@sametalmdr/word-editor 0.2.0-alpha → 0.3.0-alpha

package/dist/io/ooxml/export-splice.js

@@ -1,880 +1,880 @@
-// P6 piece 4b + piece 7a: re-write ONLY the `w:txbxContent` of each touched
-// container in the untouched document.xml, leaving every other byte identical.
-// NOT a full export — this produces document.xml BYTES, not a .docx package
-// (repack is piece 2). NO new anchor (the user edited an existing box's text,
-// they did not add one — a new anchor is a later slice), and the `mc:Fallback`
-// VML is never touched (§3.5 dirty-only already leaves it, and 4a measured Word
-// accepts a Choice/plain drawing whose Fallback is stale).
-//
-// FORMATTING (piece 7a, ADR-0017 opaque blobs): both `w:pPr` and `w:rPr` are
-// re-emitted, never dropped.
-//   - `w:pPr` is copied VERBATIM from the paragraph's `pPrRef` blob unless the
-//     paragraph carries an editor override — `Paragraph.jc` (ADR-0029) or
-//     `pPrOverride.ind` (ADR-0030). Then `emitParagraphProps` re-emits it in
-//     canonical CT_PPr order, every OTHER child byte-for-byte, so numPr/spacing
-//     survive an alignment or indent edit exactly as they survive a text edit.
-//   - `w:rPr` for an UNCHANGED run is its `rPrRef` blob VERBATIM (font/color/sz
-//     preserved byte-for-byte). When the user toggled a mark or changed the size
-//     (ADR-0028/0031), `emitRunProps` re-emits the blob with `w:b`/`w:i`/`w:u`/
-//     `w:sz` set to the run's current values in canonical CT_RPr order, every
-//     OTHER child carried through byte-for-byte. A run with no original rPr
-//     (freshly typed) gets a marks-only rPr, or none.
-// SCOPE: b/i/u/sz on runs, jc/ind on paragraphs. color/vertAlign/kerning/font
-// are NOT written. `w:szCs` is not updated with `w:sz` (undocumented until
-// 2026-10-17; decided by master plan MP3's Word experiment). Geometry: x/y only
-// (`buildGeometryEdits` below). New anchors, deletions and grouped multi-box are
-// later slices.
-// (Header brought up to date 2026-10-17 — until then it still said the editor
-// never edits paragraph properties and that only b/i/u were written.) 🔴 DOĞRULANMALI: an "off" mark is written as ABSENCE (no `<w:b/>`),
-// not `<w:b w:val="0"/>` — correct when the run's effective style is not bold
-// (the overwhelming text-box case), under-specified for a bold-by-default style
-// (4a did not measure Word's save-normalisation, so we stay on the plain side).
-//
-// The guarantee (§3.5, ARCHITECTURE §3.5): touch N containers -> exactly N
-// txbxContent ranges differ, every other byte is byte-identical.
-//
-// Locating the range: piece (1)'s provenance gives `documentXmlBytes` and, per
-// container, its anchor's byte range (`anchorRanges`) plus the pPr/rPr blob
-// ranges (`propBlobs`). document.xml declares its namespace prefixes only on the
-// root, so a blob cannot be scanned in isolation; the whole (original)
-// document.xml is scanned once here, and every blob element is found by its
-// start offset in that one parse.
-
-import { scanXml, findChild } from "./xml-scan.js";
-import { collectAnchors } from "./drawingml.js";
-import { W_NS, WP_NS, A_NS, WPG_NS } from "./ns.js";
-import { containerById } from "../../model/node.js";
-import { emuToPt, ptToEmu } from "./units.js";
-import { applyEdits } from "./edits.js";
-
-const encoder = new TextEncoder();
-
-// Mirrors drawingml.js's importer: these `w:val` values mean the mark is OFF, so
-// `<w:b w:val="0"/>` reads as not-bold — the exact inverse of what we write.
-const MARK_OFF_VALUES = new Set(["0", "false", "none"]);
-
-// Canonical CT_RPr child order (ECMA-376 §17.3.2.28). We only ever INSERT
-// w:b/w:i/w:u; every other child is carried through verbatim, so this table
-// exists solely to place those three at their schema-correct position relative
-// to the rest (4a's deney (d): Word tolerates non-canonical order on open, but
-// its save-normalisation was not measured, so we write canonical — güvenli taraf).
-const CT_RPR_ORDER = [
-  "rStyle", "rFonts", "b", "bCs", "i", "iCs", "caps", "smallCaps", "strike",
-  "dstrike", "outline", "shadow", "emboss", "imprint", "noProof", "snapToGrid",
-  "vanish", "webHidden", "color", "spacing", "w", "kern", "position", "sz",
-  "szCs", "highlight", "u", "effect", "bdr", "shd", "fitText", "vertAlign",
-  "rtl", "cs", "em", "lang", "eastAsianLayout", "specVanish", "oMath",
-];
-/** @type {Map<string, number>} localName -> canonical rank */
-const RPR_RANK = new Map(CT_RPR_ORDER.map((name, i) => [name, i]));
-
-// Canonical CT_PPr child order (ECMA-376 §17.3.1.26) — the pPr twin of
-// CT_RPR_ORDER above, and written to the same rule: the table is COMPLETE
-// (every child the schema's sequence defines, in schema order) even though
-// this exporter only ever INSERTS `w:jc`. Every other child is carried
-// through verbatim, so the extra names exist purely so that a future
-// editable pPr field (ind, spacing, ...) already has its slot — exactly the
-// shape CT_RPR_ORDER has, where 30+ names are ranked and only b/i/u/sz are
-// ever emitted.
-//
-// Measured 2026-08-31 before writing this (ADR-0029): 14,321 distinct pPr
-// blobs across the 46-document corpus, 0 of them in non-canonical order —
-// so a rank-based insert is safe on real Word output. The table itself is
-// derived from the SPEC, not from that corpus; the measurement only confirms
-// real documents agree with it.
-const CT_PPR_ORDER = [
-  "pStyle", "keepNext", "keepLines", "pageBreakBefore", "framePr", "widowControl",
-  "numPr", "suppressLineNumbers", "pBdr", "shd", "tabs", "suppressAutoHyphens",
-  "kinsoku", "wordWrap", "overflowPunct", "topLinePunct", "autoSpaceDE",
-  "autoSpaceDN", "bidi", "adjustRightInd", "snapToGrid", "spacing", "ind",
-  "contextualSpacing", "mirrorIndents", "suppressOverlap", "jc", "textDirection",
-  "textAlignment", "textboxTightWrap", "outlineLvl", "divId", "cnfStyle",
-  "rPr", "sectPr", "pPrChange",
-];
-/** @type {Map<string, number>} localName -> canonical rank */
-const PPR_RANK = new Map(CT_PPR_ORDER.map((name, i) => [name, i]));
-
-const OPEN_PPR = encoder.encode("<w:pPr>");
-const CLOSE_PPR = encoder.encode("</w:pPr>");
-
-const OPEN_P = encoder.encode("<w:p>");
-const CLOSE_P = encoder.encode("</w:p>");
-const OPEN_R = encoder.encode("<w:r>");
-const CLOSE_R = encoder.encode("</w:r>");
-const OPEN_RPR = encoder.encode("<w:rPr>");
-const CLOSE_RPR = encoder.encode("</w:rPr>");
-
-/**
- * @param {string} text
- * @returns {string}
- */
-function escapeXml(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-
-/** The `<w:b/>`/`<w:i/>`/`<w:u .../>` element source for a set mark. */
-const MARK_XML = { bold: "<w:b/>", italic: "<w:i/>", underline: '<w:u w:val="single"/>' };
-/** Which mark each CT_RPr child localName represents (for dropping existing ones). */
-const BIU_LOCAL = /** @type {Record<string, "bold" | "italic" | "underline" | undefined>} */ ({ b: "bold", i: "italic", u: "underline" });
-
-/**
- * Index every element in the tree by its start offset. pPr/rPr live inside
- * `w:txbxContent`, so this must descend everywhere (unlike `collectAnchors`).
- * @param {import("./xml-scan.js").XmlElement} root
- * @returns {Map<number, import("./xml-scan.js").XmlElement>}
- */
-function indexElementsByStart(root) {
-  /** @type {Map<number, import("./xml-scan.js").XmlElement>} */
-  const map = new Map();
-  const stack = [root];
-  while (stack.length > 0) {
-    const el = /** @type {import("./xml-scan.js").XmlElement} */ (stack.pop());
-    map.set(el.start, el);
-    for (const child of el.children) {
-      if (child.kind === "element") stack.push(child);
-    }
-  }
-  return map;
-}
-
-/**
- * The `w:val` of a direct `w:*` attribute, or undefined.
- * @param {import("./xml-scan.js").XmlElement} el
- * @param {string} localName
- * @returns {string | undefined}
- */
-function wAttr(el, localName) {
-  for (const a of el.attributes) {
-    if (a.uri === W_NS && a.localName === localName) return a.value;
-  }
-  return undefined;
-}
-
-/**
- * The b/i/u state an rPr element encodes, matching import's `runMarks`
- * (an off-value counts as absent).
- * @param {import("./xml-scan.js").XmlElement} rPrEl
- * @returns {{bold: boolean, italic: boolean, underline: boolean}}
- */
-function rPrMarks(rPrEl) {
-  const out = { bold: false, italic: false, underline: false };
-  for (const child of rPrEl.children) {
-    if (child.kind !== "element" || child.uri !== W_NS) continue;
-    const name = BIU_LOCAL[child.localName];
-    if (name === undefined) continue;
-    const val = wAttr(child, "val");
-    if (val === undefined || !MARK_OFF_VALUES.has(val)) out[name] = true;
-  }
-  return out;
-}
-
-/**
- * The existing direct `<w:sz w:val="N"/>` an rPr element carries, as the
- * raw XML attribute STRING — `readRPr`'s own convention (`styles-resolve.
- * js`), never converted here. `undefined` when the element carries none
- * (ADR-0028: unlike b/i/u, `sz`'s absence is not itself a target — the
- * caller decides whether that means "leave untouched" or "no override").
- * @param {import("./xml-scan.js").XmlElement} rPrEl
- * @returns {string | undefined}
- */
-function rPrSz(rPrEl) {
-  for (const child of rPrEl.children) {
-    if (child.kind !== "element" || child.uri !== W_NS || child.localName !== "sz") continue;
-    return wAttr(child, "val");
-  }
-  return undefined;
-}
-
-/**
- * Resolve a container-scoped prop ref to its original blob: the verbatim bytes
- * AND the parsed element (needed to walk/merge rPr children). Null when the run
- * or paragraph had no such property in the source.
