@@ -95,25 +95,29 @@ trigger it manually with `workflow_dispatch` after changes.
 Every run also counts revision-bearing elements by tag across each file's
 `word/*.xml` parts (recorded as `rec["census"]` in `results.json`). It is
 informational — never a stage, never a failure — and exists to answer which
-revision types real-world producers actually emit. Observed 2026-08-29 over the
-77-file corpus:
+revision types real-world producers actually emit. The `save2` stage adds the
+one hard check derived from it: after `accept_all()`, the saved
+`word/document.xml` may hold only what `accept_all()` itself reported as
+unhandled — a `w:ins`, `w:moveFrom`, `w:pPrChange` or move range mark left
+behind unreported fails the file with `AssertResolvedTypesRemain`. Observed
+2026-08-30 over the 77-file corpus:
 
 ```text
 tag                               elements  files  producers
  w:ins                                 162     10  LibreOffice (docx re-save), LibreOffice core ooxmlexport fix
  w:del                                 136     11  LibreOffice (docx re-save), Open-Xml-PowerTools test fixture
 *w:tcPrChange                           36      6  Open-Xml-PowerTools test fixture (Word)
-*w:moveFrom                             27      4  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
-*w:moveTo                               27      4  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
-*w:pPrChange                            11      5  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
+ w:moveFrom                             27      4  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
+ w:moveTo                               27      4  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
+ w:pPrChange                            11      5  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
 *w:cellMerge                             6      1  Open-Xml-PowerTools test fixture (Word)
 *w:tblGridChange                         6      6  Open-Xml-PowerTools test fixture (Word)
 *w:cellDel                               4      1  Open-Xml-PowerTools test fixture (Word)
 *w:cellIns                               4      1  Open-Xml-PowerTools test fixture (Word)
-*w:moveFromRangeEnd                      4      4  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
-*w:moveFromRangeStart                    4      4  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
-*w:moveToRangeEnd                        4      4  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
-*w:moveToRangeStart                      4      4  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
+ w:moveFromRangeEnd                      4      4  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
+ w:moveFromRangeStart                    4      4  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
+ w:moveToRangeEnd                        4      4  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
+ w:moveToRangeStart                      4      4  LibreOffice core ooxmlexport fixture (Word/LO mixed), Open-X
 *w:tblPrChange                           4      4  Open-Xml-PowerTools test fixture (Word)
 *w:rPrChange                             3      2  Open-Xml-PowerTools test fixture (Word)
 *w:tblPrExChange                         3      2  Open-Xml-PowerTools test fixture (Word)
@@ -130,7 +134,7 @@ tag                               elements  files  producers
 *w:sectPrChange                          1      1  Open-Xml-PowerTools test fixture (Word)
 
 26/77 files carry at least one revision element
-* = not resolved by accept_all/reject_all (169 element(s), ISSUES.md #68)
+* = not resolved by accept_all/reject_all (88 element(s))
 
 w:ins/w:del by parent element (structural markers vs content revisions):
   w:rPr                            172  <- paragraph-mark ins/del, or a change record's rPr
@@ -144,32 +148,55 @@ w:ins/w:del by parent element (structural markers vs content revisions):
   - poi_ExternalEntityInText.docx [word/document.xml]: EntitiesForbidden: ...
 ```
 
-Read as evidence for ISSUES.md #68:
+Read as evidence:
 
