diff --git a/.env.example b/.env.example
index 58de782..3cf78e5 100644
--- a/.env.example
+++ b/.env.example
@@ -17,3 +17,31 @@ PRINTER_NAME=
 # Full path to SumatraPDF.exe (Phase 5's PDF printing method). Empty = search
 # standard install locations. If set here, it is used as-is (no fallback).
 SUMATRA_PATH=
+
+# ------------------------------------------------------------------
+# Multi-format printing (docs/MULTI_FORMAT_PLAN.md). Phase 1 stores these;
+# each becomes active in the phase that needs it.
+# ------------------------------------------------------------------
+
+# Paper size for SumatraPDF's print settings. Empty (default) = the driver
+# chooses the paper — the spike-T4-proven behavior. Set e.g. A4 only after
+# spike T5 confirmed this printer honors the setting. Images are laid out
+# on A4 when this is empty.
+PAPER_SIZE=
+
+# Office documents (DOC/DOCX/XLS/XLSX/PPT/PPTX/ODF) are converted to PDF by
+# LibreOffice Headless (Phase 3). ENABLE_OFFICE=0 turns office formats off
+# without uninstalling anything; they are also refused while LibreOffice is
+# not installed (its "convert" needs ~400 MB RAM while running).
+ENABLE_OFFICE=1
+
+# Explicit path to soffice.exe. Empty = search the standard install
+# locations (C:\Program Files\LibreOffice\program\soffice.exe).
+LO_PATH=
+
+# Seconds an office conversion may run before the service kills LibreOffice.
+CONVERT_TIMEOUT_S=120
+
+# Job history database (SQLite, Phase 5). Default: logs/jobs.sqlite3 inside
+# the project folder. Delete the file to reset job history.
+# JOB_DB_PATH=
diff --git a/.gitignore b/.gitignore
index 21284cc..55223fb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,6 @@ logs/*
 .coverage
 .coverage.*
 htmlcov/
+
+# Z-Code
+.zcode/
diff --git a/README.md b/README.md
index e2f7aa6..fd18616 100644
--- a/README.md
+++ b/README.md
@@ -1,182 +1,401 @@
-# Printer Service — Print from your Android phone, over Wi-Fi
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="docs/logo/printerservice-logo-dark-bg.svg">
+    <source media="(prefers-color-scheme: light)" srcset="docs/logo/printerservice-logo.svg">
+    <img alt="PrinterService Logo" src="docs/logo/printerservice-logo.svg" width="460">
+  </picture>
+</p>
+
+<p align="center">
+  <strong>Print from your Android phone or any device over Wi-Fi to your USB printer</strong>
+</p>
+
+<p align="center">
+  <a href="https://github.com/samananias/printerService/actions/workflows/ci.yml">
+    <img src="https://github.com/samananias/printerService/actions/workflows/ci.yml/badge.svg" alt="CI">
+  </a>
+</p>
+
+A lightweight, self-hosted network printing service built with **Python** and **FastAPI**. It turns any standard USB-connected printer (such as the **Epson L3210**) attached to a Windows PC into a wireless network printer accessible directly from your Android phone or any browser on your local Wi-Fi network—no manufacturer cloud services, vendor apps, or specialized mobile drivers required.
 
-[![CI](https://github.com/samananias/printerService/actions/workflows/ci.yml/badge.svg)](https://github.com/samananias/printerService/actions/workflows/ci.yml)
+---
+
+## 📖 About The Project
+
+### The Problem
+Most entry-level desktop inkjets (like the Epson L3210) connect only via USB and lack built-in Wi-Fi or network capabilities. Mobile printing from Android typically requires proprietary manufacturer cloud apps, AirPrint/IPP hardware support, or complex network setups.
+
+### The Solution
+**Printer Service** acts as a lightweight software bridge running on a host Windows PC (even low-spec / old PCs). It exposes a mobile-friendly web application and REST API on your local network. When you select a document or image on your phone, the service accepts the upload, standardizes it into a print-ready PDF via dedicated format processors, and silently submits it to the Windows print queue using **SumatraPDF**. Windows and the official Epson driver handle the low-level USB communication and physical printing.
+
+```text
+┌─────────────────────────┐
+│  Android Phone / Client │
+│   (Browser / Web UI)    │
+└────────────┬────────────┘
+             │  Wi-Fi (HTTP POST /port 8000)
+             ▼
+┌─────────────────────────────────────────────────────────────┐
+│  Windows Host PC (Printer Service)                          │
+│                                                             │
+│  1. FastAPI Web Server & REST API (`/`, `/print`, `/jobs`)  │
+│  2. Validation & Security (Magic bytes, Size, PIN Auth)     │
+│  3. Format Processors (Normalize all inputs to PDF):        │
+│     • Images (Pillow) ────► PDF                             │
+│     • Office (LibreOffice) ► PDF                            │
+│     • TXT / CSV (ReportLab)► PDF                            │
+│     • PDF ────────────────► Pass-through                    │
+│  4. Print Pipeline & Job Engine (SQLite state tracking)     │
+│  5. SumatraPDF CLI (`-print-to` / `-print-settings`)        │
+└────────────┬────────────────────────────────────────────────┘
+             │  Windows Spooler API
+             ▼
+┌─────────────────────────┐
+│   Windows Print Queue   │
+│   Epson L3210 Driver    │
+└────────────┬────────────┘
+             │  USB Cable
+             ▼
+┌─────────────────────────┐
+│   Epson L3210 Printer   │
+│     (Paper Output)      │
+└─────────────────────────┘
+```
+
+### ✨ Key Features
+
+- **📱 Zero-Install Mobile Printing**: Open `http://<server-ip>:8000` in Chrome/Firefox on your phone to upload and print instantly.
+- **📄 Multi-Format Conversion**: Seamlessly print PDFs, Photos/Images, Microsoft Office documents, OpenDocument files, and plain text/CSV tables.
+- **⚙️ Configurable Print Options**: Set number of copies (1–99), specific page ranges (e.g., `2-6`, `odd`/`even`), paper sizes (A4, Letter, Legal, Long Bond, A3, A5), and Color vs. Monochrome modes.
+- **🛡️ Pre-Flight Hardware Checks**: Queries Windows spooler status flags (`offline`, `out of paper`, `door open`, `jam`) before dispatching jobs, preventing silent print failures.
+- **🔄 Robust Job Lifecycle & Recovery**: Durable job tracking backed by SQLite (`logs/jobs.sqlite3`), with one-click **🔁 Retry** for failed jobs and support for cancellation.
+- **🔒 Local Network Security**: Restricted to private LAN profiles, optional PIN authentication (`API_PIN`), strict file magic-byte validation, and process-tree cleanup.
+- **🧪 Comprehensive Testing**: 190+ automated tests (~97% coverage) with faked OS/spooler boundaries running in CI, accompanied by standalone hardware diagnostic spikes (T1–T7).
+
+### 📁 Supported Formats
 
-**Project:** Android phone → Wi-Fi → Python service (this PC) → Windows print queue → USB → Epson L3210
-**Status:** ✅ **MVP working end-to-end** — a phone upload prints real paper. ✅ Logic verified automatically: pytest suite + ruff lint run in CI on every push.
-**Full design document:** [docs/SOURCE_OF_TRUTH.md](docs/SOURCE_OF_TRUTH.md) — architecture, concepts, roadmap, testing plan. If it disagrees with this file, it wins.
+| Category | Extensions | Processing Method | Details |
+|---|---|---|---|
+| **PDF** | `.pdf` | Direct pass-through | Native vector submission via SumatraPDF |
+| **Images** | `.jpg`, `.jpeg`, `.png`, `.webp`, `.bmp`, `.gif`, `.tiff` | Pillow (PIL) | Automatic EXIF orientation, alpha-to-white transparency, centered on page, 300 DPI cap |
+| **Office Documents** | `.docx`, `.xlsx`, `.pptx`, `.doc`, `.xls`, `.ppt`, `.odt`, `.ods`, `.odp` | LibreOffice Headless | High-fidelity headless conversion, isolated throwaway profile, honors stored Excel print areas |
+| **Text & Data** | `.txt`, `.csv` | ReportLab | TXT formatted with monospace wrapping and pagination; CSV formatted with styled grid borders and headers |
 
 ---
 
-## Repo Map
+## 🗺️ Repo Map
 
 | Path | What it is |
 |---|---|
-| `app/` | The service: FastAPI app, upload + print pipeline, job tracking, Windows printing |
-| `app/api/web.py` | The mobile web page (file picker + Print button) served at `/` |
-| `tests/` | pytest suite — unit tests (OS boundaries faked) + API tests via TestClient |
-| `tests/conftest.py` | Shared fixtures: fresh job store, temp `uploads/`, fake `win32print`, print mock |
-| `spike_print_test.py` | Standalone printer diagnostic — run it when printing misbehaves |
-| `allow_firewall_8000.bat` | One-click firewall rule (run as administrator, once) |
-| `.env.example` | Configuration template — copy to `.env` (never committed) |
-| `requirements.txt` | Python packages: fastapi, uvicorn, pywin32, python-multipart |
-| `requirements-dev.txt` | Dev tools: pytest, pytest-cov, httpx, ruff |
-| `pyproject.toml` | Tool config: pytest options, coverage gate (90%), ruff lint rules |
-| `.github/workflows/ci.yml` | GitHub Actions: lint + tests on every push/PR (Ubuntu) |
-| `uploads/`, `logs/` | Runtime temp files (auto-cleaned) and `logs/service.log` |
+| `app/` | Core application: FastAPI routes, format processors, upload validation, print pipeline, and job engine |
+| `app/api/web.py` | Mobile web application (file upload form, options dialog, live job status) served at `/` |
+| `tests/` | Pytest test suite: unit tests (OS boundaries faked) and API tests via FastAPI `TestClient` |
+| `tests/conftest.py` | Shared test fixtures: isolated job stores, temporary `uploads/`, mock `win32print`, print mocks |
+| `spike_print_test.py` | Core hardware diagnostic spike (T1–T4) — validates printer visibility, spooler, and SumatraPDF |
+| `spike_t5_images.py` | Image printing spike (T5) — tests image conversion, EXIF rotation, and paper size on real hardware |
+| `spike_t6_office.py` | Office document spike (T6) — tests LibreOffice conversion of DOCX, XLSX, and PPTX |
+| `spike_t7_text.py` | Text & CSV spike (T7) — tests plain-text wrapping and grid table rendering |
+| `allow_firewall_8000.bat` | One-click Windows Firewall script to allow inbound TCP traffic on port 8000 |
+| `.env.example` | Configuration template — copy to `.env` for local customizations |
+| `requirements.txt` | Production dependencies: FastAPI, Uvicorn, pywin32, Pillow, ReportLab, python-multipart |
+| `requirements-dev.txt` | Development & testing tools: pytest, pytest-cov, httpx, ruff |
+| `pyproject.toml` | Tool configurations: pytest options, coverage thresholds (90%), ruff linting rules |
+| `.github/workflows/ci.yml` | Continuous integration workflow: runs ruff and pytest on Ubuntu runners |
+| `uploads/`, `logs/` | Runtime directories for temporary upload processing and rotating logs (`logs/service.log`) |
+| `docs/logo/` | Project branding assets: SVG icons and wordmark logos (light & dark backgrounds) |
 
 ---
 
-## 1. What to Install
+## 📦 1. Installation & Prerequisites
 
-### The machine that runs the service (the one with printer access)
+### Server Machine (The Windows PC connected to the printer)
 
-| Requirement | Why | How |
+| Requirement | Purpose | Installation Instructions |
 |---|---|---|
-| **Python 3.12+** | Runs the service | `winget install -e --id Python.Python.3.12` or [python.org](https://www.python.org/downloads/). Verify: `python --version`. If typing `python` opens the Microsoft Store: *Settings → Apps → Advanced app settings → App execution aliases* → turn OFF `python.exe` / `python3.exe` |
-| **SumatraPDF** | The PDF printing engine — the service hands PDFs to it silently | `winget install SumatraPDF.SumatraPDF` or [sumatrapdfreader.org](https://www.sumatrapdfreader.org). No configuration needed — standard install locations are searched automatically |
-| **Epson L3210 driver** | Windows must print normally on its own first | Test: *Settings → Printers → Epson L3210 → Print test page*. If that fails, fix it before anything else |
-| **Firewall rule, TCP 8000** | The #1 reason phones "can't connect" | Right-click `allow_firewall_8000.bat` → **Run as administrator** (one time), or accept Windows' pop-up on first run (tick *Private networks*) |
+| **Python 3.12+** | Runs the Python service | Install via winget: `winget install -e --id Python.Python.3.12` or download from [python.org](https://www.python.org/downloads/).<br>Verify: `python --version`<br>*(Note: If typing `python` opens the Microsoft Store: go to **Windows Settings → Apps → Advanced app settings → App execution aliases** and turn **OFF** `python.exe` and `python3.exe`)* |
+| **SumatraPDF** | Silent PDF printing engine | Install via winget: `winget install SumatraPDF.SumatraPDF` or download from [sumatrapdfreader.org](https://www.sumatrapdfreader.org). Standard install paths are detected automatically. |
+| **Epson L3210 Driver** | Windows printer driver | Ensure Windows can print normally: *Windows Settings → Printers → Epson L3210 → Print test page*. |
+| **LibreOffice** *(Optional)* | Office-to-PDF conversion | Required for `.docx`, `.xlsx`, `.pptx`, `.odt`, etc. Without it, office uploads are refused with a friendly message while PDF/image/text printing continues working.<br>Install via the CLI recipe below or from [libreoffice.org](https://www.libreoffice.org). |
+| **Windows Firewall Rule** | Allows LAN traffic on port 8000 | Right-click `allow_firewall_8000.bat` → **Run as administrator** (one-time setup), or allow it on the Windows Defender prompt on first run (select *Private networks*). |
 
-### The phone
+#### Installing LibreOffice via CLI (Fast & Scriptable)
+Download and run the official MSI installer using PowerShell:
 
-Nothing to install — any browser. Same Wi-Fi network as the service PC (guest networks usually isolate devices — a classic silent failure).
+```powershell
+curl.exe -L -o "$env:TEMP\LibreOffice.msi" "https://download.documentfoundation.org/libreoffice/stable/26.8.0/win/x86_64/LibreOffice_26.8.0_Win_x86-64.msi"
+msiexec /i "$env:TEMP\LibreOffice.msi"
+```
+
+A default "Typical" installation installs to `C:\Program Files\LibreOffice\program\soffice.exe`, which the service detects automatically (set `LO_PATH` in `.env` only if installed in a custom path).
+
+### Phone / Client Device
+- **Zero installation needed**: Any modern mobile browser (Chrome, Safari, Firefox).
+- **Network requirement**: Must be connected to the **same Wi-Fi network** as the server PC (note: guest Wi-Fi networks usually isolate devices and prevent connection).
 
 ---
 
-## 2. One-Time Setup
+## 🚀 2. One-Time Setup
+
+Clone or copy the repository to your host PC, open a terminal in the project root folder, and follow the instructions for your preferred shell:
 
-From the project folder:
+### Option A: PowerShell / Command Prompt (CMD)
 
 ```powershell
-python -m venv .venv                     # create an isolated Python environment
-.venv\Scripts\activate                   # activate it — prompt gains (.venv)
-pip install -r requirements.txt          # install fastapi, uvicorn, pywin32, python-multipart
-copy .env.example .env                   # local config (see §5; defaults are fine)
+# 1. Create an isolated virtual environment
+python -m venv .venv
+
+# 2. Activate the virtual environment
+.venv\Scripts\activate
+
+# 3. Install required Python packages
+pip install -r requirements.txt
+
+# 4. Create your local configuration file
+copy .env.example .env
+```
+
+> [!TIP]
+> **PowerShell execution policy error with `Activate.ps1`?**
+> If script execution is restricted, run this command once and retry activating:
+> ```powershell
+> Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
+> ```
+
+### Option B: Git Bash
+
+```bash
+# 1. Create an isolated virtual environment
+python -m venv .venv
+
+# 2. Activate the virtual environment (use 'source' and forward slashes)
+source .venv/Scripts/activate
+
+# 3. Install required Python packages
+pip install -r requirements.txt
+
+# 4. Create your local configuration file
+cp .env.example .env
 ```
 
-> PowerShell blocked `Activate.ps1`? Run once, then retry:
-> `Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser`
-> Git Bash activation: `source .venv/Scripts/activate`
+> [!NOTE]
+> **Git Bash Tip:** Always use forward slashes `/` and `source`. In Git Bash, backslashes `\` act as escape characters (so `.venv\Scripts\activate` will fail with "command not found").
 
 ---
 
-## 3. Run the Service
+## ▶️ 3. Running the Service
+
+From the project root folder:
+
+### PowerShell / Command Prompt
 
 ```powershell
 .venv\Scripts\activate
 uvicorn app.main:app --host 0.0.0.0 --port 8000
 ```
 
-- Keep the window open — the service exists only while it runs. `Ctrl+C` stops it.
-- `--host 0.0.0.0` is **required** — it means "listen on all network interfaces". Omit it and the phone can never connect.
-- No-activation one-liner (works from any terminal, any folder):
-  ```powershell
-  .venv\Scripts\python.exe -m uvicorn app.main:app --host 0.0.0.0 --port 8000
-  ```
-- Working looks like: `INFO: Uvicorn running on http://0.0.0.0:8000 (Press CTRL+C to quit)`
-- Quick self-check from the same PC: open `http://localhost:8000/health` → `{"status":"ok"}`
-- Changed the code? Run **Run the checks** below — same commands CI runs.
+*Or via the direct one-liner (without manual activation):*
+```powershell
+.venv\Scripts\python.exe -m uvicorn app.main:app --host 0.0.0.0 --port 8000
+```
 
----
+### Git Bash
 
-## 4. Print From the Phone
+```bash
+source .venv/Scripts/activate
+uvicorn app.main:app --host 0.0.0.0 --port 8000
+```
 
-1. Find the service PC's IP: run `ipconfig`, note the **IPv4 Address** (e.g. `192.168.1.5`). Tip: set a **DHCP reservation** for it in the router so it never changes.
-2. On the phone (same Wi-Fi): open `http://<that-ip>:8000`
-3. Pick a PDF → tap **Print** → watch the status:
-   `📨 Queued… → ⏳ status: queued… → 🖨️ Printed to EPSON L3210 Series!`
-4. Paper comes out. Done.
+*Or via the direct one-liner (without manual activation):*
+```bash
+.venv\Scripts\python.exe -m uvicorn app.main:app --host 0.0.0.0 --port 8000
+```
 
-Other endpoints (also browsable interactively at `http://<ip>:8000/docs`):
+### 💡 Runtime Notes
+- Keep the terminal window open—the service runs as long as the process is active. Press `Ctrl+C` to stop it.
+- `--host 0.0.0.0` is **mandatory** because it instructs the server to listen on all local network interfaces so your phone can reach it.
+- A successful startup output looks like: `INFO: Uvicorn running on http://0.0.0.0:8000 (Press CTRL+C to quit)`
+- **Self-Check**: On the host PC, open `http://localhost:8000/health` in your browser to verify it returns `{"status":"ok"}`.
 
