Release note · August 4, 2026

A thumbnail request is not a thumbnail

A Word document can store an instruction asking a supporting application to make a preview thumbnail on a later save. That instruction matters in a handoff review. It is not proof that an image exists now, that any client will make one, or that an existing image depicts the document.

DocFence 0.38 makes that narrow stored declaration review-visible: the direct Word Settings w:savePreviewPicture leaf. The result is local, aggregate-only evidence kept deliberately separate from the existing relationship-bound OPC package-thumbnail inventory.

Two different package facts

The Open XML SDK documents SavePreviewPicture as a request to generate a thumbnail for the first page when a supporting application saves a document. It also says that omission does not force applications to avoid thumbnails. That makes a direct setting a configuration fact, not an image-inspection result.

DocFence already recognizes an actual thumbnail only through the standard package relationship, an internal image target, and a valid content type. That separate inventory never decodes or renders pixels. Version 0.38 adds no shortcut from a filename or a direct Settings leaf to an image claim.

For every discovered Word Settings part, DocFence accepts at most one direct declaration in Transitional or Strict syntax. It validates the leaf shape and optional Word-namespace Boolean value. Public output contains only enabled and explicitly disabled setting counts; settings paths, raw serialization, and fingerprints stay private. Omitted values, on, and true canonicalize to the same enabled state, while enabled-to-disabled changes remain review-visible.

Two policy choices, both bounded

A clean-handoff policy can reject an explicitly enabled request:

rules:
  require_no_save_preview_picture: true

This emits DFP088. A controlled template can instead protect an approved stored state:

rules:
  no_save_preview_picture_changes: true

DFP089 reports a material inventory change. Neither rule proves a thumbnail is absent, prevents a host from choosing one, creates an image, opens Word, saves a document, or predicts a client.

Paired package evidence

The release is accompanied by DCAB 0.28.0, an open 39-case WordprocessingML change-review corpus. Its new synthetic pair holds the package-member set and all stored Word text fixed while only word/settings.xml changes from w:savePreviewPicture w:val="false" to w:savePreviewPicture w:val="true".

Neither side has a thumbnail relationship or thumbnail image part. The structural verifier checks that boundary, deterministic regeneration, and an independent DOCX/OPC-reader path. The optional DocFence adapter reports the target-free public aggregate transition; the 39-case dataset mirror is available on Hugging Face.

Released and verified

Tagged GitHub CI passed for DocFence and DCAB, including the benchmark adapter installed from the DocFence tag. Fresh wheel installs detected the transition and validated the bundled 39-case corpus. The public GitHub release downloads were byte-compared with builds from fresh tagged checkouts, and the public dataset mirror was checked for its 39-case manifest and matching fixture hash.

python -m pip install https://github.com/SybilGambleyyu/docfence/releases/download/v0.38.0/docfence-0.38.0-py3-none-any.whl

docfence profile candidate.docx --format markdown
docfence check approved.docx candidate.docx --policy docfence.yml --format sarif --output docfence.sarif

The public release includes a wheel and source archive. The tagged policy reference, threat model, and validation notes define the exact behavior and privacy limits.