-- **Every unhandled type now has genuine Word output behind it.** The 21
+- **Every unhandled type has genuine Word output behind it.** The 21
   `oxpt_RP*` files were authored in Word (see Provenance) and between them
-  emit all 26 tags in `UNHANDLED_REVISION_TAGS`. Before they were added, the
-  five revision-bearing files were almost all LibreOffice-produced and only
-  moves and `w:pPrChange` had any real-producer evidence; the rest was
+  emit all 19 tags in `UNHANDLED_REVISION_TAGS` as well as the moves and
+  `w:pPrChange` that ISSUES.md #68 took out of it. Before they were added,
+  the five revision-bearing files were almost all LibreOffice-produced and
+  only moves and `w:pPrChange` had any real-producer evidence; the rest was
   hand-authored XML in `tests/test_unhandled_revisions.py` (still there, for
   the edge shapes).
-- **Moves are the largest unhandled family** (27 + 27 + range marks) and they
-  are real, not synthetic: `locore_TC-table-DnD-move.docx` (a Word
-  drag-and-drop move re-exported by LibreOffice core) and the Word-native
-  `oxpt_RP015-MoveFrom-MoveTo.docx` / `oxpt_RP018-MoveFrom-MoveTo-CC.docx`
-  (the latter inside a content control, with `customXmlMove*` marks).
-  `accept_all()` resolves none of them and leaves the whole redline pending.
-- **Property changes are the next family**: `w:pPrChange` in five files
-  (Word: `oxpt_RP022`, `RP025`, `RP037`, plus the kitchen-sink `RP001`),
-  `w:rPrChange` on a run (`oxpt_RP037`) and on a paragraph mark
-  (`oxpt_RP024`), `w:sectPrChange` (`oxpt_RP027`), `w:numberingChange`
-  (`oxpt_RP026`), and the whole table family — `w:tblPrChange`,
-  `w:tblPrExChange`, `w:trPrChange`, `w:tcPrChange`, `w:tblGridChange`
-  (`oxpt_RP028`, `RP033`, `RP001`).
+- **Moves resolve, on every producer that emits them** (ISSUES.md #68):
+  `locore_TC-table-DnD-move.docx` (a Word drag-and-drop move of a whole table,
+  re-exported by LibreOffice core) carries 20 move marks — `accept_all()`
+  lists and resolves its 16 `w:moveFrom`/`w:moveTo` elements as one inferred
+  changeset and sweeps the 4 range marks with them, leaving the table at its
+  destination exactly once; `reject_all()` puts it back. The Word-native
+  `oxpt_RP015-MoveFrom-MoveTo.docx` resolves clean (6 elements);
+  `oxpt_RP018-MoveFrom-MoveTo-CC.docx` resolves its 7 move elements and leaves
+  the 8 `customXmlMove*` marks around its content control pending. Half the
+  DnD file's move elements are paragraph-mark markers
+  (`w:pPr/w:rPr/w:moveFrom`, one per moved cell); like a deleted paragraph
+  mark these resolve *approximately* — the marker is dropped without merging
+  or splitting paragraphs — so the moved text ends up at its destination
+  exactly once, but the source table survives as a 2×2 table of empty cells
+  (the four leading empty lines in the fixture's expected visible text),
+  where Word would remove it.
+  Both shapes are mirrored by hand-authored fixtures in
+  `tests/test_move_and_ppr_change_resolution.py` and run against the real
+  files by `tests/test_corpus_fixtures.py` when the corpus is built.
+- **Paragraph-property changes resolve too**: `w:pPrChange` in five files
+  (Word: `oxpt_RP022`, `RP025`, `RP037`, the kitchen-sink `RP001`, and
+  `locore_UnknownStyleInRedline.docx`, whose two records share `w:id="0"`, one
+  self-closing, one naming a style `styles.xml` does not define — accept drops
+  the records, reject restores the recorded properties verbatim). `RP037`
+  also carries two `w:pPrChange` inside `word/styles.xml` style definitions,
+  outside the part the library reads (ISSUES.md #30); they show in the
+  per-part census and are not a `save2` failure, the same way
+  `oxpt_RP050-Deleted-Footnote.docx`'s deletions in `word/footnotes.xml` are
+  not.
+- **The rest of the property family is still unhandled**: `w:rPrChange` on a
+  run (`oxpt_RP037`) and on a paragraph mark (`oxpt_RP024`), `w:sectPrChange`
+  (`oxpt_RP027`), `w:numberingChange` (`oxpt_RP026`), and the whole table
+  family — `w:tblPrChange`, `w:tblPrExChange`, `w:trPrChange`,
+  `w:tcPrChange`, `w:tblGridChange` (`oxpt_RP028`, `RP033`, `RP001`). These
+  stay behind the honesty floor (`ResolveResult.unhandled`, ISSUES.md #64).
 - **Table-structure revisions exist in the wild**: `w:cellIns` (`oxpt_RP035`),
   `w:cellDel` (`oxpt_RP034`), `w:cellMerge` (`oxpt_RP036`), each alongside the
   `w:ins`/`w:del` Word writes for the cells' content.
-- **The structural `w:ins`/`w:del` contexts are now the majority row**: 172
+- **The structural `w:ins`/`w:del` contexts are the majority row**: 172
   paragraph-mark markers (`w:pPr/w:rPr/w:ins|del`; the kitchen-sink file alone
   has 160) and 22 table-row markers (`w:trPr`, from `oxpt_RP009`/`RP010` and
   `RP001`), against 73 ordinary content revisions. These resolve
@@ -179,10 +206,12 @@ Read as evidence for ISSUES.md #68:
   math run (`oxpt_RP013`), and the `w:moveFrom`/`w:moveTo` rows are Word's
   own paragraph-mark markers inside the kitchen-sink file's moved paragraphs.
 