-| Endpoint | What it does |
-|---|---|
-| `GET /health` | Is the service up? First thing to check when anything seems broken |
-| `GET /printers` | Which printers Windows sees (the L3210 should be listed) |
-| `POST /print` | Upload a PDF and print it |
-| `GET /jobs` | Recent jobs and their statuses |
-| `GET /jobs/{id}` | One job's status (what the page polls) |
-| `DELETE /jobs/{id}` | Cancel a job that hasn't printed yet |
+---
+
+## 📱 4. Printing From Your Phone
+
+1. **Find the PC's Local IP Address**:
+   - Open Command Prompt/PowerShell on the server PC and run `ipconfig`.
+   - Note the **IPv4 Address** (e.g., `192.168.1.5`).
+   - *(Recommended)* Set a **DHCP reservation** in your home router settings so this IP address never changes.
+2. **Open the Web UI on your Phone**:
+   - Make sure your phone is connected to the same Wi-Fi.
+   - Open your mobile browser and navigate to `http://<server-ip>:8000` (e.g., `http://192.168.1.5:8000`).
+3. **Upload and Print**:
+   - Select a document or image (PDF, JPG/PNG/WebP, DOCX/XLSX/PPTX, or TXT/CSV).
+   - Tap **Print**.
+   - Watch the live progress status:
+     `📨 Queued… → ⏳ status: converting… → 🖨️ status: printing… → ✅ Printed to EPSON L3210 Series!`
+4. **Formatting Behaviors**:
+   - **Images**: Automatically fitted and centered on an A4 page with white margins; camera EXIF orientation is respected.
+   - **Office Files**: Converted via LibreOffice headless (typically 10–30s); UI indicates `converting` state during processing.
+   - **TXT & CSV**: TXT prints formatted monospace text with automatic line-wrapping; CSV renders a structured, bordered grid table.
+5. **Job Retries & Cancellation**:
+   - If a job fails (e.g., printer out of paper), the uploaded source file is preserved. Tap the **🔁 Retry** button on the web page or call `POST /jobs/{id}/retry`.
+   - Active jobs can be cancelled while queued, converting, or printing (best-effort once handed to the Windows spooler).
+6. **Print Options Dialog** (Expandable on the web page):
+   - **Copies**: 1 to 99 copies.
+   - **Page Range**: Custom ranges (`2-6`, `1,3,5`), `odd`, or `even`.
+   - **Paper Size**: A4, Short Bond (Letter), Long Bond (8.5×13 / Folio), Legal, A3, A5.
+   - **Color Mode**: Full Color or Monochrome (Black & White).
+   - *Options apply across all document formats and are retained when retrying a job.*
+
+### 🌐 API Reference
+
+The service provides a full REST API, also browsable interactively via Swagger UI at `http://<server-ip>:8000/docs`:
+
+| Endpoint | Method | Description |
+|---|---|---|
+| `/health` | `GET` | Server health check (`{"status": "ok"}`). Ideal for reachability verification. |
+| `/printers` | `GET` | Lists all printers detected by Windows via `pywin32`. |
+| `/print` | `POST` | Upload and queue a file for printing (accepts optional print settings). |
+| `/jobs` | `GET` | Lists recent print jobs and their current execution statuses. |
+| `/jobs/{id}` | `GET` | Fetches detailed status and metadata for a specific print job. |
+| `/jobs/{id}` | `DELETE` | Cancels an active or queued print job. |
+| `/jobs/{id}/retry` | `POST` | Re-dispatches a failed job using its stored upload without re-uploading. |
 
 ---
 
-## 5. Configuration (`.env`)
+## ⚙️ 5. Configuration (`.env`)
 
-Copy `.env.example` → `.env` and edit. All values are optional; defaults work.
+Copy `.env.example` to `.env` to configure optional server settings. All keys are optional—the default configuration is ready for immediate use:
 
-| Key | Default | Meaning |
+| Key | Default | Description |
 |---|---|---|
-| `MAX_UPLOAD_MB` | `25` | Upload size limit (bigger files are rejected with HTTP 413) |
-| `API_PIN` | *(empty)* | If set, printing/cancelling requires the PIN (sent as `X-API-PIN`; the web page has a PIN field). Empty = no auth |
-| `PRINTER_NAME` | *(empty)* | Target printer. Empty = Windows' default printer |
-| `SUMATRA_PATH` | *(empty)* | Explicit path to `SumatraPDF.exe`. Empty = search standard locations. If set, used as-is (misconfiguration fails loudly) |
-| `HOST`, `PORT` | `8000` | Informational — actually pass them on the uvicorn command line (§3) |
+| `MAX_UPLOAD_MB` | `25` | Maximum allowed upload size in megabytes (larger files rejected with HTTP 413). |
+| `API_PIN` | *(empty)* | Optional security PIN. When set, requests require the `X-API-PIN` header (the web interface will display a PIN input field). |
+| `PRINTER_NAME` | *(empty)* | Specific Windows printer name to target. If empty, the system default printer is used. |
+| `SUMATRA_PATH` | *(empty)* | Custom path to `SumatraPDF.exe`. Leave empty to use automatic standard path detection. |
+| `PAPER_SIZE` | *(empty)* | Default paper size token passed to driver (e.g. `A4`). Leave empty to let the Windows driver choose. |
+| `ENABLE_OFFICE` | `1` | Enables office file processing (`.docx`, `.xlsx`, `.pptx`, `.odt`). Set to `0` to disable office conversion. |
+| `LO_PATH` | *(empty)* | Custom path to LibreOffice `soffice.exe`. Leave empty to use automatic discovery. |
+| `CONVERT_TIMEOUT_S` | `120` | Maximum timeout in seconds for LibreOffice conversion before terminating the process tree. |
+| `JOB_DB_PATH` | `logs/jobs.sqlite3` | Path to the SQLite job history database. Delete the file at any time to reset job history. |
+| `HOST`, `PORT` | `8000` | Reference settings (actual binding host and port are passed via the `uvicorn` CLI command). |
+
+> [!NOTE]
+> - **Pre-Flight Checks**: The service verifies spooler status (`offline`, `out of paper`, `door open`, `error`) before dispatching jobs.
+> - **SumatraPDF Exit Codes**: Exit codes (2 = corrupt file, 4 = printer not found, 5 = driver error) are translated into clear, human-readable explanations.
+> - **Log Management**: Log files in `logs/service.log` automatically rotate at ~1 MB with 2 backup archives kept.
 
 ---
 
-## 6. Diagnostics: the Printer Spike
+## 🩺 6. Diagnostics & Hardware Spikes
+
+If printing ever fails or you want to verify your setup before launching the service, use the standalone diagnostic spike scripts:
 
-If printing ever misbehaves, `spike_print_test.py` checks each link of the chain separately (needs `pip install pywin32` on the machine it runs on):
+### Core Printer Diagnostic (T1–T4)
+Run from the project root (requires `pywin32`):
 
 ```powershell
 python spike_print_test.py
 ```
 
-It reports: printer visibility (T1), spooler acceptance (T2), Windows print-verb (T3), SumatraPDF (T4) — with a summary and "what to do with this result" guidance. **T4 passing + paper = the whole chain works.** See SOURCE_OF_TRUTH Section 5 for the recorded results that decided the current design.
+This diagnostic systematically checks each layer:
+- **T1**: Verifies printer visibility through `win32print`.
+- **T2**: Tests RAW text submission to the Windows spooler.
+- **T3**: Checks the Windows "print" shell verb.
+- **T4**: Tests silent PDF printing through SumatraPDF to the physical printer.
+- **Result:** T4 PASS with a printed test page confirms the entire Python → SumatraPDF → Spooler → USB chain is functional.
 
----
+### Multi-Format Acceptance Spikes
+- **`spike_t5_images.py`**: Tests ImageProcessor conversion (JPEG, PNG with transparency, WebP, EXIF orientation) and prints to paper.
+- **`spike_t6_office.py`**: Tests OfficeProcessor (DOCX tables, landscape XLSX with print areas, 16:9 PPTX) using LibreOffice.
+- **`spike_t7_text.py`**: Tests TextProcessor rendering of wrapped text and CSV tables.
 
-## 7. Deploying to the Print-Server PC (final step)
+---
 
-1. Install **Python 3.12+** and **SumatraPDF** on that PC (§1)
-2. Get the code there: `git clone` / `git pull`, or copy the folder (delete `.venv` first — recreate it there with §2)
-3. `pip install -r requirements.txt`, `copy .env.example .env`
-4. Run `allow_firewall_8000.bat` **as administrator** on that PC
-5. Run `python spike_print_test.py` there once — confirm T1/T2/T4 pass with paper
-6. Start the service (§3) and test from the phone using **that PC's IP** (`ipconfig`)
-7. Set the router's **DHCP reservation** for that PC so its IP is stable
-8. Auto-start on boot (optional): Task Scheduler → *Create Task* → trigger "At startup" → action: `C:\...\printerService\.venv\Scripts\python.exe` with arguments `-m uvicorn app.main:app --host 0.0.0.0 --port 8000`, start-in the project folder
+## 🖥️ 7. Deploying to the Dedicated Print-Server PC
+
+Follow these steps when setting up the service permanently on your print-server machine:
+
+1. **Install Prerequisites**: Install **Python 3.12+**, **SumatraPDF**, printer drivers, and optionally **LibreOffice** (§1).
+2. **Obtain the Code**: Clone the repository with `git clone` or copy the project folder (ensure you delete any existing `.venv` folder before copying).
+3. **Set Up Virtual Environment**:
+   ```powershell
+   python -m venv .venv
+   .venv\Scripts\activate
+   pip install -r requirements.txt
+   copy .env.example .env
+   ```
+4. **Configure Firewall**: Run `allow_firewall_8000.bat` **as Administrator** to open TCP port 8000.
+5. **Run Diagnostics**: Run `python spike_print_test.py` to confirm physical paper prints successfully.
+6. **Start the Server**: Launch the service using the instructions in §3 and verify connectivity from your phone.
+7. **Reserve Static IP**: In your home router configuration, create a **DHCP reservation** for the PC's MAC address to keep its IP permanent.
+8. **Configure Auto-Start on Boot (Optional via Windows Task Scheduler)**:
+   - Open **Task Scheduler** → *Create Task*.
+   - **General**: Name the task (e.g., `PrinterService`), check *Run whether user is logged on or not*.
+   - **Triggers**: Set trigger to **At startup**.
+   - **Actions**: Set action to **Start a program**:
+     - *Program/script*: `C:\path\to\printerService\.venv\Scripts\python.exe`
+     - *Add arguments*: `-m uvicorn app.main:app --host 0.0.0.0 --port 8000`
+     - *Start in*: `C:\path\to\printerService\`
 
 ---
 
-## 8. When Something Breaks
-
-| Symptom | Likely cause / fix |
-|---|---|
-| Phone can't connect at all (page hangs) | Firewall rule missing (§1), or phone on a different Wi-Fi/guest network |
-| `error 10048` on startup | Port 8000 taken by another program — close it or use `--port 8001` (and that port on the phone) |
-| Phone reaches `/health` but print fails | Read the error on the page or in `logs/service.log`; run the spike (§6) |
-| Job `failed`: SumatraPDF not found | Install SumatraPDF (§1) or set `SUMATRA_PATH` in `.env` |
-| Job `failed`: printer not default / offline | Check the printer in Windows, print a Windows test page |
-| Service IP changed after reboot | Set the router's DHCP reservation (§7 step 7) |
+## 🛠️ 8. Troubleshooting & Common Issues
 
-Full troubleshooting table: [docs/SOURCE_OF_TRUTH.md](docs/SOURCE_OF_TRUTH.md) Section 14. Debug in this order — connectivity (IP/port) → firewall → service → printing logic (Section 15 explains why).
+| Symptom | Likely Cause | Recommended Fix |
+|---|---|---|
+| Phone browser hangs / cannot connect | Missing Windows Firewall rule or wrong network | Run `allow_firewall_8000.bat` as Admin (§1). Ensure phone is on the same private Wi-Fi network (not a guest network). |
+| `error 10048` on server startup | Port 8000 is already in use | Terminate the conflicting application or start Uvicorn with `--port 8001` (and use port 8001 on the phone). |
+| Phone reaches `/health` but print job fails | Printer offline or driver error | Check printer power/cable, verify test print in Windows Settings, and check error messages in `logs/service.log`. |
+| Job fails: `SumatraPDF not found` | SumatraPDF is not installed in a standard location | Install SumatraPDF via winget (§1) or set the exact binary path in `SUMATRA_PATH` in `.env`. |
+| Job fails: `Printer offline / out of paper` | Pre-flight readiness check failed | Ensure printer is turned on, paper is loaded in tray, and clear any paper jams, then click **🔁 Retry**. |
+| Job fails: `Printer not default / not found` | Printer name mismatch | Set the exact printer name under `PRINTER_NAME` in `.env` matching Windows printer settings. |
+| Office upload rejected: `LibreOffice not installed` | Missing LibreOffice or `ENABLE_OFFICE=0` | Install LibreOffice (§1) or verify `ENABLE_OFFICE=1` in `.env`, then restart the service. |
+| Office conversion fails: `Timeout after 120 s` | Large or complex document | Increase `CONVERT_TIMEOUT_S` in `.env` or export to PDF directly on your client device. |
+| Office print layout looks altered (fonts/margins) | Missing server-side fonts or missing print area | Install standard font packs on Windows server; for spreadsheets, define an explicit Print Area in Excel. |
+| SumatraPDF fails with exit codes `2`, `4`, or `5` | File corrupt (`2`), printer missing (`4`), or driver error (`5`) | Review detailed logs in `logs/service.log` and verify the PDF renders in SumatraPDF directly. |
+| Server IP address changes after PC reboot | Dynamic DHCP re-assignment | Set a static IP or configure a DHCP reservation on your home router (§7). |
+
+> [!TIP]
+> **Recommended Debugging Hierarchy**: Always diagnose issues from the bottom up:
+> 1. Physical Hardware & Drivers (USB cable, paper, Windows test page)
+> 2. Network Connectivity (IP address, ping, same Wi-Fi subnet)
+> 3. Firewall & Ports (Inbound rules on port 8000)
+> 4. Application Logic & Service Logs (`logs/service.log`, `http://localhost:8000/health`)
 
 ---
 
-## Run the Checks (what CI runs)
+## 🧪 9. Running Tests & Developer Checks
 
-Changed the service code? Two commands verify the logic — without printing anything:
+Verify code quality and ensure test coverage before committing changes (mirrors CI workflow):
 
+### PowerShell / Command Prompt
 ```powershell
 .venv\Scripts\activate
-pip install -r requirements-dev.txt   # once per machine
-ruff check .                          # lint: unused imports, undefined names, style drift
-pytest                                # the suite + coverage report (fails below the 90% gate)
+pip install -r requirements-dev.txt   # Install testing dependencies (once)
+ruff check .                          # Linting: unused imports, style rules, bugs
+pytest                                # Executes full test suite with coverage report (≥90% gate)
 ```
 
-- **Unit tests** (`tests/unit/`) exercise validation, job tracking, PIN auth, and the printing decisions with every OS boundary faked — no printer, no SumatraPDF, no network needed.
-- **API tests** (`tests/api/`) drive the whole FastAPI app through a test client, the same requests the phone makes.
-- Tests never touch machine state (real `uploads/` is redirected to a temp dir), so they run identically on your PC and on CI's Ubuntu runner.
-- Real paper **can't** be tested by CI — no printer is attached to it. The spike (§6) stays the hardware test.
-- GitHub Actions runs both commands on every push and pull request (`.github/workflows/ci.yml`); the badge at the top shows the latest result.
+### Git Bash
+```bash
+source .venv/Scripts/activate
+pip install -r requirements-dev.txt   # Install testing dependencies (once)
+ruff check .                          # Linting: unused imports, style rules, bugs
+pytest                                # Executes full test suite with coverage report (≥90% gate)
+```
+
+### Test Architecture Highlights
+- **Unit Tests (`tests/unit/`)**: Verify file validation, magic-byte detection, format processors, and pipeline state transitions with all OS interactions (subprocess, file system, `win32print`) completely faked.
+- **API Tests (`tests/api/`)**: Simulate real client and phone requests against FastAPI endpoints using `httpx` and `TestClient` without network overhead.
+- **Hardware Isolation**: Automated tests never touch the real printer or filesystem state, enabling the exact same test suite to run identically on Windows development machines and Ubuntu CI runners.
+- **CI Automation**: GitHub Actions runs `ruff check` and `pytest` with a 90% coverage threshold on every push and pull request (`.github/workflows/ci.yml`).
 