- * @param {import("./provenance.js").Provenance} provenance
- * @param {number} containerId
- * @param {string | undefined} ref
- * @param {Map<number, import("./xml-scan.js").XmlElement>} elementByStart
- * @returns {{bytes: Uint8Array, el: import("./xml-scan.js").XmlElement | null} | null}
- */
-function resolveBlob(provenance, containerId, ref, elementByStart) {
-  if (ref === undefined) return null;
-  const byRef = provenance.propBlobs.get(containerId);
-  if (byRef === undefined) return null;
-  const range = byRef.get(ref);
-  if (range === undefined) return null;
-  return {
-    bytes: provenance.documentXmlBytes.subarray(range.start, range.end),
-    el: elementByStart.get(range.start) ?? null,
-  };
-}
-
-/**
- * Canonical `<w:b/><w:i/><w:u .../><w:sz .../>` inner for a mark set (only
- * set marks) — ordered by `RPR_RANK`, not source order: `sz` (rank 23) sorts
- * BETWEEN `i` (rank 4) and `u` (rank 26), so a naive "b then i then u then
- * sz" concatenation would have placed a fresh run's size AFTER underline,
- * violating CT_RPr's own schema order (ADR-0028, caught before this landed —
- * the three-way b/i/u concatenation happened to already be rank-ascending,
- * masking that it was never actually sorting).
- * @param {{bold: boolean, italic: boolean, underline: boolean, sz: number | undefined}} want
- * @returns {string}
- */
-function rPrInnerFromWant(want) {
-  /** @type {{rank: number, xml: string}[]} */
-  const parts = [];
-  if (want.bold) parts.push({ rank: /** @type {number} */ (RPR_RANK.get("b")), xml: MARK_XML.bold });
-  if (want.italic) parts.push({ rank: /** @type {number} */ (RPR_RANK.get("i")), xml: MARK_XML.italic });
-  if (want.underline) parts.push({ rank: /** @type {number} */ (RPR_RANK.get("u")), xml: MARK_XML.underline });
-  if (want.sz !== undefined) {
-    parts.push({ rank: /** @type {number} */ (RPR_RANK.get("sz")), xml: `<w:sz w:val="${want.sz}"/>` });
-  }
-  parts.sort((a, b) => a.rank - b.rank);
-  return parts.map((p) => p.xml).join("");
-}
-
-/**
- * Emit a run's `w:rPr` into `parts`. Unchanged -> the original blob verbatim;
- * changed -> the blob merged with `want` (b/i/u in canonical order, other
- * children byte-for-byte); no blob -> a marks-only rPr, or nothing.
- * @param {Uint8Array[]} parts
- * @param {import("../../model/node.js").Run} run
- * @param {number} containerId
- * @param {import("./provenance.js").Provenance} provenance
- * @param {Map<number, import("./xml-scan.js").XmlElement>} elementByStart
- * @returns {void}
- */
-function emitRunProps(parts, run, containerId, provenance, elementByStart) {
-  const marks = run.marks;
-  const want = {
-    bold: marks.bold === true,
-    italic: marks.italic === true,
-    underline: marks.underline === true,
-    // ADR-0028: undefined ≠ "off" here — b/i/u always have a definite
-    // target (on or off), but sz has no such target when the user never
-    // touched it; `undefined` means "leave whatever was there untouched",
-    // not "force size absent". See the szChanged gate below.
-    sz: typeof marks.sz === "number" ? marks.sz : undefined,
-  };
-  const blob = resolveBlob(provenance, containerId, marks.rPrRef, elementByStart);
-
-  if (blob === null) {
-    const inner = rPrInnerFromWant(want);
-    if (inner !== "") parts.push(encoder.encode(`<w:rPr>${inner}</w:rPr>`));
-    return;
-  }
-  if (blob.el === null) {
-    parts.push(blob.bytes); // index miss (unexpected): safest is verbatim
-    return;
-  }
-  const have = rPrMarks(blob.el);
-  const haveSzRaw = rPrSz(blob.el);
-  const haveSz = haveSzRaw !== undefined ? Number.parseInt(haveSzRaw, 10) : undefined;
-  // A change only if the model actually holds a direct override AND it
-  // differs from what the blob already says — `want.sz === undefined`
-  // never forces a change, unlike b/i/u's always-definite want.
-  const szChanged = want.sz !== undefined && want.sz !== haveSz;
-  if (have.bold === want.bold && have.italic === want.italic && have.underline === want.underline && !szChanged) {
-    parts.push(blob.bytes); // UNCHANGED -> verbatim (ADR-0017)
-    return;
-  }
-
-  // CHANGED -> re-emit with b/i/u = want (+ sz, when szChanged), canonical
-  // order, other children verbatim.
-  const bytes = provenance.documentXmlBytes;
-  /** @type {{rank: number, xml: string}[]} */
-  const toPlace = [];
-  if (want.bold) toPlace.push({ rank: /** @type {number} */ (RPR_RANK.get("b")), xml: MARK_XML.bold });
-  if (want.italic) toPlace.push({ rank: /** @type {number} */ (RPR_RANK.get("i")), xml: MARK_XML.italic });
-  if (want.underline) toPlace.push({ rank: /** @type {number} */ (RPR_RANK.get("u")), xml: MARK_XML.underline });
-  if (szChanged) {
-    toPlace.push({ rank: /** @type {number} */ (RPR_RANK.get("sz")), xml: `<w:sz w:val="${want.sz}"/>` });
-  }
-  toPlace.sort((a, b) => a.rank - b.rank);
-
-  // Would the result be an empty <w:rPr></w:rPr>? (blob held only b/i/u [+
-  // an sz now being replaced], all now off/replaced, no other children.)
-  // Then omit the rPr entirely — cleaner and identical in meaning. An
-  // UNCHANGED sz (szChanged false) still counts as "other" — it survives
-  // verbatim in the loop below, same as any child this function does not
-  // understand.
-  const hasOther = blob.el.children.some(
-    (c) =>
-      c.kind === "element" &&
-      !(c.uri === W_NS && BIU_LOCAL[c.localName] !== undefined) &&
-      !(szChanged && c.uri === W_NS && c.localName === "sz"),
-  );
-  if (!hasOther && toPlace.length === 0) return;
-
-  parts.push(OPEN_RPR);
-  let placed = 0;
-  let prevRank = -1;
-  for (const child of blob.el.children) {
-    if (child.kind !== "element") continue;
-    if (child.uri === W_NS && BIU_LOCAL[child.localName] !== undefined) {
-      continue; // drop existing b/i/u — `want` replaces them
-    }
-    if (szChanged && child.uri === W_NS && child.localName === "sz") {
-      continue; // drop the existing sz — `want.sz` replaces it
-    }
-    const rank = child.uri === W_NS && RPR_RANK.has(child.localName)
-      ? /** @type {number} */ (RPR_RANK.get(child.localName))
-      : prevRank; // unknown child keeps its predecessor's rank (stays adjacent)
-    prevRank = rank;
-    while (placed < toPlace.length && toPlace[placed].rank < rank) {
-      parts.push(encoder.encode(toPlace[placed].xml));
-      placed += 1;
-    }
-    parts.push(bytes.subarray(child.start, child.end)); // other child, verbatim
-  }
-  while (placed < toPlace.length) {
-    parts.push(encoder.encode(toPlace[placed].xml));
-    placed += 1;
-  }
-  parts.push(CLOSE_RPR);
-}
-
-/**
- * The existing direct `<w:jc w:val="..."/>` a pPr element carries, as the raw
- * XML attribute STRING (`readPPr`'s own convention). `undefined` when absent.
- * @param {import("./xml-scan.js").XmlElement} pPrEl
- * @returns {string | undefined}
- */
-function pPrJc(pPrEl) {
-  for (const child of pPrEl.children) {
-    if (child.kind !== "element" || child.uri !== W_NS || child.localName !== "jc") continue;
-    return wAttr(child, "val");
-  }
-  return undefined;
-}
-
-/**
- * A named `w:` child of a pPr element, or null.
- * @param {import("./xml-scan.js").XmlElement} pPrEl
- * @param {string} localName
- * @returns {import("./xml-scan.js").XmlElement | null}
- */
-function findPPrChild(pPrEl, localName) {
-  for (const child of pPrEl.children) {
-    if (child.kind === "element" && child.uri === W_NS && child.localName === localName) {
-      return child;
-    }
-  }
-  return null;
-}
-
-/**
- * Whether an existing `<w:ind>` already says exactly what `want` asks for.
- * Only the WANTED attributes are compared — an unmodelled attribute on the
- * element is irrelevant to whether a write is needed, and comparing it would
- * force a needless re-emit (and lose ADR-0017's verbatim guarantee) on every
- * export of a document this editor never touched.
- * @param {import("./xml-scan.js").XmlElement | null} existing
- * @param {Record<string, string>} want
- * @returns {boolean}
- */
-function indMatches(existing, want) {
-  for (const [attr, value] of Object.entries(want)) {
-    const have = existing === null ? undefined : wAttr(existing, attr);
-    if (have !== value) {
-      return false;
-    }
-  }
-  return true;
-}
-
-/**
- * The `w:ind` attribute name each writable `pPrOverride` key maps to
- * (ADR-0030). One element, four attributes — which is what makes this
- * materially harder than `<w:jc w:val>`: changing one of them means re-emitting
- * the whole element, and a naive re-emit would drop every attribute it does
- * not know about.
- * @type {Readonly<Record<string, string>>}
- */
-const IND_ATTR_BY_KEY = Object.freeze({
-  "ind.left": "left",
-  "ind.right": "right",
-  "ind.firstLine": "firstLine",
-  "ind.hanging": "hanging",
-});
-
-/**
- * The `ind.*` values a paragraph WANTS, as OOXML attribute strings — or null
- * when it carries no `ind` override at all, meaning "leave the blob alone".
