Release note · August 3, 2026

A Word control can change while its XML anchor stays fixed

By SybilGambleyyu · Document Change Assurance Benchmark 0.16.0

An embedded ActiveX control is not just a tag in a Word document. Its visible anchor can stay exactly the same while a separately stored persistence binary changes. That is a meaningful static review boundary: the XML that places and associates the control is stable, but the opaque bytes that describe its persisted state are not.

Document Change Assurance Benchmark (DCAB) 0.16.0 adds its twenty-seventh deterministic pair: embedded.activex_control_persistence_payload_changed. Both packages keep the same members, ordinary stored w:t values, Word embedded-control anchor, ActiveX XML persistence part, content types, and two internal relationships. Only word/activeX/activeX1.bin changes.

There are two relationships to review

Microsoft’s Word w:control reference describes an embedded-control representation associated with a parent w:object. The ax:ocx contract identifies the class/persistence metadata and its binary relationship reference. Microsoft’s Embedded Control Persistence Binary Data contract specifies the required internal activeXControlBinary target.

word/document.xml
  w:object
    w:control r:id="control properties"

word/_rels/document.xml.rels
  control properties → activeX persistence XML

word/activeX/activeX1.xml
  ax:ocx r:id="persistence binary"

word/activeX/_rels/activeX1.xml.rels
  persistence binary → activeX1.bin

word/activeX/activeX1.bin
  the only changed member

The package therefore requires more than noticing an unfamiliar binary file. A reviewer has to connect the Word anchor to the ActiveX persistence part, then connect that part to its internal binary, while confirming that the topology itself did not change.

Opaque bytes, deliberately no activation claim

DCAB fixes one inline w:object/w:control carrier, the internal standard control relationship, one ax:ocx persistence record, the ActiveX XML and binary content types, and the internal standard binary relationship. Its payloads are inert synthetic marker bytes, not a loadable control stream.

The builder, structural verifier, scorer, and adapter never parse the persistence bytes, open Word, load or instantiate a control, render a placeholder, invoke a client or server, authenticate, or assert any control behavior. This is a precise stored-package review test, not an ActiveX execution or compatibility test.

Aggregate evidence without exposing control metadata

The optional DocFence 0.27.0 adapter maps embedded_object_inventory_changed together with stable aggregate control topology: two control relationships, two control parts, and one internal Word embedded-control anchor. It reaches a strict 27/27 DCAB score without publishing the control name, class identifier, persistence metadata, relationship IDs, paths, payload bytes, or private fingerprints.

Hosted CI passed on Python 3.11, 3.12, and 3.13, including a separate clean DocFence adapter job. The standard python-docx reader opens all 52 .docx fixtures, while its lower-level OPC reader opens all 54 packages. Rebuilt fixtures, fresh wheel and source-distribution installs, public GitHub release downloads, and a fresh Hugging Face dataset snapshot each validate the 27-case corpus.

Use the release

python -m pip install https://github.com/SybilGambleyyu/document-change-benchmark/releases/download/v0.16.0/document_change_benchmark-0.16.0-py3-none-any.whl
dcab validate
dcab docfence-observations --executable docfence --output observations.json
dcab score --observations observations.json --strict

DCAB 0.16.0 retains fixture schema version 1 because its public truth and observation envelopes are unchanged. It adds a narrow opaque-persistence review boundary, not a control loader, runtime analyzer, document renderer, or universal security-policy claim.

The MIT-licensed source, generated fixtures, structural verifier, release artifacts, and research notes are available on GitHub. The fixture corpus is also mirrored as a public Hugging Face dataset.