 ---
 
-## Where to Go Next
+## 📚 10. Documentation & References
+
+For deep dives into architectural decisions, roadmap phases, and design rationales, refer to the project documentation:
 
-- **Roadmap & current phase** → [docs/SOURCE_OF_TRUTH.md](docs/SOURCE_OF_TRUTH.md) Section 9
-- **Why it's built this way** → Sections 3–8 there (protocol choice, tech stack, security, scope)
-- **API design** → Section 11 · **Testing plan + how the automated suite fits in** → Section 13
-- **How the test fixtures work** → the commented `tests/conftest.py` · **What CI runs** → `.github/workflows/ci.yml`
+- **[docs/SOURCE_OF_TRUTH.md](docs/SOURCE_OF_TRUTH.md)**: The authoritative architecture document, technology stack rationale, network security rules, and detailed failure diagnostic guides.
+- **[docs/MULTI_FORMAT_PLAN.md](docs/MULTI_FORMAT_PLAN.md)**: Multi-format design record, decision logs (Pillow, LibreOffice, ReportLab), and the T5–T7 spike protocols.
+- **[tests/conftest.py](tests/conftest.py)**: Reference for test fixture implementations and Windows printing mocks.
diff --git a/app/api/jobs.py b/app/api/jobs.py
index 2d7affe..bded906 100644
--- a/app/api/jobs.py
+++ b/app/api/jobs.py
@@ -1,20 +1,25 @@
 """
-Jobs API (Phase 7) — see what happened, poll status, cancel mistakes.
+Jobs API (Phase 7; queue management in p14) — see what happened, poll
+status, cancel mistakes, retry failures.
 
-Endpoints (SOURCE_OF_TRUTH Section 11):
-  GET    /jobs        — recent jobs and their statuses
-  GET    /jobs/{id}   — one job (what the phone UI polls: "done yet?")
-  DELETE /jobs/{id}   — cancel a job that hasn't reached the print queue
+Endpoints (SOURCE_OF_TRUTH Section 11, extended by p14):
+  GET    /jobs              — recent jobs and their statuses
+  GET    /jobs/{id}         — one job (what the phone UI polls: "done yet?")
+  DELETE /jobs/{id}         — cancel a job (queued/converting/printing)
+  POST   /jobs/{id}/retry   — re-print a failed job from its stored upload
 """
 
+import logging
+
 from fastapi import APIRouter, Depends, HTTPException
 
-from app.models.printing import PrintJob
-from app.services import jobs
+from app.models.printing import JobStatus, PrintJob
+from app.printer import windows
+from app.services import jobs, pipeline, uploads
 from app.services.auth import require_pin
-from app.services.uploads import upload_path
 
 router = APIRouter()
+logger = logging.getLogger(__name__)
 
 
 @router.get("/jobs", response_model=list[PrintJob])
@@ -34,19 +39,70 @@ def one_job(job_id: str):
 
 @router.delete("/jobs/{job_id}", response_model=PrintJob)
 def cancel(job_id: str, _: None = Depends(require_pin)):
-    """Cancel a queued job (Section 11: "you will queue the wrong file")."""
+    """Cancel a job (Section 11: "you will queue the wrong file").
+
+    p14: cancellation works while queued, converting AND printing. The
+    printing case is best-effort — our queued spooler jobs are purged via
+    win32print, but paper that already fed into the printer cannot be
+    recalled; the pipeline never marks a cancelled job done.
+    """
     job = jobs.get_job(job_id)
     if job is None:
         raise HTTPException(status_code=404, detail=f"No job with id '{job_id}'.")
+    was_printing = job.status == JobStatus.PRINTING
 
     ok, message = jobs.cancel_job(job_id)
     if not ok:
         raise HTTPException(status_code=409, detail=message)
 
-    # Remove the stored file so cancelled uploads don't fill the disk.
-    try:
-        upload_path(job_id).unlink(missing_ok=True)
-    except OSError:
-        pass  # cleanup failure must not fail the cancel
+    # Best-effort spooler purge for anything already handed to Windows.
+    # Never fails the cancel — a purge hiccup must not 500 the request.
+    if was_printing:
+        try:
+            removed = windows.cancel_spooler_jobs(
+                windows.resolve_printer_name(), job_id
+            )
+            if removed:
+                logger.info(
+                    "purged %d spooler job(s) for cancelled job %s", removed, job_id
+                )
+        except Exception:
+            logger.warning(
+                "spooler purge failed for cancelled job %s", job_id, exc_info=True
+            )
+
+    # Remove the stored file(s) so cancelled uploads don't fill the disk.
+    # delete_job_files covers the source upload and its converted PDF.
+    uploads.delete_job_files(job_id)
+
+    return jobs.get_job(job_id)
+
+
+@router.post("/jobs/{job_id}/retry", response_model=PrintJob)
+def retry(job_id: str, _: None = Depends(require_pin)):
+    """Re-print a failed job (p14).
+
+    Failed jobs keep their uploaded file precisely for this. The pipeline
+    re-runs from conversion — a transient failure (printer offline, a
+    LibreOffice hiccup) becomes a second chance without re-uploading.
+    """
+    job = jobs.get_job(job_id)
+    if job is None:
+        raise HTTPException(status_code=404, detail=f"No job with id '{job_id}'.")
+    if job.status != JobStatus.FAILED:
+        raise HTTPException(
+            status_code=409,
+            detail=f"Job is '{job.status}' — only failed jobs can be retried.",
+        )
+
+    source = jobs.get_source(job_id)
+    if source is None or not source[0].is_file():
+        raise HTTPException(
+            status_code=409,
+            detail="The uploaded file for this job is gone — upload it again.",
+        )
 
+    jobs.reset_for_retry(job_id)
+    pipeline.start_job(job_id, source[0], source[1], options=job.options)
+    logger.info("job %s queued for retry", job_id)
     return jobs.get_job(job_id)
diff --git a/app/api/print.py b/app/api/print.py
index 1bddd9d..c295256 100644
--- a/app/api/print.py
+++ b/app/api/print.py
@@ -1,67 +1,97 @@
 """
-POST /print — accept a PDF upload (Phase 4).
+POST /print — accept a printable file (Phase 4; multi-format in p10).
 
-Printing itself arrives in Phase 5; this endpoint proves the *transfer* half
-of the pipeline: phone → HTTP → validated bytes on disk, intact.
+Printing itself arrives in Phase 5's background thread; this endpoint
+proves the *transfer* half of the pipeline: phone → HTTP → validated bytes
+on disk, intact.
+
+Phase 1 (multi-format refactor) keeps the behavior PDF-only, but the flow
+is now format-agnostic (docs/MULTI_FORMAT_PLAN.md §8):
+
+  1. FastAPI/python-multipart parse the request and hand us the bytes.
+  2. validate_upload() applies the Section 8 checks (type, content,
+     availability, size) and returns the detected category. A category
+     prints once its processor is registered AND available on this
+     machine (PDF, images and text always; office additionally needs
+     LibreOffice installed / ENABLE_OFFICE=1). Refusals explain which
+     gate fired.
+  3. save_upload() stores the bytes under a unique job id, keeping the
+     real extension.
+  4. The job is registered (category recorded) and handed to the
+     background pipeline: convert → print → cleanup.
+
+Returns 201 with the job id. Errors: 401 (bad PIN), 415 (unsupported file
+or lying extension), 413 (too large), 500 (disk trouble).
 """
 
 import logging
+from pathlib import Path
 
-from fastapi import APIRouter, Depends, File, HTTPException, UploadFile
+from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile
 
-from app.models.printing import PrintAccepted
+from app.detection import DEFAULT_EXTENSIONS
+from app.models.printing import PrintAccepted, validate_print_options
 from app.services import jobs, pipeline
 from app.services.auth import require_pin
-from app.services.uploads import UploadError, save_upload, validate_pdf
+from app.services.uploads import UploadError, save_upload, validate_upload
 
 router = APIRouter()
 logger = logging.getLogger(__name__)
 
 
 @router.post("/print", response_model=PrintAccepted, status_code=201)
-async def print_pdf(
+async def print_file(
     file: UploadFile = File(...),
+    copies: int = Form(1),
+    pages: str = Form(""),
+    paper: str = Form(""),
+    color_mode: str = Form("color"),
     _: None = Depends(require_pin),  # PIN required only when API_PIN is set
 ):
-    """Accept a PDF exactly like a web form uploads a photo: a
+    """Accept a file exactly like a web form uploads a photo: a
     multipart/form-data POST whose file field is named "file".
 
-    Flow (SOURCE_OF_TRUTH Section 5, stages 2-7):
-      1. FastAPI/python-multipart parse the request and hand us the bytes.
-      2. validate_pdf() applies the Section 8 checks (type, size).
-      3. save_upload() stores them under a unique job_id in uploads/.
-      4. The job is registered in the in-memory tracker (Phase 7).
-      5. pipeline.start_job() submits it to the Windows print queue in a
-         background thread; status moves queued → done/failed there.
-
-    Returns 201 with the job id. Errors: 401 (bad PIN), 415 (not a PDF),
-    413 (too large), 500 (disk trouble).
-    """
+    The print options (copies, pages, paper, color_mode) are all optional
+    with safe defaults — Phase 7; see PrintOptions for the allowlists."""
     data = await file.read()
+    filename = file.filename or ""
 
     try:
-        validate_pdf(file.filename or "", data)
+        category = validate_upload(filename, data)
     except UploadError as exc:
-        logger.warning("rejected upload %r: %s", file.filename, exc)
+        logger.warning("rejected upload %r: %s", filename, exc)
         raise HTTPException(status_code=exc.status_code, detail=str(exc))
 
     try:
-        job_id, path = save_upload(data)
+        options = validate_print_options(copies, pages, paper, color_mode).model_dump()
+    except ValueError as exc:
+        logger.warning("rejected upload %r: bad print options: %s", filename, exc)
+        raise HTTPException(status_code=422, detail=str(exc))
+
+    # Store under the real extension; a client that sent no usable filename
+    # gets the canonical one for its (magic-proven) category.
+    ext = Path(filename).suffix.lower() or DEFAULT_EXTENSIONS[category]
+
+    try:
+        job_id, path = save_upload(data, ext=ext)
     except OSError as exc:
         # Disk full, permissions, antivirus blocking writes... a clean 500
         # beats an unhandled exception crashing the request (Section 14).
-        logger.exception("could not store upload %r", file.filename)
+        logger.exception("could not store upload %r", filename)
         raise HTTPException(status_code=500, detail=f"Could not store upload: {exc}")
 
-    jobs.create_job(job_id, file.filename or "unknown.pdf", len(data), path)
-    pipeline.start_job(job_id, path)
+    jobs.create_job(
+        job_id, filename or f"unknown{ext}", len(data), path, format=category,
+        options=options,
+    )
+    pipeline.start_job(job_id, path, category, options=options)
     logger.info(
-        "job %s received: %s (%d bytes)", job_id, file.filename, len(data)
+        "job %s received: %s (%d bytes, %s)", job_id, filename, len(data), category
     )
 
     return PrintAccepted(
         job_id=job_id,
         status="queued",
-        filename=file.filename or "unknown.pdf",
+        filename=filename or f"unknown{ext}",
         size_bytes=len(data),
     )
diff --git a/app/api/web.py b/app/api/web.py
index 527d72d..20356b4 100644
--- a/app/api/web.py
+++ b/app/api/web.py
@@ -3,7 +3,9 @@
 
 The page is a single self-contained HTML string (inline CSS + vanilla JS —
 no build tools, no frameworks) served directly by FastAPI. The phone's
-browser IS the app: open http://<server-ip>:8000, pick a PDF, tap Print.
+browser IS the app: open http://<server-ip>:8000, pick a PDF or image, tap
+Print. The accept list mirrors the categories registered in
+app/processors — new formats update both.
 
 How the upload works (worth reading slowly — this is HTTP from the browser's
 point of view):
@@ -18,15 +20,44 @@
 """
 
 from fastapi import APIRouter
-from fastapi.responses import HTMLResponse
+from fastapi.responses import HTMLResponse, Response
 
 router = APIRouter()
 
+FAVICON_SVG = """<svg xmlns="http://www.w3.org/2000/svg"
+     viewBox="0 0 512 512" width="512" height="512"
+     role="img" aria-labelledby="ps-title ps-desc">
+  <title id="ps-title">PrinterService</title>
+  <desc id="ps-desc">A smartphone feeding into a printer printing a Wi-Fi page.</desc>
+  <g id="printerservice-mark" transform="translate(256 256) scale(1.15) translate(-256 -256)">
+    <rect id="body" x="112" y="197" width="288" height="174" rx="30" fill="#24272E"/>
+    <rect id="page" x="194" y="325" width="124" height="120" rx="10" fill="#FFD84D"
+          stroke="#1A1C20" stroke-width="9"/>
+    <rect id="output-slot" x="188" y="319" width="136" height="14" rx="7" fill="#FFFFFF"/>
+    <g id="wifi" fill="none" stroke="#00AEEF" stroke-width="8" stroke-linecap="round">
+      <path d="M 228.4 399.4 A 39 39 0 0 1 283.6 399.4"/>
+      <path d="M 236.9 407.9 A 27 27 0 0 1 275.1 407.9"/>
+      <path d="M 245.4 416.4 A 15 15 0 0 1 266.6 416.4"/>
+    </g>
+    <circle id="wifi-dot" cx="256" cy="427" r="6.5" fill="#00AEEF"/>
+    <rect id="input-slot" x="184" y="207" width="144" height="22" rx="11" fill="#FFFFFF"/>
+    <g id="phone">
+      <rect x="204" y="67" width="104" height="160" rx="26" fill="#E6007E"/>
+      <rect x="216" y="81" width="80" height="112" rx="13" fill="#FFFFFF"/>
+      <rect x="236" y="207" width="40" height="6" rx="3" fill="#FFFFFF"/>
+    </g>
+    <rect id="input-slot-lip" x="184" y="221" width="144" height="8" fill="#24272E"/>
+    <circle id="led" cx="350" cy="267" r="9" fill="#00AEEF"/>
+  </g>
+</svg>"""
+
 PAGE = """<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
+<link rel="icon" type="image/svg+xml" href="/favicon.svg">
+<link rel="alternate icon" type="image/svg+xml" href="/favicon.ico">
 <title>Printer Service</title>
 <style>
   body   { font-family: system-ui, sans-serif; background: #f0f4f8;
@@ -35,7 +66,9 @@
   .card  { background: #fff; border-radius: 12px; padding: 24px;
            margin: 16px; max-width: 380px; width: 100%;
            box-shadow: 0 2px 10px rgba(0,0,0,.12); }
-  h1     { font-size: 1.3rem; margin: 0 0 4px; }
+  .header{ display: flex; align-items: center; gap: 10px; margin-bottom: 4px; }
+  .header img { width: 32px; height: 32px; }
+  h1     { font-size: 1.3rem; margin: 0; }
   p.sub  { color: #667; margin: 0 0 18px; font-size: .9rem; }
   input[type=file] { width: 100%; margin-bottom: 14px; }
   input[type=password] { width: 100%; margin-bottom: 14px; padding: 8px;
@@ -48,35 +81,117 @@
            word-break: break-word; }
   .ok    { color: #166534; }
   .err   { color: #b91c1c; }
+  .opt   { display: block; text-align: left; font-size: .85rem;
+           color: #445; margin-bottom: 10px; }
+  .opt input, .opt select { width: 100%; margin-top: 4px; padding: 8px;
+           box-sizing: border-box; border: 1px solid #ccd;
+           border-radius: 6px; background: #fff; }
 </style>
 </head>
 <body>
 <div class="card">
-  <h1>🖨️ Printer Service</h1>
-  <p class="sub">Pick a PDF and send it to the printer.</p>
+  <div class="header">
+    <img src="/favicon.svg" alt="PrinterService Logo">
+    <h1>Printer Service</h1>
+  </div>
+  <p class="sub">Pick a PDF, image, Office, or text file and send it to the printer.</p>
 
-  <input type="file" id="file" accept=".pdf,application/pdf">
+  <input type="file" id="file"
+         accept=".pdf,.jpg,.jpeg,.png,.webp,.doc,.docx,.xls,.xlsx,.ppt,.pptx,.odt,.ods,.odp,.txt,.csv">
   <input type="password" id="pin" placeholder="PIN (only if the server set one)">
   <button id="printBtn" onclick="sendPrint()">Print</button>
   <div id="result"></div>
+  <button id="retryBtn" onclick="retryJob()"
+          style="display:none; margin-top:10px; background:#16a34a;">
+    🔁 Retry failed job
+  </button>
+
+  <details style="margin-top:14px;">
+    <summary style="cursor:pointer; font-size:.85rem; color:#667;">
+      Print options
+    </summary>
+    <label class="opt">Copies
+      <input type="number" id="copies" min="1" max="99" value="1">
+    </label>
+    <label class="opt">Pages
+      <input type="text" id="pages" placeholder="all — or 1-3,5 or odd/even">
+    </label>
+    <label class="opt">Paper
+      <select id="paper">
+        <option value="">Printer default</option>
+        <option value="a4">A4</option>
+        <option value="letter">Letter (short bond)</option>
+        <option value="long-bond">Long bond (8.5×13)</option>
+        <option value="legal">Legal</option>
+        <option value="a3">A3</option>
+        <option value="a5">A5</option>
+      </select>
+    </label>
+    <label class="opt">Color
+      <select id="colorMode">
+        <option value="color">Color</option>
+        <option value="monochrome">Black &amp; white</option>
+      </select>
+    </label>
+  </details>
 </div>
 
 <script>
 const btn = document.getElementById("printBtn");
 const resultDiv = document.getElementById("result");
+const retryBtn = document.getElementById("retryBtn");
+
+// Client-side convenience only — the server re-checks everything
+// (extension allowlist + magic bytes) and never trusts the browser.
+const OK_TYPES = [
+  ".pdf", ".jpg", ".jpeg", ".png", ".webp",
+  ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx",
+  ".odt", ".ods", ".odp",
+  ".txt", ".csv",
+];
+
+let failedJobId = null;
 
 function show(text, cls) {
   resultDiv.textContent = text;
   resultDiv.className = cls || "";
 }
 