- * @param {import("../../model/node.js").Paragraph} para
- * @returns {Record<string, string> | null}
- */
-function wantedInd(para) {
-  const override = para.pPrOverride;
-  if (override === undefined) {
-    return null;
-  }
-  /** @type {Record<string, string>} */
-  const want = {};
-  let any = false;
-  for (const [key, attr] of Object.entries(IND_ATTR_BY_KEY)) {
-    const value = override[key];
-    if (value !== undefined) {
-      want[attr] = String(value);
-      any = true;
-    }
-  }
-  return any ? want : null;
-}
-
-/**
- * Re-emits a `<w:ind>` element with `want`'s attributes applied over its
- * existing ones.
- *
- * 🔴 Every attribute the source element carried is written back, including
- * ones this codebase does not model (`w:leftChars`, `w:start`, ...). Measured
- * 2026-08-31: the corpus carries ONLY the four modelled attributes across
- * 46/46 documents, so this costs nothing here — but they exist in the schema,
- * the measurement cannot speak for a corpus-external document, and
- * `XmlAttribute` already holds what is needed. `emitRunProps`' own "every
- * other child, verbatim" rule, one level down: child -> attribute.
- *
- * ⚠ `XmlAttribute.value` is entity-DECODED by `xml-scan`, so it is re-escaped
- * on the way out. For `w:ind`'s integers that is a formality; the mechanism
- * has to be right regardless, because it is the path any future
- * multi-attribute element will take.
- * @param {import("./xml-scan.js").XmlElement | null} existing
- * @param {Record<string, string>} want
- * @returns {string}
- */
-function emitIndElement(existing, want) {
-  /** @type {string[]} */
-  const attrs = [];
-  const written = new Set();
-  if (existing !== null) {
-    for (const a of existing.attributes) {
-      const name = a.prefix === "" ? a.localName : `${a.prefix}:${a.localName}`;
-      const isModelled = a.uri === W_NS && want[a.localName] !== undefined;
-      const value = isModelled ? want[a.localName] : a.value;
-      if (isModelled) {
-        written.add(a.localName);
-      }
-      attrs.push(`${name}="${escapeXml(value).replace(/"/g, "&quot;")}"`);
-    }
-  }
-  for (const [attr, value] of Object.entries(want)) {
-    if (!written.has(attr)) {
-      attrs.push(`w:${attr}="${escapeXml(value)}"`);
-    }
-  }
-  return `<w:ind ${attrs.join(" ")}/>`;
-}
-
-/**
- * Emit a paragraph's `w:pPr` into `parts` — the pPr twin of `emitRunProps`,
- * same three branches: no blob -> a jc-only pPr (or nothing); unchanged ->
- * the original blob VERBATIM (ADR-0017); changed -> the blob re-emitted with
- * `w:jc` replaced at its canonical rank and EVERY OTHER CHILD carried through
- * byte-for-byte.
- *
- * SCOPE (ADR-0029): only `w:jc`. `ind`/`spacing`/`numPr`/`pStyle`/`tabs` are
- * never written — their preservation comes from the mechanism, not from
- * intent: the merge loop below skips ONLY the `jc` child and copies every
- * other one with `bytes.subarray(child.start, child.end)`.
- * @param {Uint8Array[]} parts
- * @param {import("../../model/node.js").Paragraph} para
- * @param {number} containerId
- * @param {import("./provenance.js").Provenance} provenance
- * @param {Map<number, import("./xml-scan.js").XmlElement>} elementByStart
- * @returns {void}
- */
-function emitParagraphProps(parts, para, containerId, provenance, elementByStart) {
-  // undefined means "no direct override" — NOT "force absent". Same
-  // convention `want.sz` uses in emitRunProps.
-  const wantJc = typeof para.jc === "string" ? para.jc : undefined;
-  const wantInd = wantedInd(para);
-  const blob = resolveBlob(provenance, containerId, para.pPrRef, elementByStart);
-
-  if (blob === null) {
-    // No blob at all: emit only what the model actually declares, in rank
-    // order (ind 22 before jc 26).
-    if (wantJc === undefined && wantInd === null) {
-      return;
-    }
-    const inner =
-      (wantInd === null ? "" : emitIndElement(null, wantInd)) +
-      (wantJc === undefined ? "" : `<w:jc w:val="${wantJc}"/>`);
-    parts.push(encoder.encode(`<w:pPr>${inner}</w:pPr>`));
-    return;
-  }
-  if (blob.el === null) {
-    parts.push(blob.bytes); // index miss (unexpected): safest is verbatim
-    return;
-  }
-
-  const haveIndEl = findPPrChild(blob.el, "ind");
-  const jcChanged = wantJc !== undefined && wantJc !== pPrJc(blob.el);
-  const indChanged = wantInd !== null && !indMatches(haveIndEl, wantInd);
-  if (!jcChanged && !indChanged) {
-    parts.push(blob.bytes); // UNCHANGED -> verbatim (ADR-0017)
-    return;
-  }
-
-  // ONE rank walk places both, so a paragraph whose jc AND ind both changed
-  // still comes out in canonical order — two separate walks could not, and a
-  // second pass over a rebuilt buffer is the class of bug ADR-0023's own
-  // "single edit list, single applier" rule exists to prevent.
-  const bytes = provenance.documentXmlBytes;
-  /** @type {{ rank: number, xml: string, drop: string }[]} */
-  const pending = [];
-  if (indChanged) {
-    pending.push({
-      rank: /** @type {number} */ (PPR_RANK.get("ind")),
-      xml: emitIndElement(haveIndEl, /** @type {Record<string, string>} */ (wantInd)),
-      drop: "ind",
-    });
-  }
-  if (jcChanged) {
-    pending.push({
-      rank: /** @type {number} */ (PPR_RANK.get("jc")),
-      xml: `<w:jc w:val="${wantJc}"/>`,
-      drop: "jc",
-    });
-  }
-  pending.sort((a, b) => a.rank - b.rank);
-  const dropped = new Set(pending.map((entry) => entry.drop));
-
-  parts.push(OPEN_PPR);
-  let next = 0;
-  let prevRank = -1;
-  for (const child of blob.el.children) {
-    if (child.kind !== "element") continue;
-    if (child.uri === W_NS && dropped.has(child.localName)) {
-      continue; // dropped — the pending replacement carries its attributes
-    }
-    const rank = child.uri === W_NS && PPR_RANK.has(child.localName)
-      ? /** @type {number} */ (PPR_RANK.get(child.localName))
-      : prevRank; // unknown child keeps its predecessor's rank (stays adjacent)
-    prevRank = rank;
-    while (next < pending.length && pending[next].rank < rank) {
-      parts.push(encoder.encode(pending[next].xml));
-      next += 1;
-    }
-    parts.push(bytes.subarray(child.start, child.end)); // other child, verbatim
-  }
-  while (next < pending.length) {
-    parts.push(encoder.encode(pending[next].xml));
-    next += 1;
-  }
-  parts.push(CLOSE_PPR);
-}
-
-/**
- * One paragraph -> `<w:p>[pPr][runs]</w:p>`. `w:pPr` is the paragraph's blob
- * verbatim (never edited); empty runs (the single empty run normalize keeps for
- * an empty paragraph, ADR-0021) emit nothing, so an empty paragraph is
- * `<w:p>[pPr]</w:p>` — a valid, caret-able empty paragraph.
- * @param {Uint8Array[]} parts
- * @param {import("../../model/node.js").Paragraph} para
- * @param {number} containerId
- * @param {import("./provenance.js").Provenance} provenance
- * @param {Map<number, import("./xml-scan.js").XmlElement>} elementByStart
- * @returns {void}
- */
-function emitParagraph(parts, para, containerId, provenance, elementByStart) {
-  parts.push(OPEN_P);
-  // Must precede runs (CT_P). Verbatim unless the model carries a direct jc
-  // override that differs from the blob's — see emitParagraphProps.
-  emitParagraphProps(parts, para, containerId, provenance, elementByStart);
-  for (const run of para.content) {
-    if (run.text === "") continue;
-    parts.push(OPEN_R);
-    emitRunProps(parts, run, containerId, provenance, elementByStart);
-    parts.push(encoder.encode(`<w:t xml:space="preserve">${escapeXml(run.text)}</w:t>`));
-    parts.push(CLOSE_R);
-  }
-  parts.push(CLOSE_P);
-}
-
-/**
- * Every `w:txbxContent` descendant of `el`, NOT descending into one once found
- * (a text box nested inside a text box is 0/46 in the corpus, ADR-0020 §2 — and
- * `walkDocumentOrder` excludes it for exactly that reason; this mirrors it).
- * @param {import("./xml-scan.js").XmlElement} el
- * @param {import("./xml-scan.js").XmlElement[]} out
- * @returns {import("./xml-scan.js").XmlElement[]}
- */
-function collectTxbxContents(el, out) {
-  for (const child of el.children) {
-    if (child.kind !== "element") {
-      continue;
-    }
-    if (child.uri === W_NS && child.localName === "txbxContent") {
-      out.push(child);
-    } else {
-      collectTxbxContents(child, out);
-    }
-  }
-  return out;
-}
-
-/**
- * @param {Uint8Array[]} parts
- * @returns {Uint8Array}
- */
-function concatBytes(parts) {
-  let total = 0;
-  for (const p of parts) {
-    total += p.length;
-  }
-  const out = new Uint8Array(total);
-  let at = 0;
-  for (const p of parts) {
-    out.set(p, at);
-    at += p.length;
-  }
-  return out;
-}
-
-/**
- * New document.xml bytes with ONLY each dirty container's txbxContent re-written
- * from `doc` (the EDITED document); every other byte byte-identical to the
- * original. `provenance` must be the one `importDocx` returned for `doc`'s source
- * (its `documentXmlBytes`/`anchorRanges`/`propBlobs` address the original bytes).
- * An empty `dirtyIds` returns the original bytes unchanged (a genuine no-op).
- *
- * @param {import("./provenance.js").Provenance} provenance
- * @param {import("../../model/node.js").Doc} doc  the edited document
- * @param {Iterable<import("../../model/node.js").NodeId>} dirtyIds
- * @returns {Uint8Array}
- */
-export function spliceDirtyText(provenance, doc, dirtyIds) {
-  return spliceDirty(provenance, doc, { textIds: dirtyIds }).bytes;
-}
-
-/**
- * The `wp:anchor` of container `id`, resolved through provenance. Throws — never
- * returns null — because every failure here means the provenance and the document
- * disagree, which must be loud.
