Release note · August 4, 2026

A Word save setting can change the handoff contract

A document can retain the same text and still carry a stored instruction that changes the meaning of a later save. That is a useful handoff fact. It is not evidence that a form was exported, that a field was evaluated, or that a particular Word client will do anything.

DocFence 0.37 makes one such declaration review-visible: the direct Word Settings w:saveFormsData leaf. The result is local, aggregate-only evidence that stays distinct from form-field parsing, document automation, and runtime behavior.

Stored configuration, not an attempted export

The Open XML SDK documents SaveFormsData as a direct Settings declaration for saving form-field content only. Office documentation differs in how it describes the resulting delimiter, which is a good reason not to turn a static scanner into an export predictor.

DocFence accepts at most one direct declaration in every discovered Word Settings part, including Transitional and Strict packages. It validates the leaf shape and the optional Word-namespace Boolean value, canonicalizing omitted values, on, and true as enabled while preserving an enabled-to-disabled transition for review. Public output contains only enabled and explicitly disabled setting counts; settings paths and fingerprints stay private.

It does not look for legacy form fields, read or evaluate a field value, open Word, save a document, emit a record, infer a delimiter, or claim that a host honors the request.

Two policy choices, both explicit

A clean-handoff policy can reject a candidate that stores the enabled request:

rules:
  require_no_save_forms_data: true

This emits DFP086. A controlled workflow that intentionally retains a known stored state can instead protect its baseline:

rules:
  no_save_forms_data_changes: true

DFP087 reports a material inventory change, including a same-count enabled-to-disabled swap. Neither rule turns a document review into a save engine.

Paired package evidence

The release is accompanied by DCAB 0.27.0, an open 38-case WordprocessingML change-review corpus. Its new synthetic pair keeps a complete legacy FORMTEXT carrier, every package member, and every stored Word text value fixed while only word/settings.xml changes from w:saveFormsData w:val="false" to w:saveFormsData w:val="true".

The pair validates exact stored XML and package boundaries, deterministic regeneration, and an independent DOCX/OPC-reader boundary. It does not claim an export result. The optional DocFence adapter reports the new fact using only the public aggregate transition, and the 38-case dataset mirror is available on Hugging Face.

Released and verified

Tagged GitHub CI passed for DocFence and DCAB. Fresh wheel and source-distribution installs validate the bundled corpus and detect this setting transition. The public GitHub release downloads were byte-compared with the tagged builds, and the public dataset mirror was checked for its 38-case manifest and matching fixture hash.

python -m pip install https://github.com/SybilGambleyyu/docfence/releases/download/v0.37.0/docfence-0.37.0-py3-none-any.whl

docfence profile candidate.docx --format markdown
docfence check approved.docx candidate.docx --policy docfence.yml --format sarif --output docfence.sarif

The public release includes a wheel and source archive. The tagged policy reference, threat model, and validation notes define the exact behavior and privacy limits.