+function retryControls(visible) {
+  retryBtn.style.display = visible ? "block" : "none";
+}
+
+// Re-print a failed job from its stored upload (p14) — no re-upload
+// needed. Resumes polling as if the job had just been queued.
+async function retryJob() {
+  if (!failedJobId) { return; }
+  const pin = document.getElementById("pin").value.trim();
+  const headers = pin ? { "X-API-PIN": pin } : {};
+  retryControls(false);
+  show("🔁 Retrying job " + failedJobId + "…", "ok");
+  try {
+    const response = await fetch("/jobs/" + failedJobId + "/retry",
+                                 { method: "POST", headers });
+    const data = await response.json();
+    if (response.ok) {
+      poll(failedJobId, 0);
+    } else {
+      show("❌ Retry refused: " + (data.detail || response.status), "err");
+    }
+  } catch (networkError) {
+    show("❌ Could not reach the server. Are you on the same Wi-Fi?",
+         "err");
+  }
+}
+
 async function sendPrint() {
   const fileInput = document.getElementById("file");
   const file = fileInput.files[0];
 
-  if (!file) { show("Pick a PDF first.", "err"); return; }
-  if (!file.name.toLowerCase().endsWith(".pdf")) {
-    show("That doesn't look like a PDF file.", "err");
+  if (!file) { show("Pick a file first.", "err"); return; }
+  if (!OK_TYPES.some(ext => file.name.toLowerCase().endsWith(ext))) {
+    show("That file type isn't supported yet — PDF, images, Office "
+         + "documents, or TXT/CSV.", "err");
     return;
   }
 
@@ -90,6 +205,12 @@
     const body = new FormData();
     body.append("file", file);            // field name must be "file"
 
+    // Print options (Phase 7) — all optional; empty fields mean defaults.
+    body.append("copies", document.getElementById("copies").value || "1");
+    body.append("pages", document.getElementById("pages").value.trim());
+    body.append("paper", document.getElementById("paper").value);
+    body.append("color_mode", document.getElementById("colorMode").value);
+
     // Send the PIN header only if the user typed one; the server ignores
     // it entirely when no PIN is configured (auth disabled).
     const pin = document.getElementById("pin").value.trim();
@@ -136,15 +257,20 @@
     }
     const job = await response.json();
     if (job.status === "done") {
+      retryControls(false);
       show("🖨️ Printed to " + (job.printer || "printer") + "!\\njob " + jobId,
            "ok");
       return;
     }
     if (job.status === "failed") {
-      show("❌ Print failed: " + (job.error || "unknown reason"), "err");
+      failedJobId = jobId;
+      retryControls(true);
+      show("❌ Print failed: " + (job.error || "unknown reason") +
+           "\\nYou can retry it from the stored copy.", "err");
       return;
     }
     if (job.status === "cancelled") {
+      retryControls(false);
       show("Job " + jobId + " was cancelled.", "err");
       return;
     }
@@ -164,3 +290,11 @@
 def index():
     """Serve the upload page. Opening the server's URL on the phone IS the app."""
     return PAGE
+
+
+@router.get("/favicon.svg", include_in_schema=False)
+@router.get("/favicon.ico", include_in_schema=False)
+def favicon():
+    """Serve the SVG icon for browser tabs."""
+    return Response(content=FAVICON_SVG, media_type="image/svg+xml")
+
diff --git a/app/config.py b/app/config.py
index ac82e65..452531c 100644
--- a/app/config.py
+++ b/app/config.py
@@ -52,4 +52,37 @@ def _get(name: str, default: str) -> str:
 
 # Every real PDF starts with these 5 bytes — the "magic bytes" check that
 # catches renamed/fake files that a mere ".pdf" extension check would miss.
+# Consumed by app/detection.py, which generalizes the idea to every format.
 PDF_MAGIC = b"%PDF-"
+
+# ------------------------------------------------------------------
+# Multi-format printing settings (docs/MULTI_FORMAT_PLAN.md).
+# Phase 1 only wires the config; each value becomes load-bearing in the
+# phase that needs it (images p11, office p12, print options v2).
+# ------------------------------------------------------------------
+
+# Paper size sent to the driver via SumatraPDF's -print-settings
+# ("paper=<X>,fit"). Empty (default) = no print-settings flag at all — the
+# driver chooses the paper, which is the exact behavior spike T4 proved on
+# real paper. Opt in (e.g. A4) only after spike T5 confirmed this driver
+# honors the flag. Images are also laid out on this size (A4 when empty).
+PAPER_SIZE = _get("PAPER_SIZE", "")
+
+# Office conversion (Phase 3): LibreOffice Headless. ENABLE_OFFICE is the
+# kill switch for the old PC — 0 turns office formats off without
+# uninstalling anything; they are additionally refused while LibreOffice
+# is not installed.
+ENABLE_OFFICE = _get("ENABLE_OFFICE", "1").strip().lower() not in ("0", "false", "no")
+
+# Explicit path to soffice.exe. Empty = use the standard install location.
+LO_PATH = _get("LO_PATH", "")
+
+# Seconds a file conversion may run before the service kills it (enforced
+# by the office processor's subprocess handling; images/text finish in well
+# under a second).
+CONVERT_TIMEOUT_S = int(_get("CONVERT_TIMEOUT_S", "120"))
+
+# Job history database (Phase 5): SQLite, SOURCE_OF_TRUTH §12's upgrade
+# path. Default lives under logs/ (git-ignored). Delete the file to reset
+# job history.
+JOB_DB_PATH = _get("JOB_DB_PATH", str(BASE_DIR / "logs" / "jobs.sqlite3"))
diff --git a/app/detection.py b/app/detection.py
new file mode 100644
index 0000000..43e4d98
--- /dev/null
+++ b/app/detection.py
@@ -0,0 +1,117 @@
+"""Format detection — "what kind of file is this, really?" (multi-format
+plan, docs/MULTI_FORMAT_PLAN.md Section 3).
+
+Detection is deliberately separate from "what can we print": the printable
+gate lives in app/processors (a category becomes printable only once a
+processor is registered for it). Phase 1 registers only "pdf"; image,
+office and text arrive in Phases 2–4 without touching this module again.
+
+Rules, cheapest first (SOURCE_OF_TRUTH Section 8):
+
+1. The extension is only a HINT — extensions lie, so nothing is accepted
+   on the extension alone.
+2. Every supported binary format has a fixed magic signature; the
+   signature wins whenever it disagrees with the extension.
+3. ZIP and OLE containers hold several formats (DOCX/XLSX/PPTX/ODF all
+   start with PK), so the container is opened and its entry names are
+   sniffed to confirm it really is an office document.
+4. Plain text (.txt/.csv) has no magic bytes: it is classified by
+   extension, and its decodability is verified later by its processor
+   (Phase 4).
+
+This module knows nothing about HTTP — uploads.py maps classification
+failures to 415 responses.
+"""
+
+import zipfile
+from io import BytesIO
+from pathlib import Path
+
+from app.config import PDF_MAGIC
+
+JPEG_MAGIC = b"\xff\xd8\xff"
+PNG_MAGIC = b"\x89PNG\r\n\x1a\n"
+WEBP_MAGIC = b"RIFF"  # a RIFF container; b"WEBP" must follow at offset 8
+OLE_MAGIC = b"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1"  # legacy DOC/XLS/PPT
+ZIP_MAGIC = b"PK\x03\x04"  # OOXML (DOCX/XLSX/PPTX) and ODF containers
+
+# Categories whose files MUST carry their magic signature. Text is the
+# exception: bytes that are "just text" are indistinguishable from any
+# other content, so .txt/.csv are trusted at upload time and verified
+# (decodable, sane) by their processor.
+MAGIC_REQUIRED = frozenset({"pdf", "image", "office"})
+
+# Macro-enabled Office formats are rejected outright, before any other
+# check runs (plan Section 9). LibreOffice headless would not execute
+# their macros, but rejecting is cheaper and safer than relying on that.
+MACRO_EXTENSIONS = frozenset(
+    {".docm", ".dotm", ".xlsm", ".xltm", ".pptm", ".potm"}
+)
+
+EXTENSION_CATEGORIES: dict[str, str] = {
+    ".pdf": "pdf",
+    ".jpg": "image",
+    ".jpeg": "image",
+    ".png": "image",
+    ".webp": "image",
+    ".bmp": "image",
+    ".gif": "image",
+    ".tif": "image",
+    ".tiff": "image",
+    ".doc": "office",
+    ".docx": "office",
+    ".xls": "office",
+    ".xlsx": "office",
+    ".ppt": "office",
+    ".pptx": "office",
+    ".odt": "office",
+    ".ods": "office",
+    ".odp": "office",
+    ".txt": "text",
+    ".csv": "text",
+}
+
+# Extension to store a file under when the client sent no usable filename
+# (its category was proven by magic bytes instead).
+DEFAULT_EXTENSIONS = {
+    "pdf": ".pdf",
+    "image": ".jpg",
+    "office": ".docx",
+    "text": ".txt",
+}
+
+
+def category_for(filename: str) -> str | None:
+    """The category an extension claims, or None for unknown/absent names."""
+    ext = Path(filename).suffix.lower() if filename else ""
+    return EXTENSION_CATEGORIES.get(ext)
+
+
+def magic_category(data: bytes) -> str | None:
+    """The category the CONTENT claims, or None if no signature matches."""
+    if data.startswith(PDF_MAGIC):
+        return "pdf"
+    if data.startswith(JPEG_MAGIC) or data.startswith(PNG_MAGIC):
+        return "image"
+    if data.startswith(WEBP_MAGIC) and data[8:12] == b"WEBP":
+        return "image"
+    if data.startswith(OLE_MAGIC):
+        return "office"
+    if data.startswith(ZIP_MAGIC) and _is_office_zip(data):
+        return "office"
+    return None
+
+
+def _is_office_zip(data: bytes) -> bool:
+    """Tell printable office containers from ordinary zip files.
+
+    OOXML parts live under word/ (DOCX), xl/ (XLSX) or ppt/ (PPTX); ODF
+    files carry a "mimetype" entry. Anything else is a zip we don't print.
+    """
+    try:
+        names = zipfile.ZipFile(BytesIO(data)).namelist()
+    except (zipfile.BadZipFile, OSError):
+        return False
+    return any(name.startswith(("word/", "xl/", "ppt/")) for name in names) or (
+        "mimetype" in names
+    )
diff --git a/app/main.py b/app/main.py
index 5cd5fa0..2f6f751 100644
--- a/app/main.py
+++ b/app/main.py
@@ -34,6 +34,7 @@
 from app.api.print import router as print_router
 from app.api.printers import router as printers_router
 from app.api.web import router as web_router
+from app.services import jobs
 from app.services.logging_setup import setup_logging
 from app.services.uploads import sweep_stale_uploads
 
@@ -44,14 +45,22 @@ async def lifespan(app: FastAPI):
 
     Startup: configure logging, then sweep uploads/ of files left behind by
     a previous run — the temp-file hygiene SOURCE_OF_TRUTH Section 8 asks
-    for. (Phase 5 also deletes each file right after it's printed; the sweep
-    is the safety net for crashes.)
+    for. (Each finished job also deletes its own files right after
+    printing; the sweep is the safety net for crashes.) Then mark jobs left
+    in active states by that previous run as failed — their uploads are
+    gone, so they can't be retried (p14 startup recovery).
     """
     setup_logging()
 
     removed = sweep_stale_uploads()
     if removed:
         print(f"[startup] swept {removed} stale upload(s) from a previous run")
+    recovered = jobs.recover_interrupted()
+    if recovered:
+        print(
+            f"[startup] marked {recovered} interrupted job(s) as failed "
+            "(service restarted mid-print)"
+        )
     yield
     # Shutdown: nothing to clean yet.
 
diff --git a/app/models/printing.py b/app/models/printing.py
index 2d05b89..7e9e37b 100644
--- a/app/models/printing.py
+++ b/app/models/printing.py
@@ -1,5 +1,6 @@
 """Pydantic models: the shape of the API's requests/responses (SOURCE_OF_TRUTH Section 11)."""
 
+import re
 from datetime import datetime
 
 from pydantic import BaseModel
@@ -37,20 +38,90 @@ class PrintJob(BaseModel):
     updated_at: datetime
     printer: str | None = None  # set in Phase 5 when actually submitted
     error: str | None = None
+    format: str | None = None  # detected category ("pdf" today; image/office/text as phases land)
+    options: dict | None = None  # Phase 7 print options (copies/pages/paper/color_mode)
 
 
 class JobStatus:
     """The lifecycle of a job. String constants keep the JSON simple.
 
-    received → queued → printing → done
+    received → queued → converting → printing → done
                      ↘ failed
     received (or queued, once P5 submits to Windows) → cancelled
+
+    `converting` (p10) covers format conversion — a no-op for PDFs, but the
+    visible step that explains why an office document takes tens of seconds.
     """
 
     RECEIVED = "received"
     QUEUED = "queued"
+    CONVERTING = "converting"
     PRINTING = "printing"
     DONE = "done"
     FAILED = "failed"
     CANCELLED = "cancelled"
 
+
+# ---------------------------------------------------------------------------
+# Print options (Phase 7 / v2) — per-request copies, page range, paper and
+# color mode. One set of options works for EVERY format because processors
+# normalize everything to PDF before the engine sees it.
+# ---------------------------------------------------------------------------
+
+# Paper keys shared by validation (here), page layout (processors/base
+# PAGE_SIZES_PT) and the Sumatra tokens (printer/windows PAPER_TOKENS).
+# "" = printer default. "long-bond" is 8.5×13" — bond-paper sizing.
+PAPER_CHOICES = ("", "a4", "letter", "legal", "a3", "a5", "long-bond")
+COLOR_MODES = ("color", "monochrome")
+
+# Page selection allowlist: "odd"/"even", or a comma list of single pages
+# and ranges ("5", "2-6", "1-3,5,8-10"). This is a STRICT allowlist — the
+# string goes into a command line, so anything not matching is refused
+# before it gets there. SumatraPDF understands reversed ranges (10-8), so
+# start>end is allowed on purpose.
+PAGES_PATTERN = re.compile(r"^(odd|even)$|^\d{1,3}(-\d{1,3})?(,\d{1,3}(-\d{1,3})?)*$")
+
+
+class PrintOptions(BaseModel):
+    """Validated print options attached to a job (stored with it, reused
+    by retry)."""
+
+    copies: int = 1
+    pages: str = ""  # "" = the whole document
+    paper: str = ""  # "" = config PAPER_SIZE, else the printer's default
+    color_mode: str = "color"
+
+
+def validate_print_options(
+    copies: int, pages: str, paper: str, color_mode: str
+) -> PrintOptions:
+    """Validate raw form input and return normalized PrintOptions.
+
+    Raises ValueError with a phone-user-readable message — the API layer
+    maps that to HTTP 422.
+    """
+    if not 1 <= copies <= 99:
+        raise ValueError("Copies must be between 1 and 99.")
+
+    pages = (pages or "").strip()
+    if len(pages) > 100:
+        raise ValueError("The page selection is too long.")
+    if pages and not PAGES_PATTERN.match(pages):
+        raise ValueError(
+            "Pages must look like '2-6', '1,3,5', '1-3,5' — or 'odd'/'even'."
+        )
+
+    paper = (paper or "").strip().lower()
+    if paper not in PAPER_CHOICES:
+        raise ValueError(
+            f"Paper must be one of: {', '.join(c or 'printer default' for c in PAPER_CHOICES)}."
+        )
+
+    color_mode = (color_mode or "color").strip().lower()
+    if color_mode not in COLOR_MODES:
+        raise ValueError("Color mode must be 'color' or 'monochrome'.")
+
+    return PrintOptions(
+        copies=copies, pages=pages, paper=paper, color_mode=color_mode
+    )
+
diff --git a/app/printer/windows.py b/app/printer/windows.py
index fb420ed..0792ab4 100644
--- a/app/printer/windows.py
+++ b/app/printer/windows.py
@@ -29,8 +29,8 @@
 import subprocess
 from pathlib import Path
 
-from app.config import PRINTER_NAME, SUMATRA_PATH
-from app.models.printing import PrinterInfo
+from app.config import PAPER_SIZE, PRINTER_NAME, SUMATRA_PATH
+from app.models.printing import PrinterInfo, PrintOptions
 
 logger = logging.getLogger(__name__)
 