- * @param {import("./provenance.js").Provenance} provenance
- * @param {Map<number, import("./xml-scan.js").XmlElement>} anchorByStart
- * @param {import("../../model/node.js").NodeId} id
- * @returns {import("./xml-scan.js").XmlElement}
- */
-function anchorFor(provenance, anchorByStart, id) {
-  const range = provenance.anchorRanges.get(id);
-  if (range === undefined) {
-    throw new Error(`splice: container ${id} has no anchor range (not an imported box)`);
-  }
-  const anchor = anchorByStart.get(range.start);
-  if (anchor === undefined) {
-    throw new Error(`splice: no anchor at byte ${range.start} for container ${id}`);
-  }
-  return anchor;
-}
-
-/**
- * The `wp:positionH`/`wp:positionV` child holding this axis's `wp:posOffset`.
- * @param {import("./xml-scan.js").XmlElement} anchor
- * @param {"x" | "y"} axis
- * @returns {import("./xml-scan.js").XmlElement | null}
- */
-function posOffsetElement(anchor, axis) {
-  const position = findChild(anchor, WP_NS, axis === "x" ? "positionH" : "positionV");
-  if (position === null || position === undefined) {
-    return null;
-  }
-  return findChild(position, WP_NS, "posOffset") ?? null;
-}
-
-/**
- * Whether this anchor's graphic is a `wpg:wgp` GROUP.
- *
- * The geometry writer must refuse groups: a group child's model coordinate is a
- * COMPOSED value (`import.js`: `x = anchorX + (offX - chOffX) * scaleX`), so
- * writing it into the anchor's own `wp:posOffset` would move the wrong thing.
- *
- * 🔴 This cannot reuse the text path's guard: that one counts `w:txbxContent`
- * under the anchor ("need 1"), which a group holding ONE text box passes
- * cleanly — measured, that proxy has never fired on this corpus. Grouping is
- * tested here directly.
- * @param {import("./xml-scan.js").XmlElement} anchor
- * @returns {boolean}
- */
-function isGroupedAnchor(anchor) {
-  const graphic = findChild(anchor, A_NS, "graphic");
-  if (graphic === null || graphic === undefined) {
-    return false;
-  }
-  const graphicData = findChild(graphic, A_NS, "graphicData");
-  if (graphicData === null || graphicData === undefined) {
-    return false;
-  }
-  const group = findChild(graphicData, WPG_NS, "wgp");
-  return group !== null && group !== undefined;
-}
-
-/**
- * @typedef {object} SkippedGeometry
- * @property {import("../../model/node.js").NodeId} containerId
- * @property {string[]} keys  the layout keys whose new value was NOT written
- * @property {"grouped" | "locked" | "unsupported-key"} reason
- */
-
-/**
- * Byte edits for the geometry the user actually changed, plus the list of
- * changes this slice REFUSES to write (never silently dropped — the caller
- * surfaces them, see `export.js`'s report).
- *
- * Only `x`/`y` are written, by replacing the digits inside `wp:posOffset`. The
- * anchor itself is never regenerated: ADR-0023's 4a experiment (Word refused a
- * document whose anchor had lost three attributes) constrains REGENERATION, and
- * a digit replacement touches no attribute at all.
- *
- * `cx`/`cy` are refused on purpose. Measured 2026-08-29: size has TWO live
- * copies inside `mc:Choice` — `wp:extent@cx/@cy` AND `wps:spPr/a:xfrm/a:ext`
- * (7,990/7,990 containers carry both) — so writing one leaves the other stale.
- * Writing both is its own slice.
- *
- * @param {import("./provenance.js").Provenance} provenance
- * @param {import("../../model/node.js").Doc} doc  the EDITED document
- * @param {import("../../model/node.js").Doc} originalDoc  the IMPORTED document (read-back baseline)
- * @param {Map<import("../../model/node.js").NodeId, Set<string>>} geometry  id -> changed layout keys
- * @param {Map<number, import("./xml-scan.js").XmlElement>} anchorByStart
- * @param {SkippedGeometry[]} skipped  appended to
- * @returns {{start: number, end: number, bytes: Uint8Array}[]}
- */
-function buildGeometryEdits(provenance, doc, originalDoc, geometry, anchorByStart, skipped) {
-  /** @type {{start: number, end: number, bytes: Uint8Array}[]} */
-  const edits = [];
-  const encoder = new TextEncoder();
-  const decoder = new TextDecoder();
-
-  for (const [id, changedKeys] of geometry) {
-    if (containerById(doc, id) === null) {
-      throw new Error(`splice: dirty geometry id ${id} is not a container in doc`);
-    }
-    const layout = doc.layout[id];
-    const before = originalDoc.layout[id];
-    if (layout === undefined || before === undefined) {
-      // A box the imported document did not position (or a brand-new one) has no
-      // original bytes to splice — new-anchor writing is a later slice.
-      skipped.push({ containerId: id, keys: [...changedKeys], reason: "unsupported-key" });
-      continue;
-    }
-
-    const anchor = anchorFor(provenance, anchorByStart, id);
-    if (isGroupedAnchor(anchor)) {
-      skipped.push({ containerId: id, keys: [...changedKeys], reason: "grouped" });
-      continue;
-    }
-    if (layout.locked === true) {
-      // `locked` means the box carries its own rotation/flip, which this codebase
-      // never renders (FIDELITY: DEGRADED). Writing posOffset would move the
-      // UNROTATED bounding box — not what the editor drew. The UI withholds the
-      // drag affordance but the keyboard nudge path does not check `locked`, so
-      // the refusal has to live here, not in the UI.
-      skipped.push({ containerId: id, keys: [...changedKeys], reason: "locked" });
-      continue;
-    }
-
-    /** @type {string[]} */
-    const refusedKeys = [];
-    for (const key of changedKeys) {
-      if (key !== "x" && key !== "y") {
-        refusedKeys.push(key);
-        continue;
-      }
-      const element = posOffsetElement(anchor, key);
-      if (element === null) {
-        refusedKeys.push(key);
-        continue;
-      }
-
-      // READ-BACK: the digits currently in these bytes must decode to the value
-      // the IMPORTED model holds for this key. Exact by construction (import
-      // computed layout[key] from precisely this text), so a mismatch means the
-      // provenance and the document disagree — a bug, not a user situation.
-      const currentText = decoder.decode(provenance.documentXmlBytes.subarray(element.contentStart, element.contentEnd));
-      const currentEmu = Number.parseInt(currentText, 10);
-      if (!Number.isFinite(currentEmu) || emuToPt(currentEmu) !== before[key]) {
-        throw new Error(
-          `splice: read-back mismatch for container ${id} ${key} — document says ${currentText} ` +
-            `(${emuToPt(currentEmu)} pt) but the imported model says ${before[key]} pt`,
-        );
-      }
-
-      edits.push({
-        start: element.contentStart,
-        end: element.contentEnd,
-        bytes: encoder.encode(String(ptToEmu(/** @type {number} */ (layout[key])))),
-      });
-    }
-    if (refusedKeys.length > 0) {
-      skipped.push({ containerId: id, keys: refusedKeys, reason: "unsupported-key" });
-    }
-  }
-  return edits;
-}
-
-/**
- * New document.xml bytes with the touched containers' text AND geometry
- * re-written from `doc`; every other byte byte-identical to the original.
- *
- * @param {import("./provenance.js").Provenance} provenance
- * @param {import("../../model/node.js").Doc} doc  the edited document
- * @param {object} dirty
- * @param {Iterable<import("../../model/node.js").NodeId>} [dirty.textIds]
- * @param {Map<import("../../model/node.js").NodeId, Set<string>>} [dirty.geometry]
- * @param {import("../../model/node.js").Doc} [dirty.originalDoc]  required when `geometry` is non-empty
- * @returns {{bytes: Uint8Array, skippedGeometry: SkippedGeometry[]}}  `bytes` is
- *   the ORIGINAL reference when nothing was written (export.js depends on that
- *   identity to skip repacking entirely)
- */
-export function spliceDirty(provenance, doc, { textIds = [], geometry = new Map(), originalDoc } = {}) {
-  const original = provenance.documentXmlBytes;
-  const ids = [...new Set(textIds)];
-  /** @type {SkippedGeometry[]} */
-  const skippedGeometry = [];
-  if (ids.length === 0 && geometry.size === 0) {
-    return { bytes: original, skippedGeometry };
-  }
-
-  const { root } = scanXml(original);
-  const elementByStart = indexElementsByStart(root);
-  /** @type {Map<number, import("./xml-scan.js").XmlElement>} */
-  const anchorByStart = new Map();
-  for (const anchor of collectAnchors(root)) {
-    anchorByStart.set(anchor.start, anchor);
-  }
-
-  /** @type {{start: number, end: number, bytes: Uint8Array}[]} */
-  const edits = [];
-  for (const id of ids) {
-    const container = containerById(doc, id);
-    if (container === null) {
-      throw new Error(`spliceDirtyText: dirty id ${id} is not a container in doc`);
-    }
-    const anchor = anchorFor(provenance, anchorByStart, id);
-    const txbxes = collectTxbxContents(anchor, []);
-    if (txbxes.length !== 1) {
-      // Narrowest slice: exactly one text box per touched anchor. A grouped
-      // multi-box anchor (several txbxContent sharing one anchor range) cannot
-      // be disambiguated from the anchor range alone — that is a later slice.
-      throw new Error(
-        `spliceDirtyText: container ${id}'s anchor holds ${txbxes.length} txbxContent (need 1) — grouped multi-box is a later slice`,
-      );
-    }
-    const txbx = txbxes[0];
-    /** @type {Uint8Array[]} */
-    const parts = [];
-    for (const para of container.content) {
-      emitParagraph(parts, para, id, provenance, elementByStart);
-    }
-    edits.push({ start: txbx.contentStart, end: txbx.contentEnd, bytes: concatBytes(parts) });
-  }
-
-  if (geometry.size > 0) {
-    if (originalDoc === undefined) {
-      throw new Error("spliceDirty: geometry edits need `originalDoc` (the imported document) for the read-back check");
-    }
-    edits.push(...buildGeometryEdits(provenance, doc, originalDoc, geometry, anchorByStart, skippedGeometry));
-  }
-
-  // ONE application pass for text AND geometry together — see applyEdits for why
-  // a second pass over the rebuilt buffer would be a silent corruption.
-  return { bytes: applyEdits(original, edits), skippedGeometry };
-}
+// P6 piece 4b + piece 7a: re-write ONLY the `w:txbxContent` of each touched
+// container in the untouched document.xml, leaving every other byte identical.