-The `*`-marked tags are exactly `UNHANDLED_REVISION_TAGS`
-(`docx_editor/track_changes.py`), which is also what `accept_all()` /
+The `*`-marked tags are `UNHANDLED_REVISION_TAGS`
+(`docx_editor/track_changes.py`), which is what `accept_all()` /
 `reject_all()` report as `.unhandled` and what `list_unhandled_revisions()`
-lists.
+lists — plus, in a document a nonconforming producer wrote, any handled-type
+mark with no numeric `w:id` (nothing id-keyed can resolve it; none in this
+corpus).
 
 ## Failure semantics
 
@@ -204,23 +233,22 @@ lists.
   `w:trackRevisions` flag, or a vanished edit marker still fails. A waiver
   that turns out to be unnecessary fails the file with
   `StaleSurvivalWaiver`, so the manifest cannot quietly outlive the behavior
-  it documents. Two files carry one today, both verified by dumping
-  LibreOffice's import as flat ODT:
+  it documents. One file carries one today, verified by dumping LibreOffice's
+  import as flat ODT:
   - `poi_FieldCodes.docx` — the first paragraph is an `AUTHOR` field result;
     Writer fields carry no redlines, so LibreOffice flattens our del/ins into
     the result text (`ANTONIANTONI-EDITED`).
-  - `locore_TC-table-DnD-move.docx` — the first paragraph sits inside a
-    foreign `w:moveFrom` (moved-away text); LibreOffice folds our deletion
-    into the move's own deletion region and only the insertion comes back.
-    (That the library edits inside `w:moveFrom` content at all — text that is
-    deleted at its source — is a finding for ISSUES.md #68, not for the gate.)
+  `locore_TC-table-DnD-move.docx` carried one until ISSUES.md #68: its first
+  paragraphs sit inside a foreign `w:moveFrom` (moved-away text), which the
+  library now treats as invisible, so the harness edits the first paragraph
+  that is actually visible and the redline survives LibreOffice unaided.
 - The harness exits nonzero if any file has a real failure (failed stage or
   harness error), and if the corpus directory is empty or a `--only` filter
   matches nothing (a run that tested nothing must not look green).
   Baseline: 76 clean + 1 rejected → exit 0. Of the 76, the `lo_roundtrip`
-  survival assertion ran on 68 (1 of them with the flag check not
+  survival assertion ran on 69 (1 of them with the flag check not
   applicable, `onlyoffice_sample.docx`), was skipped on 6 with no editable
-  paragraph, and was waived on 2.
+  paragraph, and was waived on 1.
 