@@ -75,7 +75,157 @@ def find_sumatra() -> str | None:
     return None
 
 
-def submit_pdf(pdf_path: Path, printer_name: str | None = None) -> tuple[str, str]:
+# SumatraPDF's documented exit codes (official CLI docs) → what the phone
+# user sees. Codes not listed fall back to the raw stderr text.
+SUMATRA_EXIT_MESSAGES = {
+    2: "The PDF could not be opened — it may be corrupt or password-protected.",
+    3: "The document does not allow printing.",
+    4: "The printer was not found — check the printer name and connection.",
+    5: "The printer driver reported a failure — check paper, ink and USB.",
+    6: "Printing was blocked by a restriction policy.",
+}
+
+# Printer status flags (win32print constants, with hex fallbacks so a
+# missing constant on some pywin32 build can't break the check) and the
+# messages they produce. PRINTER_ATTRIBUTE_WORK_OFFLINE is what Windows
+# sets when a USB printer is powered off — the most common real case.
+_NOT_READY_FLAGS = {
+    0x00000080: "offline",          # PRINTER_STATUS_OFFLINE
+    0x00001000: "not available",    # PRINTER_STATUS_NOT_AVAILABLE
+    0x00000010: "out of paper",     # PRINTER_STATUS_PAPER_OUT
+    0x00000008: "out of paper (jam)",  # PRINTER_STATUS_PAPER_JAM
+    0x00400000: "reporting its door open",  # PRINTER_STATUS_DOOR_OPEN
+    0x00000002: "in an error state",  # PRINTER_STATUS_ERROR
+}
+_ATTRIBUTE_WORK_OFFLINE = 0x00000400
+
+
+def printer_ready(printer_name: str) -> tuple[bool, str]:
+    """Best-effort pre-dispatch check (p15): is the printer usable?
+
+    Returns (True, "") when the spooler reports the printer as fine — or
+    when the check itself can't be performed (never block printing on a
+    query hiccup). Returns (False, reason) for definitive not-ready
+    states; catching them BEFORE SumatraPDF runs turns a generic driver
+    exit code into a message the phone user can act on.
+    """
+    import win32print
+
+    try:
+        handle = win32print.OpenPrinter(printer_name)
+        try:
+            info = win32print.GetPrinter(handle, 2)
+            status = int(info["Status"])
+            attributes = int(info["Attributes"])
+        finally:
+            win32print.ClosePrinter(handle)
+    except Exception:
+        logger.warning(
+            "printer readiness check failed for %r — dispatching anyway",
+            printer_name,
+            exc_info=True,
+        )
+        return True, ""
+
+    if attributes & _ATTRIBUTE_WORK_OFFLINE:
+        return False, (
+            "The printer is offline (Windows has 'Use Printer Offline' set)."
+        )
+    for flag, label in _NOT_READY_FLAGS.items():
+        if status & flag:
+            return False, f"The printer is {label}."
+    return True, ""
+
+
+# Phase 7: per-request paper keys → Sumatra's -print-settings tokens.
+# Keys mirror models.printing.PAPER_CHOICES; "long-bond" is 8.5×13" —
+# Sumatra takes custom sizes in mm (one spike line still owes a real-paper
+# check of this size: MULTI_FORMAT_PLAN §15).
+PAPER_TOKENS = {
+    "a4": "paper=A4",
+    "a3": "paper=A3",
+    "a5": "paper=A5",
+    "letter": "paper=letter",
+    "legal": "paper=legal",
+    "long-bond": "paper=215.9mm x 330.2mm",
+}
+
+
+def build_print_settings(options: PrintOptions | None) -> str | None:
+    """The -print-settings value for these options — None when nothing is
+    requested, which keeps the no-options command byte-identical to the
+    T4-proven one.
+
+    Precedence: the request's paper beats the PAPER_SIZE config; "fit"
+    rides along only when a paper size is named (it prevents clipping when
+    page and paper disagree) — copies/pages/monochrome alone must not
+    rescale a document that would have printed 1:1.
+    """
+    options = options or PrintOptions()
+    tokens: list[str] = []
+
+    paper = (options.paper or PAPER_SIZE).strip().lower()
+    if paper:
+        tokens.append(PAPER_TOKENS.get(paper, f"paper={paper}"))
+        tokens.append("fit")
+    if options.copies > 1:
+        tokens.append(f"{options.copies}x")
+        tokens.append("collate")
+    if options.pages:
+        tokens.append(options.pages)
+    if options.color_mode == "monochrome":
+        tokens.append("monochrome")
+
+    return ",".join(tokens) if tokens else None
+
+
+def resolve_printer_name() -> str:
+    """The printer jobs are submitted to: PRINTER_NAME config, else the
+    Windows default. Used by submit_pdf and the cancel endpoint's spooler
+    purge."""
+    return PRINTER_NAME or get_default_printer()
+
+
+def cancel_spooler_jobs(printer_name: str, job_id: str) -> int:
+    """Best-effort removal of OUR queued jobs from the Windows spooler.
+
+    SumatraPDF names the spooler document after the file it prints, and
+    the service names that file <job_id>.pdf — so matching the document
+    name against job_id finds our jobs without tracking Windows job ids.
+    Best-effort per job: paper that already reached the printer cannot be
+    recalled. Returns how many spooler jobs were removed.
+    """
+    import win32print
+
+    handle = win32print.OpenPrinter(printer_name)
+    try:
+        removed = 0
+        for job in win32print.EnumJobs(handle, 0, -1, 1):
+            document = job.get("pDocument") or ""
+            if document.startswith(job_id):
+                try:
+                    win32print.SetJob(
+                        handle,
+                        job["JobId"],
+                        0,
+                        None,
+                        win32print.JOB_CONTROL_DELETE,
+                    )
+                    removed += 1
+                except Exception:
+                    logger.warning(
+                        "could not purge spooler job %s", job.get("JobId")
+                    )
+        return removed
+    finally:
+        win32print.ClosePrinter(handle)
+
+
+def submit_pdf(
+    pdf_path: Path,
+    printer_name: str | None = None,
+    options: PrintOptions | None = None,
+) -> tuple[str, str]:
     """Print a PDF file. Returns (method_used, printer_name).
 
     Raises RuntimeError with a human-readable reason on any failure — the
@@ -84,20 +234,38 @@ def submit_pdf(pdf_path: Path, printer_name: str | None = None) -> tuple[str, st
     import win32print  # noqa: F401 — fail fast if pywin32 is missing
 
     if printer_name is None:
-        printer_name = PRINTER_NAME or get_default_printer()
+        printer_name = resolve_printer_name()
+
+    ready, not_ready_reason = printer_ready(printer_name)
+    if not ready:
+        # Fail BEFORE handing the job to SumatraPDF — a known-offline
+        # printer would otherwise surface as a generic driver exit code.
+        raise RuntimeError(not_ready_reason)
 
     sumatra = find_sumatra()
     if sumatra:
         logger.info("printing %s via SumatraPDF to %r", pdf_path.name, printer_name)
+        cmd = [sumatra, "-print-to", printer_name]
+        settings = build_print_settings(options)
+        if settings:
+            # Phase 7 print options (copies, pages, paper, color) and/or
+            # the PAPER_SIZE config. Empty = no print settings at all —
+            # the driver chooses, which is the exact behavior spike T4
+            # proved on real paper.
+            cmd += ["-print-settings", settings]
+        cmd += ["-silent", str(pdf_path)]
         result = subprocess.run(
-            [sumatra, "-print-to", printer_name, "-silent", str(pdf_path)],
+            cmd,
             capture_output=True,
             timeout=180,
         )
         if result.returncode != 0:
+            reason = SUMATRA_EXIT_MESSAGES.get(
+                result.returncode, "Unknown printing failure."
+            )
             raise RuntimeError(
-                f"SumatraPDF failed (exit {result.returncode}): "
-                f"{result.stderr.decode(errors='replace').strip()}"
+                f"SumatraPDF failed (exit {result.returncode}): {reason} "
+                f"{result.stderr.decode(errors='replace').strip()}".rstrip()
             )
         return "sumatrapdf", printer_name
 