+// NOT a full export — this produces document.xml BYTES, not a .docx package
+// (repack is piece 2). NO new anchor (the user edited an existing box's text,
+// they did not add one — a new anchor is a later slice), and the `mc:Fallback`
+// VML is never touched (§3.5 dirty-only already leaves it, and 4a measured Word
+// accepts a Choice/plain drawing whose Fallback is stale).
+//
+// FORMATTING (piece 7a, ADR-0017 opaque blobs): both `w:pPr` and `w:rPr` are
+// re-emitted, never dropped.
+//   - `w:pPr` is copied VERBATIM from the paragraph's `pPrRef` blob unless the
+//     paragraph carries an editor override — `Paragraph.jc` (ADR-0029) or
+//     `pPrOverride.ind` (ADR-0030). Then `emitParagraphProps` re-emits it in
+//     canonical CT_PPr order, every OTHER child byte-for-byte, so numPr/spacing
+//     survive an alignment or indent edit exactly as they survive a text edit.
+//   - `w:rPr` for an UNCHANGED run is its `rPrRef` blob VERBATIM (font/color/sz
+//     preserved byte-for-byte). When the user toggled a mark or changed the size
+//     (ADR-0028/0031), `emitRunProps` re-emits the blob with `w:b`/`w:i`/`w:u`/
+//     `w:sz` set to the run's current values in canonical CT_RPr order, every
+//     OTHER child carried through byte-for-byte. A run with no original rPr
+//     (freshly typed) gets a marks-only rPr, or none.
+// SCOPE: b/i/u/sz on runs, jc/ind on paragraphs. color/vertAlign/kerning/font
+// are NOT written. `w:szCs` is not updated with `w:sz` (undocumented until
+// 2026-10-17; decided by master plan MP3's Word experiment). Geometry: x/y only
+// (`buildGeometryEdits` below). New anchors, deletions and grouped multi-box are
+// later slices.
+// (Header brought up to date 2026-10-17 — until then it still said the editor
+// never edits paragraph properties and that only b/i/u were written.) 🔴 DOĞRULANMALI: an "off" mark is written as ABSENCE (no `<w:b/>`),
+// not `<w:b w:val="0"/>` — correct when the run's effective style is not bold
+// (the overwhelming text-box case), under-specified for a bold-by-default style
+// (4a did not measure Word's save-normalisation, so we stay on the plain side).
+//
+// The guarantee (§3.5, ARCHITECTURE §3.5): touch N containers -> exactly N
+// txbxContent ranges differ, every other byte is byte-identical.
+//
+// Locating the range: piece (1)'s provenance gives `documentXmlBytes` and, per
+// container, its anchor's byte range (`anchorRanges`) plus the pPr/rPr blob
+// ranges (`propBlobs`). document.xml declares its namespace prefixes only on the
+// root, so a blob cannot be scanned in isolation; the whole (original)
+// document.xml is scanned once here, and every blob element is found by its
+// start offset in that one parse.
+
+import { scanXml, findChild } from "./xml-scan.js";
+import { collectAnchors } from "./drawingml.js";
+import { W_NS, WP_NS, A_NS, WPG_NS } from "./ns.js";
+import { containerById } from "../../model/node.js";
+import { emuToPt, ptToEmu } from "./units.js";
+import { applyEdits } from "./edits.js";
+
+const encoder = new TextEncoder();
+
+// Mirrors drawingml.js's importer: these `w:val` values mean the mark is OFF, so
+// `<w:b w:val="0"/>` reads as not-bold — the exact inverse of what we write.
+const MARK_OFF_VALUES = new Set(["0", "false", "none"]);
+
+// Canonical CT_RPr child order (ECMA-376 §17.3.2.28). We only ever INSERT
+// w:b/w:i/w:u; every other child is carried through verbatim, so this table
+// exists solely to place those three at their schema-correct position relative
+// to the rest (4a's deney (d): Word tolerates non-canonical order on open, but
+// its save-normalisation was not measured, so we write canonical — güvenli taraf).
+const CT_RPR_ORDER = [
+  "rStyle", "rFonts", "b", "bCs", "i", "iCs", "caps", "smallCaps", "strike",
+  "dstrike", "outline", "shadow", "emboss", "imprint", "noProof", "snapToGrid",
+  "vanish", "webHidden", "color", "spacing", "w", "kern", "position", "sz",
+  "szCs", "highlight", "u", "effect", "bdr", "shd", "fitText", "vertAlign",
+  "rtl", "cs", "em", "lang", "eastAsianLayout", "specVanish", "oMath",
+];
+/** @type {Map<string, number>} localName -> canonical rank */
+const RPR_RANK = new Map(CT_RPR_ORDER.map((name, i) => [name, i]));
+
+// Canonical CT_PPr child order (ECMA-376 §17.3.1.26) — the pPr twin of
+// CT_RPR_ORDER above, and written to the same rule: the table is COMPLETE
+// (every child the schema's sequence defines, in schema order) even though
+// this exporter only ever INSERTS `w:jc`. Every other child is carried
+// through verbatim, so the extra names exist purely so that a future
+// editable pPr field (ind, spacing, ...) already has its slot — exactly the
+// shape CT_RPR_ORDER has, where 30+ names are ranked and only b/i/u/sz are
+// ever emitted.
+//
+// Measured 2026-08-31 before writing this (ADR-0029): 14,321 distinct pPr
+// blobs across the 46-document corpus, 0 of them in non-canonical order —
+// so a rank-based insert is safe on real Word output. The table itself is
+// derived from the SPEC, not from that corpus; the measurement only confirms
+// real documents agree with it.
+const CT_PPR_ORDER = [
+  "pStyle", "keepNext", "keepLines", "pageBreakBefore", "framePr", "widowControl",
+  "numPr", "suppressLineNumbers", "pBdr", "shd", "tabs", "suppressAutoHyphens",
+  "kinsoku", "wordWrap", "overflowPunct", "topLinePunct", "autoSpaceDE",
+  "autoSpaceDN", "bidi", "adjustRightInd", "snapToGrid", "spacing", "ind",
+  "contextualSpacing", "mirrorIndents", "suppressOverlap", "jc", "textDirection",
+  "textAlignment", "textboxTightWrap", "outlineLvl", "divId", "cnfStyle",
+  "rPr", "sectPr", "pPrChange",
+];
+/** @type {Map<string, number>} localName -> canonical rank */
+const PPR_RANK = new Map(CT_PPR_ORDER.map((name, i) => [name, i]));
+
+const OPEN_PPR = encoder.encode("<w:pPr>");
+const CLOSE_PPR = encoder.encode("</w:pPr>");
+
+const OPEN_P = encoder.encode("<w:p>");
+const CLOSE_P = encoder.encode("</w:p>");
+const OPEN_R = encoder.encode("<w:r>");
+const CLOSE_R = encoder.encode("</w:r>");
+const OPEN_RPR = encoder.encode("<w:rPr>");
+const CLOSE_RPR = encoder.encode("</w:rPr>");
+
+/**
+ * @param {string} text
+ * @returns {string}
+ */
+function escapeXml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+
+/** The `<w:b/>`/`<w:i/>`/`<w:u .../>` element source for a set mark. */
+const MARK_XML = { bold: "<w:b/>", italic: "<w:i/>", underline: '<w:u w:val="single"/>' };
+/** Which mark each CT_RPr child localName represents (for dropping existing ones). */
+const BIU_LOCAL = /** @type {Record<string, "bold" | "italic" | "underline" | undefined>} */ ({ b: "bold", i: "italic", u: "underline" });
+
+/**
+ * Index every element in the tree by its start offset. pPr/rPr live inside
+ * `w:txbxContent`, so this must descend everywhere (unlike `collectAnchors`).
+ * @param {import("./xml-scan.js").XmlElement} root
+ * @returns {Map<number, import("./xml-scan.js").XmlElement>}
+ */
+function indexElementsByStart(root) {
+  /** @type {Map<number, import("./xml-scan.js").XmlElement>} */
+  const map = new Map();
+  const stack = [root];
+  while (stack.length > 0) {
+    const el = /** @type {import("./xml-scan.js").XmlElement} */ (stack.pop());
+    map.set(el.start, el);
+    for (const child of el.children) {
+      if (child.kind === "element") stack.push(child);
+    }
+  }
+  return map;
+}
+
+/**
+ * The `w:val` of a direct `w:*` attribute, or undefined.
+ * @param {import("./xml-scan.js").XmlElement} el
+ * @param {string} localName
+ * @returns {string | undefined}
+ */
+function wAttr(el, localName) {
+  for (const a of el.attributes) {
+    if (a.uri === W_NS && a.localName === localName) return a.value;
+  }
+  return undefined;
+}
+
+/**
+ * The b/i/u state an rPr element encodes, matching import's `runMarks`
+ * (an off-value counts as absent).
+ * @param {import("./xml-scan.js").XmlElement} rPrEl
+ * @returns {{bold: boolean, italic: boolean, underline: boolean}}
+ */
+function rPrMarks(rPrEl) {
+  const out = { bold: false, italic: false, underline: false };
+  for (const child of rPrEl.children) {
+    if (child.kind !== "element" || child.uri !== W_NS) continue;
+    const name = BIU_LOCAL[child.localName];
+    if (name === undefined) continue;
+    const val = wAttr(child, "val");
+    if (val === undefined || !MARK_OFF_VALUES.has(val)) out[name] = true;
+  }
+  return out;
+}
+
+/**
+ * The existing direct `<w:sz w:val="N"/>` an rPr element carries, as the
+ * raw XML attribute STRING — `readRPr`'s own convention (`styles-resolve.
+ * js`), never converted here. `undefined` when the element carries none
+ * (ADR-0028: unlike b/i/u, `sz`'s absence is not itself a target — the
+ * caller decides whether that means "leave untouched" or "no override").
+ * @param {import("./xml-scan.js").XmlElement} rPrEl
+ * @returns {string | undefined}
+ */
+function rPrSz(rPrEl) {
+  for (const child of rPrEl.children) {
+    if (child.kind !== "element" || child.uri !== W_NS || child.localName !== "sz") continue;
+    return wAttr(child, "val");
+  }
+  return undefined;
+}
+
+/**
+ * Resolve a container-scoped prop ref to its original blob: the verbatim bytes
+ * AND the parsed element (needed to walk/merge rPr children). Null when the run
+ * or paragraph had no such property in the source.