 ## Provenance policy
 
 
@@ -22,7 +22,11 @@
   save1           save-as to out/<name>_edited.docx + zip/XML validation
   reopen          reopen saved file, assert the edit survived and the revision
                   count is coherent, then accept_all
-  save2           save to out/<name>_final.docx + zip/XML validation
+  save2           save to out/<name>_final.docx + zip/XML validation, then
+                  assert the saved word/document.xml holds only what
+                  accept_all itself reported as unhandled: an ins/del/move/
+                  pPrChange element or move range mark left behind unreported
+                  is a failure
   lo_roundtrip    soffice --headless --convert-to docx on the *edited* output,
                   then assert that what we wrote survived the re-save
   pdf             soffice --headless --convert-to pdf on the final output
@@ -37,8 +41,8 @@
 never the signal relied on), and lo_roundtrip additionally reopens the
 re-saved file and checks that our w:trackRevisions flag and our own
 insertion/deletion are still there. Where
-LibreOffice's own model cannot hold our redline (inside a field result,
-inside a foreign move), the manifest records a ``survival_waiver`` with the
+LibreOffice's own model cannot hold our redline (inside a field result),
+the manifest records a ``survival_waiver`` with the
 reason; see apply_manifest_expectations.
 
 An input that fails input_validate and is then refused by Document.open is
@@ -49,8 +53,8 @@
 across its ``word/*.xml`` parts, recorded as ``rec["census"]``. It is
 informational and can never fail a run, so it is not a stage — it exists to
 say which revision types real-world producers actually emit, which is the
-evidence base for handling the ones this library does not resolve
-(ISSUES.md #68). ``--census`` prints just that table, in seconds.
+evidence base for handling the ones this library does not resolve.
+``--census`` prints just that table, in seconds.
 """
 
 import argparse
@@ -193,7 +197,7 @@ def census_file(path: Path) -> dict:
 
 def print_census(results: list[dict]) -> None:
     """Print the corpus-wide revision census: which tags real producers emit."""
-    from docx_editor.track_changes import HANDLED_REVISION_TAGS, UNHANDLED_REVISION_TAGS
+    from docx_editor.track_changes import UNHANDLED_REVISION_TAGS
 
     totals: dict[str, int] = {}
     files_with: dict[str, set[str]] = {}
@@ -230,14 +234,14 @@ def print_census(results: list[dict]) -> None:
     print("\nRevision census (all word/*.xml parts)")
     print(f"{'tag':<32}{'elements':>10}{'files':>7}  producers")
     for tag, n in sorted(totals.items(), key=lambda kv: (-kv[1], kv[0])):
-        mark = " " if tag in HANDLED_REVISION_TAGS else "*"
+        mark = "*" if tag in UNHANDLED_REVISION_TAGS else " "
         prods = ", ".join(sorted(producers[tag]))
         print(f"{mark}{tag:<31}{n:>10}{len(files_with[tag]):>7}  {prods[:60]}")
     if not totals:
         print("  (no revision elements found in any corpus file)")
     print(f"\n{carrying}/{n_files} files carry at least one revision element")
     unhandled_total = sum(n for tag, n in totals.items() if tag in UNHANDLED_REVISION_TAGS)
-    print(f"* = not resolved by accept_all/reject_all ({unhandled_total} element(s), ISSUES.md #68)")
+    print(f"* = not resolved by accept_all/reject_all ({unhandled_total} element(s))")
     if contexts:
         print("\nw:ins/w:del by parent element (structural markers vs content revisions):")
         for parent, n in sorted(contexts.items(), key=lambda kv: (-kv[1], kv[0])):
@@ -658,26 +662,59 @@ def fail_rest(from_stage: str):
                 )
                 fail_rest("reopen")
                 return result
-            stages["reopen"] = {"status": "pass", "accepted": accepted}
+            stages["reopen"] = {
+                "status": "pass",
+                "accepted": accepted,
+                "unhandled": dict(accepted.unhandled_types),
+            }
         except Exception as e:
             stages["reopen"] = err_record(e)
             fail_rest("reopen")
             return result
 