diff --git a/app/processors/__init__.py b/app/processors/__init__.py
new file mode 100644
index 0000000..724911f
--- /dev/null
+++ b/app/processors/__init__.py
@@ -0,0 +1,42 @@
+"""The processor registry: category → the processor that converts it to PDF.
+
+Registering a processor here is the ONLY code change needed to enable a
+format category (its magic signatures already live in app/detection.py).
+A category without a registration is detected but refused at upload time;
+a REGISTERED processor can still be per-machine unavailable (the office
+kill switch, LibreOffice missing) — that's what Processor.available() is
+for (docs/MULTI_FORMAT_PLAN.md §10). All four MVP categories are
+registered as of Phase 4.
+"""
+
+from app.processors.base import ConversionError, Processor
+from app.processors.images import IMAGE_PROCESSOR
+from app.processors.office import OFFICE_PROCESSOR
+from app.processors.pdf import PDF_PROCESSOR
+from app.processors.text import TEXT_PROCESSOR
+
+__all__ = [
+    "ConversionError",
+    "Processor",
+    "for_category",
+    "supported_categories",
+]
+
+_REGISTRY: dict[str, Processor] = {
+    "image": IMAGE_PROCESSOR,
+    "office": OFFICE_PROCESSOR,
+    "pdf": PDF_PROCESSOR,
+    "text": TEXT_PROCESSOR,
+}
+
+
+def for_category(category: str) -> Processor | None:
+    """The processor for a category, or None while that format is
+    unregistered ("not enabled yet" — the upload gate and the pipeline
+    both treat None as "cannot convert")."""
+    return _REGISTRY.get(category)
+
+
+def supported_categories() -> tuple[str, ...]:
+    """Categories that can currently be printed (sorted for stable display)."""
+    return tuple(sorted(_REGISTRY))
diff --git a/app/processors/base.py b/app/processors/base.py
new file mode 100644
index 0000000..2f02570
--- /dev/null
+++ b/app/processors/base.py
@@ -0,0 +1,75 @@
+"""The Processor contract (multi-format plan, docs/MULTI_FORMAT_PLAN.md §3).
+
+A processor turns ONE category of uploaded file into the service's single
+internal print format: a PDF. Everything downstream of the processors —
+the pipeline, `submit_pdf()`, SumatraPDF, the Windows queue — only ever
+sees a PDF, which is exactly what spike T4 proved prints reliably on the
+L3210.
+
+This is the seam that keeps the print engine format-agnostic forever:
+adding a format means writing one processor and registering it in
+app/processors/__init__.py — the pipeline never changes.
+"""
+
+from pathlib import Path
+from typing import Protocol
+
+from app.config import PAPER_SIZE
+
+# Shared page geometry (points; 1 pt = 1/72"). Processors that AUTHOR pages
+# (images, text) lay their content out on this size; unknown/empty
+# PAPER_SIZE falls back to A4. Add entries (e.g. long bond 8.5x13) as later
+# phases need them.
+PAGE_SIZES_PT = {
+    "a3": (842, 1191),
+    "a4": (595, 842),
+    "a5": (420, 595),
+    "letter": (612, 792),
+    "legal": (612, 1008),
+    "long-bond": (612, 936),  # 8.5×13" — bond-paper sizing (Phase 7)
+}
+DEFAULT_PAGE = "a4"
+
+
+def page_size_pt() -> tuple[int, int]:
+    """The page authored content sits on: PAPER_SIZE when it names a known
+    size, A4 otherwise (a page must be concrete before anything fits on it)."""
+    return PAGE_SIZES_PT.get(PAPER_SIZE.strip().lower(), PAGE_SIZES_PT[DEFAULT_PAGE])
+
+
+class ConversionError(Exception):
+    """Raised with a human-readable reason when a file cannot be converted.
+
+    The pipeline records the message as the job's error — write for the
+    person holding the phone ("LibreOffice could not open the file: ..."),
+    not for a log analyst.
+    """
+
+
+class Processor(Protocol):
+    """One format category's conversion step.
+
+    Implementations must be safe to run on the pipeline's background
+    thread, must not modify `src`, and must return a path to a valid PDF.
+    Long-running converters (LibreOffice, Phase 3) are subprocess calls
+    with their own timeout + process-tree kill.
+    """
+
+    def available(self) -> bool:
+        """Whether this processor can run on THIS machine right now.
+
+        A processor can be registered but still disabled (the office kill
+        switch) or missing its external tool (LibreOffice not installed).
+        The upload gate checks this so users get an actionable message —
+        "install LibreOffice / flip ENABLE_OFFICE" — instead of a job that
+        dies later with a subprocess error.
+        """
+        ...
+
+    def process(self, src: Path, out_dir: Path) -> Path:
+        """Convert `src` into a print-ready PDF and return that PDF's path.
+
+        `out_dir` is the directory to write the converted file into
+        (uploads/, next to the original) so cleanup stays one glob away.
+        """
+        ...
diff --git a/app/processors/images.py b/app/processors/images.py
new file mode 100644
index 0000000..e988f45
--- /dev/null
+++ b/app/processors/images.py
@@ -0,0 +1,143 @@
+"""Image processor (Phase 2) — turns images into print-ready PDF pages.
+
+Strategy (docs/MULTI_FORMAT_PLAN.md §6): Pillow composites the picture onto
+a white page canvas and saves the canvas as the PDF — one code path for
+every input quirk:
+
+    load → EXIF-rotate → flatten transparency onto white →
+    fit + center on the page (wide photos rotate the PAGE, not the pixels)
+    → cap the effective DPI → save (multi-frame files become multi-page PDFs)
+
+Why a canvas instead of Pillow's bare img.save(..., "PDF"): the canvas
+pins the PAGE size (A4 by default) no matter the photo's pixel size,
+centers the picture with real margins, and caps the effective DPI — a
+12 MP phone photo must not become a 100 MB PDF, and a 200 px thumbnail
+must not be blown up into a full page of blur.
+
+Quality decisions recorded in MULTI_FORMAT_PLAN.md §6 (images row + §7):
+EXIF orientation is honored, transparency prints white (unflattened alpha
+prints black on paper), a wide photo gets a landscape page instead of
+rotated pixels (rotation would fight EXIF and resample the image twice).
+"""
+
+import logging
+from pathlib import Path
+
+from PIL import Image, ImageOps, ImageSequence
+
+from app.processors.base import ConversionError, page_size_pt
+
+logger = logging.getLogger(__name__)
+
+MARGIN_PT = 36    # 0.5" — this printer cannot print borderless anyway
+MAX_DPI = 300     # above ~300 effective DPI, extra pixels are invisible on paper
+SOURCE_DPI = 96   # small images are assumed ~96 DPI (the web/phone norm)...
+MAX_UPSCALE = MAX_DPI / SOURCE_DPI  # ...so upscaling stops at 300 effective DPI
+MAX_FRAMES = 10   # an animated WebP/scan-batch TIFF is not a 50-page print job
+
+
+def layout(
+    img_w: int, img_h: int, page_pt: tuple[int, int]
+) -> tuple[tuple[int, int], tuple[int, int, int, int]]:
+    """Fit an image on a page; return ((canvas_w, canvas_h), (x, y, w, h)).
+
+    Pure geometry — all values in CANVAS pixels, and the canvas renders at
+    MAX_DPI (so a page of `page_pt` points becomes page_pt * MAX_DPI/72
+    pixels). Rules:
+
+    - a wide image on a portrait page rotates the PAGE, not the pixels;
+    - the image never leaves the printable area (page minus margins);
+    - upscaling is capped at MAX_UPSCALE: a small image prints near its
+      natural size, centered, instead of stretched full-page blurry.
+    """
+    page_w, page_h = page_pt
+    if img_w > img_h and page_w < page_h:
+        page_w, page_h = page_h, page_w
+
+    points_to_px = MAX_DPI / 72
+    canvas_w, canvas_h = round(page_w * points_to_px), round(page_h * points_to_px)
+    margin_px = round(MARGIN_PT * points_to_px)
+    avail_w, avail_h = canvas_w - 2 * margin_px, canvas_h - 2 * margin_px
+
+    scale = min(avail_w / img_w, avail_h / img_h, MAX_UPSCALE)
+    box_w, box_h = max(1, round(img_w * scale)), max(1, round(img_h * scale))
+    x, y = (canvas_w - box_w) // 2, (canvas_h - box_h) // 2
+    return (canvas_w, canvas_h), (x, y, box_w, box_h)
+
+
+def _printable(img: Image.Image) -> Image.Image:
+    """EXIF-rotate, then flatten anything with transparency onto white.
+
+    Returns a plain RGB image — the only mode worth encoding into a PDF
+    page for this printer.
+    """
+    img = ImageOps.exif_transpose(img)
+    if img.mode != "RGB":
+        if "A" in img.getbands() or img.mode == "P":
+            rgba = img.convert("RGBA")
+            flat = Image.new("RGB", rgba.size, "white")
+            flat.paste(rgba, mask=rgba.getchannel("A"))
+            return flat
+        return img.convert("RGB")
+    return img
+
+
+def _page_canvas(img: Image.Image) -> Image.Image:
+    """One print-ready page: the image fitted and centered on white."""
+    (canvas_w, canvas_h), (x, y, box_w, box_h) = layout(
+        img.width, img.height, page_size_pt()
+    )
+    canvas = Image.new("RGB", (canvas_w, canvas_h), "white")
+    canvas.paste(img.resize((box_w, box_h), Image.Resampling.LANCZOS), (x, y))
+    return canvas
+
+
+class ImageProcessor:
+    def available(self) -> bool:
+        # Pillow is a hard dependency (requirements.txt) — always available.
+        return True
+
+    def process(self, src: Path, out_dir: Path) -> Path:
+        """Convert an image file into the print-ready PDF the engine gets."""
+        pdf_path = out_dir / f"{src.stem}.pdf"
+        try:
+            frames: list[Image.Image] = []
+            with Image.open(src) as img:
+                for frame in ImageSequence.Iterator(img):
+                    frames.append(_page_canvas(_printable(frame)))
+                    if len(frames) > MAX_FRAMES:
+                        raise ConversionError(
+                            f"The image has more than {MAX_FRAMES} frames; the "
+                            f"service prints at most {MAX_FRAMES} pages from one "
+                            "image file. Split it or export single pages."
+                        )
+            if not frames:
+                raise ConversionError("The image contains no frames to print.")
+        except ConversionError:
+            raise
+        except Exception as exc:
+            raise ConversionError(
+                f"Could not read the image — it looks corrupt or is an "
+                f"unsupported image format ({exc})"
+            ) from exc
+
+        try:
+            first, *rest = frames
+            first.save(
+                pdf_path,
+                "PDF",
+                resolution=MAX_DPI,
+                save_all=bool(rest),
+                append_images=rest,
+            )
+        except OSError as exc:
+            raise ConversionError(f"Could not write the print file: {exc}") from exc
+
+        logger.info(
+            "converted %s -> %s (%d page(s))", src.name, pdf_path.name, len(frames)
+        )
+        return pdf_path
+
+
+# Stateless → one shared instance for every job.
+IMAGE_PROCESSOR = ImageProcessor()
diff --git a/app/processors/office.py b/app/processors/office.py
new file mode 100644
index 0000000..7812e18
--- /dev/null
+++ b/app/processors/office.py
@@ -0,0 +1,160 @@
+"""Office processor (Phase 3) — DOCX/XLSX/PPTX (and legacy/ODF) via
+LibreOffice Headless.
+
+LibreOffice converts each document to the service's one print format (a
+PDF) in a subprocess; the conversion runs inside the pipeline's conversion
+lock, so at most ONE LibreOffice instance exists at a time — the old-PC
+guard (≤4 GB RAM, MULTI_FORMAT_PLAN.md §6 load profile).
+
+Invocation (security notes in MULTI_FORMAT_PLAN.md §9):
+
+    soffice --headless --norestore --nolockcheck
+            -env:UserInstallation=<fresh throwaway profile>
+            --convert-to pdf --outdir <out_dir> <src>
+
+- headless: no GUI, no desktop needed; it does not execute document macros.
+- a FRESH throwaway user profile per conversion: a crashed earlier run can
+  never poison the next one (stale locks), and someone running LibreOffice's
+  GUI on the default profile can never clash with us. Costs ~1s of profile
+  warmup per document — worth the robustness on a home server.
+- CONVERT_TIMEOUT_S bounds the whole conversion; on timeout the whole
+  process TREE is killed (soffice spawns soffice.bin children).
+
+Quality expectations (MULTI_FORMAT_PLAN.md §7): layout fidelity is
+LibreOffice's, so fonts installed on THIS server matter (missing fonts get
+substituted and line breaks shift); an XLSX saved without a print area
+paginates all columns. spike_t6_office.py verifies on real paper — it is
+this phase's acceptance gate.
+"""
+
+import logging
+import os
+import shutil
+import subprocess
+import tempfile
+import time
+from pathlib import Path
+
+from app.config import CONVERT_TIMEOUT_S, ENABLE_OFFICE, LO_PATH
+from app.processors.base import ConversionError
+
+logger = logging.getLogger(__name__)
+
+SOFFICE_CANDIDATES = [
+    r"C:\Program Files\LibreOffice\program\soffice.exe",
+    r"C:\Program Files (x86)\LibreOffice\program\soffice.exe",
+]
+
+
+def find_soffice() -> str | None:
+    """Locate soffice.exe. An explicitly configured LO_PATH is authoritative:
+    if it's set but missing, we report it missing rather than silently
+    falling back (misconfigurations should be loud) — the same rule as
+    SUMATRA_PATH."""
+    if LO_PATH:
+        return LO_PATH if Path(LO_PATH).is_file() else None
+    found = shutil.which("soffice") or shutil.which("soffice.exe")
+    if found:
+        return found
+    for candidate in SOFFICE_CANDIDATES:
+        if Path(candidate).is_file():
+            return candidate
+    return None
+
+
+class OfficeProcessor:
+    """Converts office documents to PDF. Depends on an external LibreOffice
+    install — the service's only heavyweight dependency, gated behind
+    ENABLE_OFFICE so it can be switched off without uninstalling."""
+
+    def available(self) -> bool:
+        return ENABLE_OFFICE and find_soffice() is not None
+
+    def process(self, src: Path, out_dir: Path) -> Path:
+        soffice = find_soffice()
+        if soffice is None:
+            # Only reachable if the machine changed between upload and
+            # conversion (e.g. ENABLE_OFFICE flipped mid-queue) — fail with
+            # the message the user needs, not a subprocess traceback.
+            raise ConversionError(
+                "LibreOffice is not available on this server, so this "
+                "document cannot be converted. Convert it to PDF first."
+            )
+
+        pdf_path = out_dir / f"{src.stem}.pdf"
+        try:
+            profile = tempfile.TemporaryDirectory(
+                prefix="lo-profile-", ignore_cleanup_errors=True
+            )
+        except OSError as exc:
+            raise ConversionError(f"Could not create a temp profile dir: {exc}") from exc
+
+        with profile:
+            cmd = [
+                soffice,
+                "--headless",
+                "--norestore",
+                "--nolockcheck",
+                f"-env:UserInstallation={Path(profile.name).as_uri()}",
+                "--convert-to",
+                "pdf",
+                "--outdir",
+                str(out_dir),
+                str(src),
+            ]
+            started = time.perf_counter()
+            try:
+                process = subprocess.Popen(
+                    cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE
+                )
+            except OSError as exc:
+                raise ConversionError(f"Could not start LibreOffice: {exc}") from exc
+
+            try:
+                _stdout, stderr = process.communicate(timeout=CONVERT_TIMEOUT_S)
+            except subprocess.TimeoutExpired:
+                self._kill_tree(process)
+                raise ConversionError(
+                    f"LibreOffice did not finish within {CONVERT_TIMEOUT_S}s — "
+                    "the document may be too complex. Try exporting a PDF "
+                    "from the app it was made in."
+                ) from None
+
+            if process.returncode != 0:
+                raise ConversionError(
+                    f"LibreOffice failed (exit {process.returncode}): "
+                    f"{stderr.decode(errors='replace').strip()[:500]}"
+                )
+            if not pdf_path.is_file():
+                # soffice can exit 0 without producing output (e.g. an
+                # unreadable file it chose not to complain about).
+                raise ConversionError(
+                    "LibreOffice reported success but produced no PDF — the "
+                    "document may be corrupt or use an unsupported feature."
+                )
+
+            logger.info(
+                "converted %s -> %s in %.1fs (LibreOffice)",
+                src.name,
+                pdf_path.name,
+                time.perf_counter() - started,
+            )
+            return pdf_path
+
+    @staticmethod
+    def _kill_tree(process: subprocess.Popen) -> None:
+        """Kill soffice AND its children — it runs the real work in a
+        soffice.bin child, so killing the direct process is not enough."""
+        if os.name == "nt":
+            subprocess.run(
+                ["taskkill", "/F", "/T", "/PID", str(process.pid)],
+                capture_output=True,
+            )
+        else:
+            process.kill()
+        process.communicate()  # reap so nothing is left hanging
+
+
+# Stateless → one shared instance for every job (conversions are serialized
+# by the pipeline's conversion lock).
+OFFICE_PROCESSOR = OfficeProcessor()
diff --git a/app/processors/pdf.py b/app/processors/pdf.py
new file mode 100644
index 0000000..ec9faea
--- /dev/null
+++ b/app/processors/pdf.py
@@ -0,0 +1,26 @@
+"""PDF pass-through processor (Phase 1).
+
+PDF already IS the service's internal print format, so "conversion" is a
+no-op that returns the source unchanged. It exists so every category flows
+through the same pipeline code path — detect → processor → print engine —
+with no PDF special case anywhere.
+"""
+
+from pathlib import Path
+
+
+class PdfProcessor:
+    def available(self) -> bool:
+        # PDFs need nothing but SumatraPDF, which the print engine already
+        # requires — always available.
+        return True
+
+    def process(self, src: Path, out_dir: Path) -> Path:
+        # Source bytes were validated at upload time (magic + size); the
+        # real "can Sumatra open it" check happens when Sumatra runs, and
+        # its exit code 2 becomes a job error with a human message.
+        return src
+
+
+# Stateless → one shared instance for every job.
+PDF_PROCESSOR = PdfProcessor()
diff --git a/app/processors/text.py b/app/processors/text.py
new file mode 100644
index 0000000..74ac095
--- /dev/null
+++ b/app/processors/text.py
@@ -0,0 +1,270 @@
+"""Text/CSV processor (Phase 4) — authors print-ready PDFs for text files.
+
+A text file has no pages of its own, so this processor AUTHORS the layout
+(multi-format plan §0, answer 4):
+
+    TXT → monospace text, word-wrapped, paginated
+    CSV → a bordered grid with the header row repeated on every page
+
+reportlab draws both onto the shared page (base.page_size_pt). reportlab
+is a Python library — unlike LibreOffice it runs INSIDE the test suite, so
+these conversions are exercised for real, not mocked.
+
+Encoding: text has no magic bytes (detection trusts the extension), so
+decoding is verified here: UTF-16 (only with a BOM, which carries the byte
+order) → UTF-8 → Windows-1252. A file that decodes as none of those is a
+binary file wearing a text-file name and fails with a clear error instead
+of printing mojibake.
+
+Limits (paper + memory guards on the ≤4 GB PC): TXT caps at MAX_TXT_PAGES;
+CSV caps rows and columns — both print an explicit "truncated" notice.
+
+Known limitation: the built-in Courier font covers Latin scripts; CJK or
+emoji print as boxes (registering a Unicode TTF is a v2 idea).
+"""
+
+import csv
+import io
+import logging
+import math
+from pathlib import Path
+
+from reportlab.pdfbase.pdfmetrics import stringWidth
+from reportlab.pdfgen import canvas as pdfcanvas
+
+from app.processors.base import ConversionError, page_size_pt
+
+logger = logging.getLogger(__name__)
+
+FONT = "Courier"
+FONT_BOLD = "Courier-Bold"
+FONT_SIZE = 9.5
+LINE_HEIGHT = 12
+CELL_PADDING = 3
+MARGIN_PT = 54  # 0.75" — text pages want breathing room on both sides
+MAX_TXT_PAGES = 100
+CSV_MAX_ROWS = 1000  # rendered rows INCLUDING the header row
+CSV_MAX_COLS = 30
+
+# Monospace: every character occupies the width of an "M".
+CHAR_W = stringWidth("M", FONT, FONT_SIZE)
+
+
+def decode_text(data: bytes) -> str:
+    """Bytes → text, with the no-mojibake guarantee described above."""
+    if data.startswith((b"\xff\xfe", b"\xfe\xff")):
+        return data.decode("utf-16")  # BOM carries the byte order
+    for encoding in ("utf-8", "cp1252"):
+        try:
+            return data.decode(encoding)
+        except UnicodeDecodeError:
+            continue
+    raise ConversionError(
+        "This text file does not decode as text (tried UTF-8, UTF-16 and "
+        "Windows-1252) — it may be a binary file with a text-file name."
+    )
+
+
+def wrap_line(line: str, max_chars: int) -> list[str]:
+    """Word-wrap one logical line into chunks of at most max_chars.
+
+    Breaks at spaces when it can; a single word longer than a whole line
+    is hard-split rather than allowed to overflow the page.
+    """
+    if len(line) <= max_chars:
+        return [line]
+    chunks: list[str] = []
+    rest = line
+    while len(rest) > max_chars:
+        cut = rest.rfind(" ", 0, max_chars + 1)
+        if cut <= 0:
+            cut = max_chars  # no space to break at: hard-split the word
+        chunks.append(rest[:cut].rstrip(" "))
+        rest = rest[cut:].lstrip(" ")
+    chunks.append(rest)
+    return chunks
+
+
+def sniff_dialect(sample: str):
+    """Detect , ; tab | delimiters; fall back to plain comma-separated."""
+    try:
+        return csv.Sniffer().sniff(sample, delimiters=",;\t|")
+    except csv.Error:
+        return csv.excel
+
+
+def grid_columns(rows: list[list[str]], avail_w: float) -> list[float]:
+    """Column widths in points for a grid that must fit `avail_w`.
+
+    Each width covers its widest cell (a monster cell is capped so it
+    can't hog the page) PLUS the cell padding on both sides — the same
+    accounting _clip_cell uses — then the whole grid is scaled down
+    proportionally when it exceeds the printable width.
+    """
+    column_count = max((len(row) for row in rows), default=1)
+    char_counts = [1] * column_count
+    for row in rows:
+        for index, cell in enumerate(row):
+            char_counts[index] = max(char_counts[index], min(len(cell), 60))
+    widths = [count * CHAR_W + 2 * CELL_PADDING for count in char_counts]
+    if sum(widths) > avail_w:
+        factor = avail_w / sum(widths)
+        widths = [width * factor for width in widths]
+    return widths
+
+
+def _clip_cell(cell: str, column_w: float) -> str:
+    # The 1e-9 absorbs binary-float noise in the width math (e.g. a cell
+    # that is exactly 2.0 characters wide must not truncate to 1).
+    max_chars = int((column_w - 2 * CELL_PADDING) / CHAR_W + 1e-9)
+    if len(cell) <= max_chars:
+        return cell
+    return cell[: max(0, max_chars - 3)] + "..."
+
+
+def _render_txt(text: str, canvas: pdfcanvas.Canvas, page_w: float, page_h: float) -> int:
+    """Monospace, wrapped, paginated. Returns the page count."""
+    max_chars = int((page_w - 2 * MARGIN_PT) / CHAR_W)
+    lines_per_page = int((page_h - 2 * MARGIN_PT) // LINE_HEIGHT)
+
+    logical = (
+        text.replace("\r\n", "\n").replace("\r", "\n").replace("\t", "    ")
+        .replace("\f", "\n")
+        .split("\n")
+    )
+    wrapped: list[str] = []
+    for line in logical:
+        wrapped.extend(wrap_line(line, max_chars))
+
+    total_pages = math.ceil(len(wrapped) / lines_per_page)
+    truncated = total_pages > MAX_TXT_PAGES
+    pages = min(total_pages, MAX_TXT_PAGES)
+
+    for page in range(pages):
+        # setFont belongs to the page being drawn — anything after the
+        # final showPage would touch a new page and reportlab would emit
+        # it as a blank trailing page.
+        canvas.setFont(FONT, FONT_SIZE)
+        chunk = wrapped[page * lines_per_page : (page + 1) * lines_per_page]
+        if truncated and page == pages - 1:
+            chunk[-1] = "[truncated — the file was longer than the print limit]"
+        y = page_h - MARGIN_PT - FONT_SIZE
+        for line in chunk:
+            canvas.drawString(MARGIN_PT, y, line)
+            y -= LINE_HEIGHT
+        canvas.showPage()
+    return pages
+
+
+def _render_csv(
+    rows: list[list[str]], canvas: pdfcanvas.Canvas, page_w: float, page_h: float
+) -> int:
+    """Bordered grid, header repeated per page, caps with a notice."""
+    original_rows = len(rows)
+    original_cols = max(len(row) for row in rows)
+
+    truncated_cols = original_cols > CSV_MAX_COLS
+    if truncated_cols:
+        rows = [row[:CSV_MAX_COLS] for row in rows]
+    column_count = max(len(row) for row in rows)
+    rows = [row + [""] * (column_count - len(row)) for row in rows]  # pad ragged rows
+
+    truncated_rows = original_rows > CSV_MAX_ROWS
+    if truncated_rows:
+        rows = rows[:CSV_MAX_ROWS]
+
+    notes = []
+    if truncated_rows:
+        notes.append(f"[truncated — showing the first {CSV_MAX_ROWS} of "
+                     f"{original_rows} rows]")
+    if truncated_cols:
+        notes.append(f"[truncated — showing the first {CSV_MAX_COLS} of "
+                     f"{original_cols} columns]")
+    note_space = LINE_HEIGHT * (len(notes) + 1)  # +1: never touch the bottom margin
+
+    header, data = rows[0], rows[1:]
+    column_widths = grid_columns(rows, page_w - 2 * MARGIN_PT)
+    grid_w = sum(column_widths)
+    row_h = LINE_HEIGHT + 2 * CELL_PADDING
+    rows_per_page = max(1, int((page_h - 2 * MARGIN_PT - note_space) // row_h))
+    data_per_page = rows_per_page - 1  # the header occupies a slot on every page
+    pages = max(1, math.ceil(len(data) / data_per_page))
+
+    for page in range(pages):
+        y_top = page_h - MARGIN_PT
+        page_rows = [header] + data[page * data_per_page : (page + 1) * data_per_page]
+        grid_h = row_h * len(page_rows)
+
+        canvas.setLineWidth(0.4)
+        for index in range(len(page_rows) + 1):  # horizontal rules
+            y = y_top - index * row_h
+            canvas.line(MARGIN_PT, y, MARGIN_PT + grid_w, y)
+        x = MARGIN_PT
+        for width in [*column_widths]:  # vertical rules
+            x += width
+            canvas.line(x, y_top - grid_h, x, y_top)
+
+        for row_index, row in enumerate(page_rows):
+            canvas.setFont(FONT_BOLD if row_index == 0 else FONT, FONT_SIZE)
+            y = y_top - (row_index + 1) * row_h + CELL_PADDING
+            x = MARGIN_PT
+            for col_index, cell in enumerate(row):
+                canvas.drawString(
+                    x + CELL_PADDING, y, _clip_cell(cell, column_widths[col_index])
+                )
+                x += column_widths[col_index]
+
+        if page == pages - 1:
+            canvas.setFont(FONT, FONT_SIZE)
+            y = y_top - grid_h - LINE_HEIGHT
+            for note in notes:
+                canvas.drawString(MARGIN_PT, y, note)
+                y -= LINE_HEIGHT
+
+        canvas.showPage()
+    return pages
+
+
+class TextProcessor:
+    def available(self) -> bool:
+        # reportlab is a hard dependency (requirements.txt) — always on.
+        return True
+
+    def process(self, src: Path, out_dir: Path) -> Path:
+        """Render a TXT/CSV file into the print-ready PDF the engine gets."""
+        pdf_path = out_dir / f"{src.stem}.pdf"
+        data = src.read_bytes()
+        if not data.strip():
+            raise ConversionError("The text file is empty — nothing to print.")
+
+        text = decode_text(data)
+        page_w, page_h = page_size_pt()
+        # pageCompression off: the drawn text stays visible in the bytes,
+        # which is how the tests (and a plain text editor) can verify output.
+        document = pdfcanvas.Canvas(str(pdf_path), pagesize=(page_w, page_h), pageCompression=0)
+        try:
+            if src.suffix.lower() == ".csv":
+                rows = [
+                    row
+                    for row in csv.reader(io.StringIO(text), sniff_dialect(text[:4096]))
+                    if any(cell.strip() for cell in row)  # blank lines are noise
+                ]
+                if not rows:
+                    raise ConversionError("The CSV file contains no rows to print.")
+                pages = _render_csv(rows, document, page_w, page_h)
+            else:
+                pages = _render_txt(text, document, page_w, page_h)
+        except ConversionError:
+            raise
+        except Exception as exc:
+            raise ConversionError(f"Could not render the text as PDF: {exc}") from exc
+        document.save()
+
+        logger.info(
+            "rendered %s -> %s (%d page(s))", src.name, pdf_path.name, pages
+        )
+        return pdf_path
+
+
+# Stateless → one shared instance for every job.
+TEXT_PROCESSOR = TextProcessor()
diff --git a/app/services/jobs.py b/app/services/jobs.py
index fa49f8a..a1304d6 100644
--- a/app/services/jobs.py
+++ b/app/services/jobs.py
@@ -1,54 +1,172 @@
-"""
-Job tracking (Phase 7) — in-memory store, exactly as SOURCE_OF_TRUTH
-Section 12 prescribes for v1: a Python dict, no database.
+"""Job tracking (Phase 7's in-memory dict → Phase 5's SQLite store).
+
+SOURCE_OF_TRUTH Section 12 prescribed a plain dict for v1 and named the
+upgrade path for when persistence started to matter. Multi-format office
+jobs (tens of seconds each) crossed that line: losing a queued job to a
+restart now costs real time, and "retry failed" needs the uploaded file's
+location to outlive the request.
+
+The function surface is the same as the dict version — nothing else in
+the app changed — now backed by one SQLite file (config: JOB_DB_PATH,
+default `logs/jobs.sqlite3`):
+
+    jobs table: job_id (PK), filename, size_bytes, status, created_at,
+                updated_at, printer, error, format, source_path, category
 
-Known trade-off (accepted for v1): job history disappears if the service
-restarts. If that ever hurts, the Section 12 upgrade path is JSON file →
-SQLite.
+The threading.Lock stays (RLock now): uvicorn's thread pool and the print
+threads mutate the store concurrently, and the shared sqlite3 connection
+must not be used from two threads at once.
 