+ * @param {import("./provenance.js").Provenance} provenance
+ * @param {number} containerId
+ * @param {string | undefined} ref
+ * @param {Map<number, import("./xml-scan.js").XmlElement>} elementByStart
+ * @returns {{bytes: Uint8Array, el: import("./xml-scan.js").XmlElement | null} | null}
+ */
+function resolveBlob(provenance, containerId, ref, elementByStart) {
+  if (ref === undefined) return null;
+  const byRef = provenance.propBlobs.get(containerId);
+  if (byRef === undefined) return null;
+  const range = byRef.get(ref);
+  if (range === undefined) return null;
+  return {
+    bytes: provenance.documentXmlBytes.subarray(range.start, range.end),
+    el: elementByStart.get(range.start) ?? null,
+  };
+}
+
+/**
+ * Canonical `<w:b/><w:i/><w:u .../><w:sz .../>` inner for a mark set (only
+ * set marks) — ordered by `RPR_RANK`, not source order: `sz` (rank 23) sorts
+ * BETWEEN `i` (rank 4) and `u` (rank 26), so a naive "b then i then u then
+ * sz" concatenation would have placed a fresh run's size AFTER underline,
+ * violating CT_RPr's own schema order (ADR-0028, caught before this landed —
+ * the three-way b/i/u concatenation happened to already be rank-ascending,
+ * masking that it was never actually sorting).
+ * @param {{bold: boolean, italic: boolean, underline: boolean, sz: number | undefined}} want
+ * @returns {string}
+ */
+function rPrInnerFromWant(want) {
+  /** @type {{rank: number, xml: string}[]} */
+  const parts = [];
+  if (want.bold) parts.push({ rank: /** @type {number} */ (RPR_RANK.get("b")), xml: MARK_XML.bold });
+  if (want.italic) parts.push({ rank: /** @type {number} */ (RPR_RANK.get("i")), xml: MARK_XML.italic });
+  if (want.underline) parts.push({ rank: /** @type {number} */ (RPR_RANK.get("u")), xml: MARK_XML.underline });
+  if (want.sz !== undefined) {
+    parts.push({ rank: /** @type {number} */ (RPR_RANK.get("sz")), xml: `<w:sz w:val="${want.sz}"/>` });
+  }
+  parts.sort((a, b) => a.rank - b.rank);
+  return parts.map((p) => p.xml).join("");
+}
+
+/**
+ * Emit a run's `w:rPr` into `parts`. Unchanged -> the original blob verbatim;
+ * changed -> the blob merged with `want` (b/i/u in canonical order, other
+ * children byte-for-byte); no blob -> a marks-only rPr, or nothing.
+ * @param {Uint8Array[]} parts
+ * @param {import("../../model/node.js").Run} run
+ * @param {number} containerId
+ * @param {import("./provenance.js").Provenance} provenance
+ * @param {Map<number, import("./xml-scan.js").XmlElement>} elementByStart
+ * @returns {void}
+ */
+function emitRunProps(parts, run, containerId, provenance, elementByStart) {
+  const marks = run.marks;
+  const want = {
+    bold: marks.bold === true,
+    italic: marks.italic === true,
+    underline: marks.underline === true,
+    // ADR-0028: undefined ≠ "off" here — b/i/u always have a definite
+    // target (on or off), but sz has no such target when the user never
+    // touched it; `undefined` means "leave whatever was there untouched",
+    // not "force size absent". See the szChanged gate below.
+    sz: typeof marks.sz === "number" ? marks.sz : undefined,
+  };
+  const blob = resolveBlob(provenance, containerId, marks.rPrRef, elementByStart);
+
+  if (blob === null) {
+    const inner = rPrInnerFromWant(want);
+    if (inner !== "") parts.push(encoder.encode(`<w:rPr>${inner}</w:rPr>`));
+    return;
+  }
+  if (blob.el === null) {
+    parts.push(blob.bytes); // index miss (unexpected): safest is verbatim
+    return;
+  }
+  const have = rPrMarks(blob.el);
+  const haveSzRaw = rPrSz(blob.el);
+  const haveSz = haveSzRaw !== undefined ? Number.parseInt(haveSzRaw, 10) : undefined;
+  // A change only if the model actually holds a direct override AND it
+  // differs from what the blob already says — `want.sz === undefined`
+  // never forces a change, unlike b/i/u's always-definite want.
+  const szChanged = want.sz !== undefined && want.sz !== haveSz;
+  if (have.bold === want.bold && have.italic === want.italic && have.underline === want.underline && !szChanged) {
+    parts.push(blob.bytes); // UNCHANGED -> verbatim (ADR-0017)
+    return;
+  }
+
+  // CHANGED -> re-emit with b/i/u = want (+ sz, when szChanged), canonical
+  // order, other children verbatim.
+  const bytes = provenance.documentXmlBytes;
+  /** @type {{rank: number, xml: string}[]} */
+  const toPlace = [];
+  if (want.bold) toPlace.push({ rank: /** @type {number} */ (RPR_RANK.get("b")), xml: MARK_XML.bold });
+  if (want.italic) toPlace.push({ rank: /** @type {number} */ (RPR_RANK.get("i")), xml: MARK_XML.italic });
+  if (want.underline) toPlace.push({ rank: /** @type {number} */ (RPR_RANK.get("u")), xml: MARK_XML.underline });
+  if (szChanged) {
+    toPlace.push({ rank: /** @type {number} */ (RPR_RANK.get("sz")), xml: `<w:sz w:val="${want.sz}"/>` });
+  }
+  toPlace.sort((a, b) => a.rank - b.rank);
+
+  // Would the result be an empty <w:rPr></w:rPr>? (blob held only b/i/u [+
+  // an sz now being replaced], all now off/replaced, no other children.)
+  // Then omit the rPr entirely — cleaner and identical in meaning. An
+  // UNCHANGED sz (szChanged false) still counts as "other" — it survives
+  // verbatim in the loop below, same as any child this function does not
+  // understand.
+  const hasOther = blob.el.children.some(
+    (c) =>
+      c.kind === "element" &&
+      !(c.uri === W_NS && BIU_LOCAL[c.localName] !== undefined) &&
+      !(szChanged && c.uri === W_NS && c.localName === "sz"),
+  );
+  if (!hasOther && toPlace.length === 0) return;
+
+  parts.push(OPEN_RPR);
+  let placed = 0;
+  let prevRank = -1;
+  for (const child of blob.el.children) {
+    if (child.kind !== "element") continue;
+    if (child.uri === W_NS && BIU_LOCAL[child.localName] !== undefined) {
+      continue; // drop existing b/i/u — `want` replaces them
+    }
+    if (szChanged && child.uri === W_NS && child.localName === "sz") {
+      continue; // drop the existing sz — `want.sz` replaces it
+    }
+    const rank = child.uri === W_NS && RPR_RANK.has(child.localName)
+      ? /** @type {number} */ (RPR_RANK.get(child.localName))
+      : prevRank; // unknown child keeps its predecessor's rank (stays adjacent)
+    prevRank = rank;
+    while (placed < toPlace.length && toPlace[placed].rank < rank) {
+      parts.push(encoder.encode(toPlace[placed].xml));
+      placed += 1;
+    }
+    parts.push(bytes.subarray(child.start, child.end)); // other child, verbatim
+  }
+  while (placed < toPlace.length) {
+    parts.push(encoder.encode(toPlace[placed].xml));
+    placed += 1;
+  }
+  parts.push(CLOSE_RPR);
+}
+
+/**
+ * The existing direct `<w:jc w:val="..."/>` a pPr element carries, as the raw
+ * XML attribute STRING (`readPPr`'s own convention). `undefined` when absent.
+ * @param {import("./xml-scan.js").XmlElement} pPrEl
+ * @returns {string | undefined}
+ */
+function pPrJc(pPrEl) {
+  for (const child of pPrEl.children) {
+    if (child.kind !== "element" || child.uri !== W_NS || child.localName !== "jc") continue;
+    return wAttr(child, "val");
+  }
+  return undefined;
+}
+
+/**
+ * A named `w:` child of a pPr element, or null.
+ * @param {import("./xml-scan.js").XmlElement} pPrEl
+ * @param {string} localName
+ * @returns {import("./xml-scan.js").XmlElement | null}
+ */
+function findPPrChild(pPrEl, localName) {
+  for (const child of pPrEl.children) {
+    if (child.kind === "element" && child.uri === W_NS && child.localName === localName) {
+      return child;
+    }
+  }
+  return null;
+}
+
+/**
+ * Whether an existing `<w:ind>` already says exactly what `want` asks for.
+ * Only the WANTED attributes are compared — an unmodelled attribute on the
+ * element is irrelevant to whether a write is needed, and comparing it would
+ * force a needless re-emit (and lose ADR-0017's verbatim guarantee) on every
+ * export of a document this editor never touched.
+ * @param {import("./xml-scan.js").XmlElement | null} existing
+ * @param {Record<string, string>} want
+ * @returns {boolean}
+ */
+function indMatches(existing, want) {
+  for (const [attr, value] of Object.entries(want)) {
+    const have = existing === null ? undefined : wAttr(existing, attr);
+    if (have !== value) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/**
+ * The `w:ind` attribute name each writable `pPrOverride` key maps to
+ * (ADR-0030). One element, four attributes — which is what makes this
+ * materially harder than `<w:jc w:val>`: changing one of them means re-emitting
+ * the whole element, and a naive re-emit would drop every attribute it does
+ * not know about.
+ * @type {Readonly<Record<string, string>>}
+ */
+const IND_ATTR_BY_KEY = Object.freeze({
+  "ind.left": "left",
+  "ind.right": "right",
+  "ind.firstLine": "firstLine",
+  "ind.hanging": "hanging",
+});
+
+/**
+ * The `ind.*` values a paragraph WANTS, as OOXML attribute strings — or null
+ * when it carries no `ind` override at all, meaning "leave the blob alone".
+ * @param {import("../../model/node.js").Paragraph} para
+ * @returns {Record<string, string> | null}
+ */
+function wantedInd(para) {
+  const override = para.pPrOverride;
+  if (override === undefined) {
+    return null;
+  }
+  /** @type {Record<string, string>} */
+  const want = {};
+  let any = false;
+  for (const [key, attr] of Object.entries(IND_ATTR_BY_KEY)) {
+    const value = override[key];
+    if (value !== undefined) {
+      want[attr] = String(value);
+      any = true;
+    }
+  }
+  return any ? want : null;
+}
+
+/**
+ * Re-emits a `<w:ind>` element with `want`'s attributes applied over its
+ * existing ones.