-        # Stage 6: save2 + validate
+        # Stage 6: save2 + validate + post-condition: after accept_all, the
+        # saved file may hold only revision types the library never resolves.
         try:
+            from docx_editor.track_changes import MOVE_RANGE_TAGS, UNHANDLED_REVISION_TAGS
+
             doc2.save(out2)
             v = validate_docx(out2)
-            if v["ok"]:
-                stages["save2"] = {"status": "pass"}
-            else:
+            if not v["ok"]:
                 stages["save2"] = {
                     "status": "fail",
                     "error_type": "OutputValidation:" + v["error_type"],
                     "error": v["error"][:400],
                 }
                 fail_rest("save2")
                 return result
+            # word/document.xml only: the part accept_all reads (ISSUES.md #30).
+            # A redline in styles.xml or footnotes.xml is visible in the
+            # per-part census but is not something accept_all claimed to do.
+            # Measured against accept_all's own report, not a static tag set:
+            # a handled-type mark it could not reach (no numeric w:id) is
+            # reported in unhandled_types and may stay; only what it left
+            # behind *unreported* is a failure. Range marks are scaffolding
+            # swept with their move, so they may remain only while a move
+            # element of their family is still reported as unhandled.
+            final_census = census_file(out2)
+            body_tags = final_census.get("parts", {}).get("word/document.xml", {}).get("by_tag", {})
+            reported = accepted.unhandled_types
+            leftover = {
+                tag: n - reported.get(tag, 0)
+                for tag, n in body_tags.items()
+                if tag not in UNHANDLED_REVISION_TAGS and tag not in MOVE_RANGE_TAGS and n > reported.get(tag, 0)
+            }
+            for tag, n in body_tags.items():
+                if tag in MOVE_RANGE_TAGS and not reported.get("w:" + tag[len("w:") : tag.index("Range")], 0):
+                    leftover[tag] = n
+            if leftover:
+                stages["save2"] = assert_fail(
+                    "AssertResolvedTypesRemain",
+                    f"accept_all() left unreported revision elements in the saved file: {leftover}",
+                )
+                fail_rest("save2")
+                return result
+            stages["save2"] = {"status": "pass", "census": final_census.get("by_tag", {})}
         except Exception as e:
             stages["save2"] = err_record(e)
             fail_rest("save2")
@@ -717,8 +754,8 @@ def apply_manifest_expectations(rec: dict) -> None:
     counts as failed and keeps its own diagnostics.
 
     ``survival_waiver``: a documented reason why LibreOffice cannot keep our
-    redline in *this* file (a redline inside a field result, inside a foreign
-    move, ...). The survival assertion is then reported as a skip with that
+    redline in *this* file (a redline inside a field result, ...). The
+    survival assertion is then reported as a skip with that
     reason — never as a pass — and a waiver that turns out to be unnecessary
     (everything survived) is itself a failure, so the manifest cannot quietly
     outlive the LibreOffice behavior it describes. Only ``WAIVABLE_ASSERTIONS``
 
@@ -363,8 +363,7 @@
     "producer": "LibreOffice core ooxmlexport fixture (Word/LO mixed)",
     "source": "https://raw.githubusercontent.com/LibreOffice/core/1c29ec6c2b2ec1f343545915ba66b7e9718b3792/sw/qa/extras/ooxmlexport/data/TC-table-DnD-move.docx",
     "size": 12977,
-    "sha256": "32419eb1c66dc5ca",
-    "survival_waiver": "the edited paragraph sits inside a foreign w:moveFrom (moved-away text); LibreOffice folds our deletion into the move's own deletion region on import"
+    "sha256": "32419eb1c66dc5ca"
   },
   "locore_99_Fields.docx": {
     "kind": "download",