-Why the lock: Uvicorn runs sync endpoint functions in a small thread pool,
-so two simultaneous requests could mutate the dict at once. A threading.Lock
-makes "check then modify" sequences safe — the simplest correct tool here.
+Startup recovery (recover_interrupted, called from main's lifespan) flips
+jobs left in active states by a crashed run to failed — their uploads are
+already gone (the startup sweep deletes everything in uploads/), so they
+can't be retried; the error message says so.
+
+Cancellation rules (p14): a job may be cancelled while received, queued,
+converting or printing. Printing-cancels are best-effort — the spooler
+purge (app/printer/windows.py) removes queued Windows jobs, but paper
+that already reached the printer cannot be recalled; the pipeline checks
+the cancelled status after each stage and never marks a cancelled job
+done.
 """
 
+import json
+import sqlite3
 import threading
 from datetime import datetime, timezone
 from pathlib import Path
 
+from app.config import JOB_DB_PATH
 from app.models.printing import JobStatus, PrintJob
 
-_lock = threading.Lock()
-_jobs: dict[str, PrintJob] = {}
+# The states a cancel request may interrupt (p14). done/failed/cancelled
+# are terminal — cancelling those is refused with the current state.
+CANCELLABLE = frozenset(
+    {JobStatus.RECEIVED, JobStatus.QUEUED, JobStatus.CONVERTING, JobStatus.PRINTING}
+)
+
+_lock = threading.RLock()
+_db_path = Path(JOB_DB_PATH)
+_conn: sqlite3.Connection | None = None
 
+_SCHEMA = """
+CREATE TABLE IF NOT EXISTS jobs (
+    job_id      TEXT PRIMARY KEY,
+    filename    TEXT NOT NULL,
+    size_bytes  INTEGER NOT NULL,
+    status      TEXT NOT NULL,
+    created_at  TEXT NOT NULL,
+    updated_at  TEXT NOT NULL,
+    printer     TEXT,
+    error       TEXT,
+    format      TEXT,
+    source_path TEXT,
+    category    TEXT
+)
+"""
 
-def _now() -> datetime:
-    return datetime.now(timezone.utc)
 
+def _get_conn() -> sqlite3.Connection:
+    """The shared connection, created (with schema) on first use.
 
-def create_job(job_id: str, filename: str, size_bytes: int, path: Path) -> PrintJob:
-    """Register a freshly uploaded file as a tracked job."""
-    job = PrintJob(
-        job_id=job_id,
-        filename=filename,
-        size_bytes=size_bytes,
-        status=JobStatus.RECEIVED,
-        created_at=_now(),
-        updated_at=_now(),
+    check_same_thread=False: access is serialized by _lock instead, which
+    also guards the check-then-modify sequences the dict version needed.
+    The ALTER migrates databases created before Phase 7 — they lack the
+    options column; "duplicate column" means the migration already ran.
+    """
+    global _conn
+    if _conn is None:
+        _db_path.parent.mkdir(parents=True, exist_ok=True)
+        _conn = sqlite3.connect(_db_path, check_same_thread=False)
+        _conn.row_factory = sqlite3.Row
+        _conn.execute(_SCHEMA)
+        try:
+            _conn.execute("ALTER TABLE jobs ADD COLUMN options TEXT")
+        except sqlite3.OperationalError:
+            pass  # column exists — either fresh schema or already migrated
+        _conn.commit()
+    return _conn
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _to_job(row: sqlite3.Row) -> PrintJob:
+    options = None
+    if row["options"]:
+        try:
+            options = json.loads(row["options"])
+        except json.JSONDecodeError:
+            options = None  # corrupt JSON must not 500 a status poll
+    return PrintJob(
+        job_id=row["job_id"],
+        filename=row["filename"],
+        size_bytes=row["size_bytes"],
+        status=row["status"],
+        created_at=datetime.fromisoformat(row["created_at"]),
+        updated_at=datetime.fromisoformat(row["updated_at"]),
+        printer=row["printer"],
+        error=row["error"],
+        format=row["format"],
+        options=options,
     )
+
+
+def create_job(
+    job_id: str,
+    filename: str,
+    size_bytes: int,
+    path: Path,
+    format: str | None = None,
+    options: dict | None = None,
+) -> PrintJob:
+    """Register a freshly uploaded file as a tracked job.
+
+    `format` is the detected category from upload validation; the file's
+    location, category and print options (Phase 7) are stored alongside it
+    so a failed job can be retried exactly as it was submitted.
+    """
+    now = _now()
     with _lock:
-        _jobs[job_id] = job
-    return job
+        _get_conn().execute(
+            "INSERT INTO jobs (job_id, filename, size_bytes, status, created_at,"
+            " updated_at, format, source_path, category, options)"
+            " VALUES (?, ?, ?, 'received', ?, ?, ?, ?, ?, ?)",
+            (
+                job_id,
+                filename,
+                size_bytes,
+                now,
+                now,
+                format,
+                str(path),
+                format,
+                json.dumps(options) if options else None,
+            ),
+        )
+        _get_conn().commit()
+        row = _get_conn().execute(
+            "SELECT * FROM jobs WHERE job_id = ?", (job_id,)
+        ).fetchone()
+    return _to_job(row)
 
 
 def get_job(job_id: str) -> PrintJob | None:
     with _lock:
-        return _jobs.get(job_id)
+        row = _get_conn().execute(
+            "SELECT * FROM jobs WHERE job_id = ?", (job_id,)
+        ).fetchone()
+    return _to_job(row) if row is not None else None
 
 
 def list_jobs() -> list[PrintJob]:
-    """All jobs, oldest first (dicts preserve insertion order)."""
+    """All jobs, oldest first."""
     with _lock:
-        return list(_jobs.values())
+        rows = _get_conn().execute(
+            "SELECT * FROM jobs ORDER BY created_at, rowid"
+        ).fetchall()
+    return [_to_job(row) for row in rows]
 
 
 def update_status(
@@ -57,40 +175,92 @@ def update_status(
     error: str | None = None,
     printer: str | None = None,
 ) -> None:
-    """Move a job along its lifecycle (used by Phase 5's printing code).
+    """Move a job along its lifecycle (used by the printing pipeline).
 
     error/printer are only written when provided; reaching 'done' clears a
-    stale error, since the job obviously succeeded.
+    stale error, since the job obviously succeeded. Unknown ids are a
+    silent no-op — callers run on background threads and must never raise.
     """
     with _lock:
-        job = _jobs.get(job_id)
-        if job:
-            job.status = status
-            if error is not None:
-                job.error = error
-            elif status == JobStatus.DONE:
-                job.error = None
-            if printer is not None:
-                job.printer = printer
-            job.updated_at = _now()
+        _get_conn().execute(
+            "UPDATE jobs SET status = ?, updated_at = ?,"
+            " error = CASE WHEN ? = 'done' THEN NULL ELSE COALESCE(?, error) END,"
+            " printer = COALESCE(?, printer)"
+            " WHERE job_id = ?",
+            (status, _now(), status, error, printer, job_id),
+        )
+        _get_conn().commit()
 
 
 def cancel_job(job_id: str) -> tuple[bool, str]:
-    """Cancel a job that hasn't reached the Windows print queue yet.
+    """Cancel a job that hasn't reached a terminal state.
 
-    Returns (ok, message). Only 'received' jobs are cancellable in Phase 7 —
-    once Phase 5 submits a job to the spooler, cancellation has to go
-    through Windows (win32print.SetJob), which is Phase 5/P8 territory.
+    Returns (ok, message). Cancellable states (p14): received/queued
+    (nothing happened yet), converting (the pipeline checks the status
+    between stages and abandons the job), printing (best-effort — the
+    caller also purges the Windows spooler queue; paper that already
+    fed into the printer cannot be recalled).
     """
     with _lock:
-        job = _jobs.get(job_id)
-        if job is None:
+        row = _get_conn().execute(
+            "SELECT status FROM jobs WHERE job_id = ?", (job_id,)
+        ).fetchone()
+        if row is None:
             return False, "No such job."
-        if job.status != JobStatus.RECEIVED:
+        status = row["status"]
+        if status not in CANCELLABLE:
             return False, (
-                f"Job is '{job.status}' — only jobs that haven't been handed "
-                "to the print queue can be cancelled."
+                f"Job is '{status}' — only jobs that haven't finished can be "
+                "cancelled."
             )
-        job.status = JobStatus.CANCELLED
-        job.updated_at = _now()
+        _get_conn().execute(
+            "UPDATE jobs SET status = 'cancelled', updated_at = ? WHERE job_id = ?",
+            (_now(), job_id),
+        )
+        _get_conn().commit()
     return True, "Cancelled."
+
+
+def get_source(job_id: str) -> tuple[Path, str] | None:
+    """The (file, category) a job was created from — retry's raw material."""
+    with _lock:
+        row = _get_conn().execute(
+            "SELECT source_path, category FROM jobs WHERE job_id = ?", (job_id,)
+        ).fetchone()
+    if row is None or row["source_path"] is None:
+        return None
+    return Path(row["source_path"]), row["category"] or "pdf"
+
+
+def reset_for_retry(job_id: str) -> bool:
+    """Move a FAILED job back to received, clearing its error.
+
+    Only failed jobs qualify (a failed job's files are kept for exactly
+    this purpose); returns False for anything else.
+    """
+    with _lock:
+        cursor = _get_conn().execute(
+            "UPDATE jobs SET status = 'received', error = NULL, updated_at = ?"
+            " WHERE job_id = ? AND status = 'failed'",
+            (_now(), job_id),
+        )
+        _get_conn().commit()
+    return cursor.rowcount > 0
+
+
+def recover_interrupted() -> int:
+    """Mark jobs left in active states by a previous run as failed.
+
+    Called once at startup. Their uploaded files are already gone (the
+    startup sweep clears uploads/), so retrying is impossible — the error
+    says what happened. Returns how many jobs were recovered.
+    """
+    active = (JobStatus.RECEIVED, JobStatus.QUEUED, JobStatus.CONVERTING, JobStatus.PRINTING)
+    with _lock:
+        cursor = _get_conn().execute(
+            "UPDATE jobs SET status = 'failed', updated_at = ?, error = ?"
+            " WHERE status IN (?, ?, ?, ?)",
+            (_now(), "Service restarted before this job finished.", *active),
+        )
+        _get_conn().commit()
+    return cursor.rowcount
diff --git a/app/services/pipeline.py b/app/services/pipeline.py
index dc45b4a..5986480 100644
--- a/app/services/pipeline.py
+++ b/app/services/pipeline.py
@@ -1,15 +1,33 @@
-"""
-Job submission pipeline (Phase 5) — turns a stored upload into paper.
+"""Job submission pipeline (Phase 5; multi-format in p10) — turns a stored
+upload into paper.
 
 Why a background thread: printing a PDF can take seconds. Doing it inside
 the HTTP request would make the phone wait with no feedback; instead the
 upload response returns immediately with status "queued" (matching the
-Section 11 API design), and the job's status moves forward in the store:
+Section 11 API design), and the job's status moves forward in the store.
+
+The multi-format shape (docs/MULTI_FORMAT_PLAN.md §3/§8):
+
+    detect (upload time) → processor → PDF → submit_pdf → Windows queue
+
+PDF is the service's ONE internal print format: every category is turned
+into a PDF before submit_pdf() ever sees it, so the print engine stays
+byte-for-byte what Phase 5 proved with real paper (spike T4).
+
+The job's states now move:
 
-    received → queued → done     (or failed, with a human-readable error)
+    received → queued → converting → printing → done
+                                       ↘ failed
 
-Windows' own print queue serializes actual printing between concurrent
-jobs (SOURCE_OF_TRUTH Section 2), so we don't need our own queue for v1.
+`printing` used to be defined but never set; it now wraps the actual
+submission, and `converting` covers the (future) slow office conversions
+so the phone can tell "working on your DOCX" from "talking to the printer".
+
+The conversion lock: at most ONE conversion runs at a time. On the
+print-server PC (≤4 GB RAM) that keeps future LibreOffice conversions from
+stacking up; the PDF pass-through holds it for microseconds, and Windows'
+own print queue keeps serializing actual printing between concurrent jobs
+(SOURCE_OF_TRUTH Section 2).
 """
 
 import logging
@@ -18,36 +36,100 @@
 
 from app.models.printing import JobStatus
 from app.printer import windows
-from app.services import jobs
+from app.processors import for_category
+from app.services import jobs, uploads
 
 logger = logging.getLogger(__name__)
 
+# The old-PC guard: one conversion at a time, job or no job.
+_conversion_lock = threading.Lock()
+
 
-def start_job(job_id: str, pdf_path: Path) -> None:
-    """Hand a freshly uploaded job to a background submission thread."""
+def start_job(
+    job_id: str,
+    src: Path,
+    category: str = "pdf",
+    options: dict | None = None,
+) -> None:
+    """Hand a freshly uploaded job to a background submission thread.
+
+    `options` is the job's stored print-options dict (copies, pages,
+    paper, color_mode) — retried jobs reuse theirs (p14 + Phase 7).
+    """
+    current = jobs.get_job(job_id)
+    if current is not None and current.status == JobStatus.CANCELLED:
+        # The cancel raced in between upload and this call — queuing would
+        # resurrect it (update_status doesn't know better).
+        logger.info("job %s cancelled before it started — not queuing", job_id)
+        uploads.delete_job_files(job_id)
+        return
     jobs.update_status(job_id, JobStatus.QUEUED)
     threading.Thread(
         target=_process,
-        args=(job_id, pdf_path),
+        args=(job_id, src, category, options),
         name=f"print-{job_id}",
         daemon=True,  # never block service shutdown on a stuck print job
     ).start()
 
 
-def _process(job_id: str, pdf_path: Path) -> None:
+def _cancelled(job_id: str) -> bool:
+    """Whether the user cancelled this job — checked between stages so a
+    cancel always wins over the next print step (p14)."""
+    job = jobs.get_job(job_id)
+    return job is not None and job.status == JobStatus.CANCELLED
+
+
+def _abandon(job_id: str, where: str) -> None:
+    """Clean up after a cancellation noticed at a stage boundary."""
+    uploads.delete_job_files(job_id)
+    logger.info("job %s cancelled %s — nothing further printed", job_id, where)
+
+
+def _process(
+    job_id: str, src: Path, category: str, options: dict | None = None
+) -> None:
     try:
-        method, printer = windows.submit_pdf(pdf_path)
+        if _cancelled(job_id):
+            _abandon(job_id, "before conversion")
+            return
+
+        pdf_path = src
+        processor = for_category(category)
+        if processor is not None:
+            jobs.update_status(job_id, JobStatus.CONVERTING)
+            with _conversion_lock:
+                # The lock can be held by a slow office conversion — the
+                # cancel may have arrived while this thread was waiting.
+                if _cancelled(job_id):
+                    _abandon(job_id, "while waiting to convert")
+                    return
+                pdf_path = processor.process(src, src.parent)
+
+        if _cancelled(job_id):
+            _abandon(job_id, "after conversion")
+            return
+
+        jobs.update_status(job_id, JobStatus.PRINTING)
+        method, printer = windows.submit_pdf(pdf_path, options=options)
+
+        if _cancelled(job_id):
+            # The cancel endpoint purged the spooler queue best-effort; if
+            # paper still came out, that's the documented limit of a
+            # printing-stage cancel. The job stays cancelled regardless.
+            _abandon(job_id, "while printing")
+            return
+
         jobs.update_status(job_id, JobStatus.DONE, printer=printer)
-        logger.info("job %s submitted via %s to %r", job_id, method, printer)
+        logger.info(
+            "job %s (%s) submitted via %s to %r", job_id, category, method, printer
+        )
 
         # Temp-file lifecycle (Section 8): printed → no longer needed.
-        try:
-            pdf_path.unlink(missing_ok=True)
-        except OSError:
-            logger.warning("could not delete %s after printing", pdf_path)
+        # Covers the source upload AND the converted PDF in one sweep.
+        uploads.delete_job_files(job_id)
 
     except Exception as exc:
-        logger.exception("job %s failed to print", job_id)
-        # Keep the stored file on failure — useful for diagnosing, and the
-        # startup sweep (Phase 4) eventually clears it.
+        logger.exception("job %s failed", job_id)
+        # Keep the stored file(s) on failure — useful for diagnosing, and
+        # what makes retry (p14) possible.
         jobs.update_status(job_id, JobStatus.FAILED, error=str(exc))
diff --git a/app/services/uploads.py b/app/services/uploads.py
index 17d318a..3d8afed 100644
--- a/app/services/uploads.py
+++ b/app/services/uploads.py
@@ -1,19 +1,53 @@
-"""
-Upload handling (Phase 4): validation + temporary storage.
+"""Upload handling (Phase 4; generalized for multi-format in p10).
 