+ *
+ * 🔴 Every attribute the source element carried is written back, including
+ * ones this codebase does not model (`w:leftChars`, `w:start`, ...). Measured
+ * 2026-08-31: the corpus carries ONLY the four modelled attributes across
+ * 46/46 documents, so this costs nothing here — but they exist in the schema,
+ * the measurement cannot speak for a corpus-external document, and
+ * `XmlAttribute` already holds what is needed. `emitRunProps`' own "every
+ * other child, verbatim" rule, one level down: child -> attribute.
+ *
+ * ⚠ `XmlAttribute.value` is entity-DECODED by `xml-scan`, so it is re-escaped
+ * on the way out. For `w:ind`'s integers that is a formality; the mechanism
+ * has to be right regardless, because it is the path any future
+ * multi-attribute element will take.
+ * @param {import("./xml-scan.js").XmlElement | null} existing
+ * @param {Record<string, string>} want
+ * @returns {string}
+ */
+function emitIndElement(existing, want) {
+  /** @type {string[]} */
+  const attrs = [];
+  const written = new Set();
+  if (existing !== null) {
+    for (const a of existing.attributes) {
+      const name = a.prefix === "" ? a.localName : `${a.prefix}:${a.localName}`;
+      const isModelled = a.uri === W_NS && want[a.localName] !== undefined;
+      const value = isModelled ? want[a.localName] : a.value;
+      if (isModelled) {
+        written.add(a.localName);
+      }
+      attrs.push(`${name}="${escapeXml(value).replace(/"/g, "&quot;")}"`);
+    }
+  }
+  for (const [attr, value] of Object.entries(want)) {
+    if (!written.has(attr)) {
+      attrs.push(`w:${attr}="${escapeXml(value)}"`);
+    }
+  }
+  return `<w:ind ${attrs.join(" ")}/>`;
+}
+
+/**
+ * Emit a paragraph's `w:pPr` into `parts` — the pPr twin of `emitRunProps`,
+ * same three branches: no blob -> a jc-only pPr (or nothing); unchanged ->
+ * the original blob VERBATIM (ADR-0017); changed -> the blob re-emitted with
+ * `w:jc` replaced at its canonical rank and EVERY OTHER CHILD carried through
+ * byte-for-byte.
+ *
+ * SCOPE (ADR-0029): only `w:jc`. `ind`/`spacing`/`numPr`/`pStyle`/`tabs` are
+ * never written — their preservation comes from the mechanism, not from
+ * intent: the merge loop below skips ONLY the `jc` child and copies every
+ * other one with `bytes.subarray(child.start, child.end)`.
+ * @param {Uint8Array[]} parts
+ * @param {import("../../model/node.js").Paragraph} para
+ * @param {number} containerId
+ * @param {import("./provenance.js").Provenance} provenance
+ * @param {Map<number, import("./xml-scan.js").XmlElement>} elementByStart
+ * @returns {void}
+ */
+function emitParagraphProps(parts, para, containerId, provenance, elementByStart) {
+  // undefined means "no direct override" — NOT "force absent". Same
+  // convention `want.sz` uses in emitRunProps.
+  const wantJc = typeof para.jc === "string" ? para.jc : undefined;
+  const wantInd = wantedInd(para);
+  const blob = resolveBlob(provenance, containerId, para.pPrRef, elementByStart);
+
+  if (blob === null) {
+    // No blob at all: emit only what the model actually declares, in rank
+    // order (ind 22 before jc 26).
+    if (wantJc === undefined && wantInd === null) {
+      return;
+    }
+    const inner =
+      (wantInd === null ? "" : emitIndElement(null, wantInd)) +
+      (wantJc === undefined ? "" : `<w:jc w:val="${wantJc}"/>`);
+    parts.push(encoder.encode(`<w:pPr>${inner}</w:pPr>`));
+    return;
+  }
+  if (blob.el === null) {
+    parts.push(blob.bytes); // index miss (unexpected): safest is verbatim
+    return;
+  }
+
+  const haveIndEl = findPPrChild(blob.el, "ind");
+  const jcChanged = wantJc !== undefined && wantJc !== pPrJc(blob.el);
+  const indChanged = wantInd !== null && !indMatches(haveIndEl, wantInd);
+  if (!jcChanged && !indChanged) {
+    parts.push(blob.bytes); // UNCHANGED -> verbatim (ADR-0017)
+    return;
+  }
+
+  // ONE rank walk places both, so a paragraph whose jc AND ind both changed
+  // still comes out in canonical order — two separate walks could not, and a
+  // second pass over a rebuilt buffer is the class of bug ADR-0023's own
+  // "single edit list, single applier" rule exists to prevent.
+  const bytes = provenance.documentXmlBytes;
+  /** @type {{ rank: number, xml: string, drop: string }[]} */
+  const pending = [];
+  if (indChanged) {
+    pending.push({
+      rank: /** @type {number} */ (PPR_RANK.get("ind")),
+      xml: emitIndElement(haveIndEl, /** @type {Record<string, string>} */ (wantInd)),
+      drop: "ind",
+    });
+  }
+  if (jcChanged) {
+    pending.push({
+      rank: /** @type {number} */ (PPR_RANK.get("jc")),
+      xml: `<w:jc w:val="${wantJc}"/>`,
+      drop: "jc",
+    });
+  }
+  pending.sort((a, b) => a.rank - b.rank);
+  const dropped = new Set(pending.map((entry) => entry.drop));
+
+  parts.push(OPEN_PPR);
+  let next = 0;
+  let prevRank = -1;
+  for (const child of blob.el.children) {
+    if (child.kind !== "element") continue;
+    if (child.uri === W_NS && dropped.has(child.localName)) {
+      continue; // dropped — the pending replacement carries its attributes
+    }
+    const rank = child.uri === W_NS && PPR_RANK.has(child.localName)
+      ? /** @type {number} */ (PPR_RANK.get(child.localName))
+      : prevRank; // unknown child keeps its predecessor's rank (stays adjacent)
+    prevRank = rank;
+    while (next < pending.length && pending[next].rank < rank) {
+      parts.push(encoder.encode(pending[next].xml));
+      next += 1;
+    }
+    parts.push(bytes.subarray(child.start, child.end)); // other child, verbatim
+  }
+  while (next < pending.length) {
+    parts.push(encoder.encode(pending[next].xml));
+    next += 1;
+  }
+  parts.push(CLOSE_PPR);
+}
+
+/**
+ * One paragraph -> `<w:p>[pPr][runs]</w:p>`. `w:pPr` is the paragraph's blob
+ * verbatim (never edited); empty runs (the single empty run normalize keeps for
+ * an empty paragraph, ADR-0021) emit nothing, so an empty paragraph is
+ * `<w:p>[pPr]</w:p>` — a valid, caret-able empty paragraph.
+ * @param {Uint8Array[]} parts
+ * @param {import("../../model/node.js").Paragraph} para
+ * @param {number} containerId
+ * @param {import("./provenance.js").Provenance} provenance
+ * @param {Map<number, import("./xml-scan.js").XmlElement>} elementByStart
+ * @returns {void}
+ */
+function emitParagraph(parts, para, containerId, provenance, elementByStart) {
+  parts.push(OPEN_P);
+  // Must precede runs (CT_P). Verbatim unless the model carries a direct jc
+  // override that differs from the blob's — see emitParagraphProps.
+  emitParagraphProps(parts, para, containerId, provenance, elementByStart);
+  for (const run of para.content) {
+    if (run.text === "") continue;
+    parts.push(OPEN_R);
+    emitRunProps(parts, run, containerId, provenance, elementByStart);
+    parts.push(encoder.encode(`<w:t xml:space="preserve">${escapeXml(run.text)}</w:t>`));
+    parts.push(CLOSE_R);
+  }
+  parts.push(CLOSE_P);
+}
+
+/**
+ * Every `w:txbxContent` descendant of `el`, NOT descending into one once found
+ * (a text box nested inside a text box is 0/46 in the corpus, ADR-0020 §2 — and
+ * `walkDocumentOrder` excludes it for exactly that reason; this mirrors it).
+ * @param {import("./xml-scan.js").XmlElement} el
+ * @param {import("./xml-scan.js").XmlElement[]} out
+ * @returns {import("./xml-scan.js").XmlElement[]}
+ */
+function collectTxbxContents(el, out) {
+  for (const child of el.children) {
+    if (child.kind !== "element") {
+      continue;
+    }
+    if (child.uri === W_NS && child.localName === "txbxContent") {
+      out.push(child);
+    } else {
+      collectTxbxContents(child, out);
+    }
+  }
+  return out;
+}
+
+/**
+ * @param {Uint8Array[]} parts
+ * @returns {Uint8Array}
+ */
+function concatBytes(parts) {
+  let total = 0;
+  for (const p of parts) {
+    total += p.length;
+  }
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.length;
+  }
+  return out;
+}
+
+/**
+ * New document.xml bytes with ONLY each dirty container's txbxContent re-written
+ * from `doc` (the EDITED document); every other byte byte-identical to the
+ * original. `provenance` must be the one `importDocx` returned for `doc`'s source
+ * (its `documentXmlBytes`/`anchorRanges`/`propBlobs` address the original bytes).
+ * An empty `dirtyIds` returns the original bytes unchanged (a genuine no-op).
+ *
+ * @param {import("./provenance.js").Provenance} provenance
+ * @param {import("../../model/node.js").Doc} doc  the edited document
+ * @param {Iterable<import("../../model/node.js").NodeId>} dirtyIds
+ * @returns {Uint8Array}
+ */
+export function spliceDirtyText(provenance, doc, dirtyIds) {
+  return spliceDirty(provenance, doc, { textIds: dirtyIds }).bytes;
+}
+
+/**
+ * The `wp:anchor` of container `id`, resolved through provenance. Throws — never
+ * returns null — because every failure here means the provenance and the document
+ * disagree, which must be loud.
