Release note · August 3, 2026
A mail-merge source can change without changing Word text
Mail-merge setup is stored in a Word package’s settings, not necessarily in its visible text. A source document can retain every stored text node, its mail-merge anchor, and its relationship ID while the stored target of its external data-source relationship changes. A text diff will miss that; a static reviewer can report it without making a connection.
Document Change Assurance Benchmark (DCAB) 0.6.0 adds its seventeenth deterministic paired package: external.mail_merge_data_source_target_retargeted. Both sides keep the same w:mailMerge/w:dataSource settings markup, relationship ID, package-member set, and stored w:t sequence. Only word/_rels/settings.xml.rels changes.
Review the stored binding; do not connect
Microsoft’s Open XML documentation for DataSourceReference describes w:dataSource as the relationship to the external source used for a mail merge, and requires the corresponding mailMergeSource relationship. DCAB fixes that anchor and relationship type, using only synthetic example.invalid targets, then changes the target between the two packages.
The builder, structural verifier, scorer, and reference adapter never resolve the relationship, open Word, connect to a data source, execute a query, parse a connection string, or claim what a client will merge. The public truth declares only mail_merge_data_source_target_changed, an external binding, a mail-merge-source relationship category, and the settings source. It excludes targets, relationship IDs, and stored settings details.
A deterministic settings relationship boundary
The independent verifier checks the fixed w:mailMerge and w:dataSource structure, its relationship ID, the standard relationship type, external mode, deterministic package bytes, stable member set, unchanged Word text, and exact one-member pair boundary. The standard python-docx reader opens all 32 .docx fixtures, and its lower-level OPC reader opens all 34 packages.
The optional local DocFence 0.27.0 adapter maps the public mail-merge inventory change while the configuration and data-source relationship counts remain one and header/recipient-data counts remain zero. It uses aggregate evidence only, not targets or a private signature.
The release passed 13 tests locally, including that adapter path, then passed hosted CI on Python 3.11, 3.12, and 3.13 plus a clean DocFence installation. Fresh wheel and source-distribution installs each validate the bundled corpus.
Use the release
python -m pip install https://github.com/SybilGambleyyu/document-change-benchmark/releases/download/v0.6.0/document_change_benchmark-0.6.0-py3-none-any.whl
dcab validate
dcab docfence-observations --executable docfence --output observations.json
dcab score --observations observations.json --strictDCAB 0.6.0 retains fixture schema version 1 because the public truth and observation envelopes are unchanged; it extends the corpus from 16 to 17 cases. It does not claim a source is reachable, safe, queried, rendered, or used by a client. It supplies a reproducible static boundary for serious document review.
The MIT-licensed source, generated fixtures, structural verifier, release artifacts, and research notes are available on GitHub. The fixture corpus is also mirrored as a public Hugging Face dataset.