+ * @param {import("./provenance.js").Provenance} provenance
+ * @param {Map<number, import("./xml-scan.js").XmlElement>} anchorByStart
+ * @param {import("../../model/node.js").NodeId} id
+ * @returns {import("./xml-scan.js").XmlElement}
+ */
+function anchorFor(provenance, anchorByStart, id) {
+  const range = provenance.anchorRanges.get(id);
+  if (range === undefined) {
+    throw new Error(`splice: container ${id} has no anchor range (not an imported box)`);
+  }
+  const anchor = anchorByStart.get(range.start);
+  if (anchor === undefined) {
+    throw new Error(`splice: no anchor at byte ${range.start} for container ${id}`);
+  }
+  return anchor;
+}
+
+/**
+ * The `wp:positionH`/`wp:positionV` child holding this axis's `wp:posOffset`.
+ * @param {import("./xml-scan.js").XmlElement} anchor
+ * @param {"x" | "y"} axis
+ * @returns {import("./xml-scan.js").XmlElement | null}
+ */
+function posOffsetElement(anchor, axis) {
+  const position = findChild(anchor, WP_NS, axis === "x" ? "positionH" : "positionV");
+  if (position === null || position === undefined) {
+    return null;
+  }
+  return findChild(position, WP_NS, "posOffset") ?? null;
+}
+
+/**
+ * Whether this anchor's graphic is a `wpg:wgp` GROUP.
+ *
+ * The geometry writer must refuse groups: a group child's model coordinate is a
+ * COMPOSED value (`import.js`: `x = anchorX + (offX - chOffX) * scaleX`), so
+ * writing it into the anchor's own `wp:posOffset` would move the wrong thing.
+ *
+ * 🔴 This cannot reuse the text path's guard: that one counts `w:txbxContent`
+ * under the anchor ("need 1"), which a group holding ONE text box passes
+ * cleanly — measured, that proxy has never fired on this corpus. Grouping is
+ * tested here directly.
+ * @param {import("./xml-scan.js").XmlElement} anchor
+ * @returns {boolean}
+ */
+function isGroupedAnchor(anchor) {
+  const graphic = findChild(anchor, A_NS, "graphic");
+  if (graphic === null || graphic === undefined) {
+    return false;
+  }
+  const graphicData = findChild(graphic, A_NS, "graphicData");
+  if (graphicData === null || graphicData === undefined) {
+    return false;
+  }
+  const group = findChild(graphicData, WPG_NS, "wgp");
+  return group !== null && group !== undefined;
+}
+
+/**
+ * @typedef {object} SkippedGeometry
+ * @property {import("../../model/node.js").NodeId} containerId
+ * @property {string[]} keys  the layout keys whose new value was NOT written
+ * @property {"grouped" | "locked" | "unsupported-key"} reason
+ */
+
+/**
+ * Byte edits for the geometry the user actually changed, plus the list of
+ * changes this slice REFUSES to write (never silently dropped — the caller
+ * surfaces them, see `export.js`'s report).
+ *
+ * Only `x`/`y` are written, by replacing the digits inside `wp:posOffset`. The
+ * anchor itself is never regenerated: ADR-0023's 4a experiment (Word refused a
+ * document whose anchor had lost three attributes) constrains REGENERATION, and
+ * a digit replacement touches no attribute at all.
+ *
+ * `cx`/`cy` are refused on purpose. Measured 2026-08-29: size has TWO live
+ * copies inside `mc:Choice` — `wp:extent@cx/@cy` AND `wps:spPr/a:xfrm/a:ext`
+ * (7,990/7,990 containers carry both) — so writing one leaves the other stale.
+ * Writing both is its own slice.
+ *
+ * @param {import("./provenance.js").Provenance} provenance
+ * @param {import("../../model/node.js").Doc} doc  the EDITED document
+ * @param {import("../../model/node.js").Doc} originalDoc  the IMPORTED document (read-back baseline)
+ * @param {Map<import("../../model/node.js").NodeId, Set<string>>} geometry  id -> changed layout keys
+ * @param {Map<number, import("./xml-scan.js").XmlElement>} anchorByStart
+ * @param {SkippedGeometry[]} skipped  appended to
+ * @returns {{start: number, end: number, bytes: Uint8Array}[]}
+ */
+function buildGeometryEdits(provenance, doc, originalDoc, geometry, anchorByStart, skipped) {
+  /** @type {{start: number, end: number, bytes: Uint8Array}[]} */
+  const edits = [];
+  const encoder = new TextEncoder();
+  const decoder = new TextDecoder();
+
+  for (const [id, changedKeys] of geometry) {
+    if (containerById(doc, id) === null) {
+      throw new Error(`splice: dirty geometry id ${id} is not a container in doc`);
+    }
+    const layout = doc.layout[id];
+    const before = originalDoc.layout[id];
+    if (layout === undefined || before === undefined) {
+      // A box the imported document did not position (or a brand-new one) has no
+      // original bytes to splice — new-anchor writing is a later slice.
+      skipped.push({ containerId: id, keys: [...changedKeys], reason: "unsupported-key" });
+      continue;
+    }
+
+    const anchor = anchorFor(provenance, anchorByStart, id);
+    if (isGroupedAnchor(anchor)) {
+      skipped.push({ containerId: id, keys: [...changedKeys], reason: "grouped" });
+      continue;
+    }
+    if (layout.locked === true) {
+      // `locked` means the box carries its own rotation/flip, which this codebase
+      // never renders (FIDELITY: DEGRADED). Writing posOffset would move the
+      // UNROTATED bounding box — not what the editor drew. The UI withholds the
+      // drag affordance but the keyboard nudge path does not check `locked`, so
+      // the refusal has to live here, not in the UI.
+      skipped.push({ containerId: id, keys: [...changedKeys], reason: "locked" });
+      continue;
+    }
+
+    /** @type {string[]} */
+    const refusedKeys = [];
+    for (const key of changedKeys) {
+      if (key !== "x" && key !== "y") {
+        refusedKeys.push(key);
+        continue;
+      }
+      const element = posOffsetElement(anchor, key);
+      if (element === null) {
+        refusedKeys.push(key);
+        continue;
+      }
+
+      // READ-BACK: the digits currently in these bytes must decode to the value
+      // the IMPORTED model holds for this key. Exact by construction (import
+      // computed layout[key] from precisely this text), so a mismatch means the
+      // provenance and the document disagree — a bug, not a user situation.
+      const currentText = decoder.decode(provenance.documentXmlBytes.subarray(element.contentStart, element.contentEnd));
+      const currentEmu = Number.parseInt(currentText, 10);
+      if (!Number.isFinite(currentEmu) || emuToPt(currentEmu) !== before[key]) {
+        throw new Error(
+          `splice: read-back mismatch for container ${id} ${key} — document says ${currentText} ` +
+            `(${emuToPt(currentEmu)} pt) but the imported model says ${before[key]} pt`,
+        );
+      }
+
+      edits.push({
+        start: element.contentStart,
+        end: element.contentEnd,
+        bytes: encoder.encode(String(ptToEmu(/** @type {number} */ (layout[key])))),
+      });
+    }
+    if (refusedKeys.length > 0) {
+      skipped.push({ containerId: id, keys: refusedKeys, reason: "unsupported-key" });
+    }
+  }
+  return edits;
+}
+
+/**
+ * New document.xml bytes with the touched containers' text AND geometry
+ * re-written from `doc`; every other byte byte-identical to the original.
+ *
+ * @param {import("./provenance.js").Provenance} provenance
+ * @param {import("../../model/node.js").Doc} doc  the edited document
+ * @param {object} dirty
+ * @param {Iterable<import("../../model/node.js").NodeId>} [dirty.textIds]
+ * @param {Map<import("../../model/node.js").NodeId, Set<string>>} [dirty.geometry]
+ * @param {import("../../model/node.js").Doc} [dirty.originalDoc]  required when `geometry` is non-empty
+ * @returns {{bytes: Uint8Array, skippedGeometry: SkippedGeometry[]}}  `bytes` is
+ *   the ORIGINAL reference when nothing was written (export.js depends on that
+ *   identity to skip repacking entirely)
+ */
+export function spliceDirty(provenance, doc, { textIds = [], geometry = new Map(), originalDoc } = {}) {
+  const original = provenance.documentXmlBytes;
+  const ids = [...new Set(textIds)];
+  /** @type {SkippedGeometry[]} */
+  const skippedGeometry = [];
+  if (ids.length === 0 && geometry.size === 0) {
+    return { bytes: original, skippedGeometry };
+  }
+
+  const { root } = scanXml(original);
+  const elementByStart = indexElementsByStart(root);
+  /** @type {Map<number, import("./xml-scan.js").XmlElement>} */
+  const anchorByStart = new Map();
+  for (const anchor of collectAnchors(root)) {
+    anchorByStart.set(anchor.start, anchor);
+  }
+
+  /** @type {{start: number, end: number, bytes: Uint8Array}[]} */
+  const edits = [];
+  for (const id of ids) {
+    const container = containerById(doc, id);
+    if (container === null) {
+      throw new Error(`spliceDirtyText: dirty id ${id} is not a container in doc`);
+    }
+    const anchor = anchorFor(provenance, anchorByStart, id);
+    const txbxes = collectTxbxContents(anchor, []);
+    if (txbxes.length !== 1) {
+      // Narrowest slice: exactly one text box per touched anchor. A grouped
+      // multi-box anchor (several txbxContent sharing one anchor range) cannot
+      // be disambiguated from the anchor range alone — that is a later slice.
+      throw new Error(
+        `spliceDirtyText: container ${id}'s anchor holds ${txbxes.length} txbxContent (need 1) — grouped multi-box is a later slice`,
+      );
+    }
+    const txbx = txbxes[0];
+    /** @type {Uint8Array[]} */
+    const parts = [];
+    for (const para of container.content) {
+      emitParagraph(parts, para, id, provenance, elementByStart);
+    }
+    edits.push({ start: txbx.contentStart, end: txbx.contentEnd, bytes: concatBytes(parts) });
+  }
+
+  if (geometry.size > 0) {
+    if (originalDoc === undefined) {
+      throw new Error("spliceDirty: geometry edits need `originalDoc` (the imported document) for the read-back check");
+    }
+    edits.push(...buildGeometryEdits(provenance, doc, originalDoc, geometry, anchorByStart, skippedGeometry));
+  }
+
+  // ONE application pass for text AND geometry together — see applyEdits for why
+  // a second pass over the rebuilt buffer would be a silent corruption.
+  return { bytes: applyEdits(original, edits), skippedGeometry };
+}