 Lifecycle of an uploaded file:
-    phone → POST /print → validated here → uploads/<job_id>.pdf
-          → (Phase 5) handed to the Windows print queue → deleted
+    phone → POST /print → validated here → uploads/<job_id><ext>
+          → pipeline converts to uploads/<job_id>.pdf → printed → deleted
+
+The PDF-only days enforced one rule ("is this a PDF?"); the multi-format
+service enforces a policy instead (docs/MULTI_FORMAT_PLAN.md §6/§9):
+
+    0. Macro-enabled Office formats are refused outright — policy, not
+       technology (rejecting is cheaper than trusting a converter not to
+       run their macros).
+    1. The extension is a hint; app/detection.py decides what the file
+       really is, using magic bytes.
+    2. A binary format must actually show its signature — a renamed file
+       fails here even though its extension looks right.
+    3. A detected format is only accepted when a processor is registered
+       for it (app/processors) — image/office/text stay refused until
+       their phases land.
+    4. The size limit still protects memory and disk from hostile uploads.
 
 Anything still in uploads/ when the service starts is stale (the previous
 run died before cleanup), so the app sweeps it on startup — the cheap
-insurance SOURCE_OF_TRUTH Section 8 asks for.
+insurance SOURCE_OF_TRUTH Section 8 asks for. uploads/ is service-managed
+(every name in it is server-generated), so the sweep now removes ANY file,
+not just PDFs.
 """
 
 import uuid
 from pathlib import Path
 
-from app.config import MAX_UPLOAD_MB, PDF_MAGIC, UPLOAD_DIR
+from app.config import MAX_UPLOAD_MB, UPLOAD_DIR
+from app.detection import (
+    EXTENSION_CATEGORIES,
+    MACRO_EXTENSIONS,
+    category_for,
+    magic_category,
+)
+from app.processors import for_category, supported_categories
+
+# For a REGISTERED-but-unavailable processor: the message must tell the
+# phone user what to do (office is the case today — LibreOffice missing or
+# the ENABLE_OFFICE kill switch).
+UNAVAILABLE_MESSAGES = {
+    "office": (
+        "Office printing is unavailable on this server — LibreOffice is not "
+        "installed, or ENABLE_OFFICE=0 in .env. Convert the document to PDF "
+        "first, or install LibreOffice to enable office formats."
+    ),
+}
 
 
 class UploadError(Exception):
@@ -28,45 +62,125 @@ def ensure_upload_dir() -> None:
     UPLOAD_DIR.mkdir(parents=True, exist_ok=True)
 
 
-def upload_path(job_id: str) -> Path:
+def upload_path(job_id: str, ext: str = ".pdf") -> Path:
     """Where an upload with this job id lives on disk.
 
     Every module that needs to find a stored upload goes through here, so
     the location is defined once — and tests can redirect it in one place.
     """
-    return UPLOAD_DIR / f"{job_id}.pdf"
+    return UPLOAD_DIR / f"{job_id}{ext}"
+
+
+def job_files(job_id: str) -> list[Path]:
+    """Every file belonging to a job: the source upload and — once non-PDF
+    formats exist — its converted PDF alongside it. Defined once so the
+    pipeline's cleanup and the cancel endpoint agree on what a job leaves
+    behind."""
+    ensure_upload_dir()
+    return sorted(path for path in UPLOAD_DIR.glob(f"{job_id}.*") if path.is_file())
+
+
+def delete_job_files(job_id: str) -> int:
+    """Delete every file of a job. Returns how many were removed."""
+    removed = 0
+    for path in job_files(job_id):
+        try:
+            path.unlink()
+            removed += 1
+        except OSError:
+            pass  # never let cleanup crash the service
+    return removed
 
 
-def validate_pdf(filename: str, data: bytes) -> None:
-    """Three checks, cheapest first (SOURCE_OF_TRUTH Section 8)."""
+def validate_upload(filename: str, data: bytes) -> str:
+    """Security gate for every upload (SOURCE_OF_TRUTH Section 8).
 
-    # 1. Extension hint — a cheap first look, but extensions can lie.
-    if filename and not filename.lower().endswith(".pdf"):
-        raise UploadError("Only .pdf files are accepted.", status_code=415)
+    Checks run cheapest-first; returns the detected category ("pdf" in
+    Phase 1) that the API records on the job and the pipeline dispatches
+    on.
+    """
+    # 0. Macro policy — before any content parsing even looks at the file.
+    ext = Path(filename).suffix.lower() if filename else ""
+    if ext in MACRO_EXTENSIONS:
+        raise UploadError(
+            f"Macro-enabled Office files ({ext}) are not accepted for security "
+            "reasons. Re-save the document without macros as a plain "
+            ".docx/.xlsx/.pptx, or export a PDF.",
+            status_code=415,
+        )
 
-    # 2. Magic bytes — what a file CLAIMS to be matters less than what it IS.
-    #    A real PDF always begins with the bytes b"%PDF-"; a renamed .txt
-    #    fails here even though it ends in ".pdf".
-    if not data.startswith(PDF_MAGIC):
+    # 1+2. Extension hint vs magic evidence (app/detection.py): the allowlist
+    #    stays explicit — an unknown extension is refused even when the
+    #    content itself is recognizable (a lying "virus.exe" must not sneak
+    #    in just because it happens to contain a PDF). When both sides are
+    #    known they must agree; a binary format must show its signature.
+    if ext and ext not in EXTENSION_CATEGORIES:
+        raise UploadError(
+            f"Unsupported file type '{ext}'. Currently supported: .pdf — "
+            "more formats arrive in later phases.",
+            status_code=415,
+        )
+    claimed = category_for(filename)
+    content = magic_category(data)
+    category = claimed or content
+    if category is None:
+        raise UploadError(
+            "Unsupported file type '(no extension)'. Currently supported: "
+            ".pdf — more formats arrive in later phases.",
+            status_code=415,
+        )
+    if content is not None and content != category:
+        raise UploadError(
+            f"File content does not match the '{ext or '(none)'}' extension "
+            f"(content looks like {content} data).",
+            status_code=415,
+        )
+    if category in {"pdf", "image", "office"} and content is None:
+        # Binary formats must show their signature; text is the only
+        # extension-trusted category (see detection.py).
+        reason = {
+            "pdf": "File content is not a PDF (missing %PDF- header).",
+            "image": "File content does not look like an image.",
+            "office": "File content does not look like an Office document.",
+        }[category]
+        raise UploadError(reason, status_code=415)
+
+    # 3. Availability — two distinct gates, two distinct messages:
+    #    (a) no processor registered yet → "arrives in a later phase";
+    #    (b) registered but not runnable on THIS machine (office kill
+    #        switch / LibreOffice missing) → an actionable message.
+    processor = for_category(category)
+    if processor is None:
+        printable = ", ".join(supported_categories())
+        raise UploadError(
+            f"'{ext or 'this format'}' files cannot be printed yet — support "
+            f"arrives in a later phase. Currently printable: {printable}.",
+            status_code=415,
+        )
+    if not processor.available():
         raise UploadError(
-            "File content is not a PDF (missing %PDF- header).",
+            UNAVAILABLE_MESSAGES.get(
+                category,
+                f"'{ext or category}' printing is unavailable on this server.",
+            ),
             status_code=415,
         )
 
-    # 3. Size limit — protects memory and disk from huge or hostile uploads.
+    # 4. Size limit — protects memory and disk from huge or hostile uploads.
     max_bytes = MAX_UPLOAD_MB * 1024 * 1024
     if len(data) > max_bytes:
         raise UploadError(
             f"File is {len(data) / 1_000_000:.1f} MB; limit is {MAX_UPLOAD_MB} MB.",
             status_code=413,
         )
+    return category
 
 
-def save_upload(data: bytes) -> tuple[str, Path]:
+def save_upload(data: bytes, ext: str = ".pdf") -> tuple[str, Path]:
     """Store the bytes under a unique name. Returns (job_id, saved_path)."""
     ensure_upload_dir()
     job_id = uuid.uuid4().hex[:12]  # short, unique, no secrets in it
-    path = upload_path(job_id)
+    path = upload_path(job_id, ext)
     path.write_bytes(data)
     return job_id, path
 
@@ -75,7 +189,9 @@ def sweep_stale_uploads() -> int:
     """Delete leftovers from a previous run. Returns how many were removed."""
     ensure_upload_dir()
     removed = 0
-    for stale in UPLOAD_DIR.glob("*.pdf"):
+    for stale in UPLOAD_DIR.iterdir():
+        if not stale.is_file():
+            continue  # directories (or oddities) are skipped, not deleted
         try:
             stale.unlink()
             removed += 1
diff --git a/docs/MULTI_FORMAT_PLAN.md b/docs/MULTI_FORMAT_PLAN.md
new file mode 100644
index 0000000..55d4f2e
--- /dev/null
+++ b/docs/MULTI_FORMAT_PLAN.md
@@ -0,0 +1,368 @@
+# Multi-Format Printing — Investigation, Decision Record & Roadmap
+
+Status: **approved plan** (branch `multiple-types-compatibility`).
+Goal: grow the PDF-only MVP into a general multi-format network printing
+service while keeping it simple enough for a beginner home lab on an
+old/low-spec Windows PC.
+
+Claims are tagged like SOURCE_OF_TRUTH:
+🟢 CONFIRMED FACT · 🔵 RECOMMENDED (decided here) · 🟡 ALTERNATIVE · 🔴 NEEDS TESTING (spike) · ⚪ FUTURE
+
+---
+
+## 0. Where this stage stopped (closed 2026-08-29)
+
+**MVP VERIFIED: code complete through Phase 4 AND all paper gates passed.**
+
+- 🟢 **Done and pushed** on `multiple-types-compatibility` (PR #1 open):
+  `56afce6` (this roadmap) → `d078d41` **p10** groundwork → `b928e11`
+  **p11** images → `19a7223` **p12** office → `0be3eab` **p13** text/CSV →
+  docs/status commits → `1f1a1f4` spike fix. 193 automated tests at ≈97 %
+  coverage; ruff clean.
+- ✅ **Hardware gates all PASS on the Epson L3210** (2026-08-29):
+  **T4** (PDF, earlier) · **T5** (images + `paper=A4` driver check) ·
+  **T6** (office via LibreOffice 26.8.0: DOCX 20.8 s, XLSX 10.5 s, PPTX
+  10.9 s — print area honored) · **T7** (TXT/CSV). Details in
+  SOURCE_OF_TRUTH §5.
+- 🟡 **Follow-ups:** merge PR #1 when green; optionally set
+  `PAPER_SIZE=A4` in `.env` (verified safe by T5); a phone smile-check of
+  each format; LibreOffice install recipe now lives in README §1.
+- ⚪ **Next stage: Phase 7** (print options UI: copies, page range, paper
+  size, color mode — v2). Phases 5–6 landed in p14/p15.
+
+---
+
+## 1. Executive summary — the 10 answers
+
+| # | Question | Decision |
+|---|----------|----------|
+| 1 | Keep SumatraPDF? | **Yes** — unchanged CLI, same install, same `submit_pdf()` |
+| 2 | Replace it? | **No** |
+| 3 | What joins it? | LibreOffice Headless (office→PDF converter only), Pillow (images), reportlab (TXT/CSV) — all free (MPL-2.0 / MIT-style / BSD) |
+| 4 | Convert to PDF before printing? | **Yes**, for every non-PDF input |
+| 5 | Internal print format? | **PDF**, stored beside the original upload |
+| 6 | Python's role? | Orchestrator: Pillow/reportlab/pywin32 as libraries; LibreOffice/SumatraPDF as external executables via arg-list subprocess |
+| 7 | First new formats? | Images (JPG/PNG/WebP) — no heavy dependencies |
+| 8 | Architecture? | Format processors → common PDF → existing `submit_pdf()` print engine, inserted at one point of the current pipeline |
+| 9 | Avoid? | Per-format direct printing, MS Office COM, RAW/GDI printing, anything beyond SQLite, internet exposure (SOURCE_OF_TRUTH §16) |
+| 10 | Implement first? | Hardware spike T5–T7 on the real PC, then the Phase 1 refactor (p10) |
+
+---
+
+## 2. What the service is today 🟢 (verified by reading the code)
+
+- FastAPI console app (`uvicorn app.main:app`), optional PIN auth, LAN-only
+  (private-profile firewall rule), Epson L3210 on USB via the Windows queue
+  `EPSON L3210 Series`.
+- `POST /print` → `validate_pdf()` (`.pdf` extension + `%PDF-` magic +
+  `MAX_UPLOAD_MB`) → saved as `uploads/<job_id>.pdf` → in-memory job store
+  (dict behind a lock, SOURCE_OF_TRUTH §12) → one daemon thread per job →
+  `submit_pdf()` → `SumatraPDF.exe -print-to "<printer>" -silent <file>`
+  (180 s timeout) → done → file deleted.
+- The Windows "print" verb fallback is broken on this machine (spike T3,
+  WinError 1155) and stays a documented safety net only.
+- Spike T4 physically printed paper through the whole chain.
+- 81 tests mock `win32print`; CI runs ruff + pytest + ≥90 % coverage.
+
+**Key insight:** the service is already ~80 % format-agnostic.
+`submit_pdf(pdf_path)` *is* the print-engine contract (PDF in → paper out).
+The only PDF-specific code: `uploads.py` (validate/save/sweep), `config.py`
+(`PDF_MAGIC`), `api/print.py` (415 message), `api/web.py` (`accept=".pdf"`).
+
+## 3. Keep / modify / new / replace / isolate 🔵
+
+- **Keep unchanged:** FastAPI app + routes + PIN auth; job store and lock;
+  **`submit_pdf()` untouched**; logging; startup sweep pattern; tests/CI
+  conventions; SumatraPDF itself.
+- **Modify (surgical):** `uploads.py` (generic validation, real extension,
+  sweep everything), `config.py` (format-related settings), `pipeline.py`
+  (detect → processor → submit; real `converting`/`printing` states;
+  conversion lock), `models/printing.py` (+`converting`, +`format` field),
+  `api/print.py` + `api/web.py` (generic messages, wider accept list).
+- **New:** `app/detection.py` (magic-byte-first detection);
+  `app/processors/` package (`base.py` Processor protocol, `pdf.py`
+  pass-through, later `images.py`, `office.py`, `text.py`).
+- **Replaced:** nothing — no working component is rewritten.
+- **Isolated behind interfaces:** (1) the Processor protocol
+  (`process(src, out_dir) -> Path` returning a print-ready PDF); (2)
+  `submit_pdf()`'s signature (a future alternative engine implements the
+  same one call); (3) the job-store function set (dict → SQLite swap).
+
+## 4. SumatraPDF evaluation — KEEP 🟢/🔵
+
+🟢 Confirmed from the official CLI docs: `-print-to` / `-print-settings`
+accept `paper=A4|letter|legal|...`, `fit`/`shrink`/`noscale`, `center`,
+`color`/`monochrome`, `duplex`, copies (`3x`, `collate`), page ranges
+(`2-6`, `odd`, `even`); documented exit codes 0/2/3/4/5/6 (2 = file won't
+open, 4 = printer not found, 5 = driver/device failure) → mappable to human
+messages. Reads PDF, EPUB, MOBI, CBZ, CBR, FB2, CHM, XPS, DjVu — **not
+images, not office docs** — which is irrelevant here because processors
+normalize everything to PDF first. (A)GPLv3 is unproblematic: invoked as a
+separate process, no linking. ~15 MB, fast startup, actively maintained,
+works from a console/Task-Scheduler session (the current deployment model).
+
+### Alternatives rejected 🔵
+
+| Alternative | Why rejected |
+|---|---|
+| LibreOffice `--pt` direct print | Still loads the whole office suite; bypasses the PDF quality checkpoint; weaker per-file error reporting |
+| win32print RAW | The L3210 is a host-based GDI inkjet — RAW PDF bytes print as garbage |
+| pypdfium2 → bitmap → GDI | Most control, most code, worse raster quality; documented future fallback |
+| Ghostscript (mswinpr2) | AGPL, no advantage over Sumatra |
+| Adobe/Foxit CLIs | Licensing / deprecation |
+| MS Office COM, docx2pdf, docto | Need Office installed + licensed; unsupported headless; fragile |
+| Windows print verb | Proven broken here (spike T3, WinError 1155) |
+
+## 5. PDF as the intermediate format — YES 🔵
+
+**Advantages:** one print engine; a debuggable artifact when paper looks
+wrong (open `uploads/<id>.pdf`); all paper/fit/orientation handling in one
+place (`-print-settings`); source-document layout fidelity preserved by
+LibreOffice's own layout engine; JPEGs embed losslessly; testable without a
+printer; one set of print options works for every format (Phase 7).
+**Disadvantages:** extra disk I/O; 10–30 s conversion per office doc on an
+old PC; exotic office features may not survive export; LibreOffice must be
+installed. Alternatives (XPS, raster, "each format prints itself") are
+worse: weaker tooling, no multipage, N engines = N failure modes.
+
+## 6. Format strategy table 🔵
+
+| Format | Processor | Convert to PDF? | Dependencies | Difficulty | Reliability | Notes |
+|---|---|---|---|---|---|---|
+| PDF | pass-through | — | none | trivial | high | today's behavior |
+| JPG/JPEG | images (Pillow) | yes | Pillow | easy | high | EXIF rotation honored |
+| PNG | images (Pillow) | yes | Pillow | easy | high | alpha → white |
+| WebP | images (Pillow) | yes | Pillow | easy | high | wheels bundle libwebp |
+| BMP/GIF/TIFF | images (bonus) | yes | Pillow | free | high | multipage TIFF |
+| DOC/DOCX | office (LibreOffice headless) | yes | LibreOffice | medium | med-high | server-side fonts matter |
+| XLS/XLSX | office (LibreOffice headless) | yes | LibreOffice | medium | medium | honors stored print areas/scaling |
+| PPT/PPTX | office (LibreOffice headless) | yes | LibreOffice | medium | med-high | 1 slide = 1 page |
+| ODT/ODS/ODP | office (bonus) | yes | LibreOffice | free | high | comes free with LibreOffice |
+| TXT | text (reportlab) | generated | reportlab | easy | high | monospace, word-wrap, page breaks |
+| CSV | text (csv + reportlab) | generated | reportlab | easy-med | high | bordered grid, capped rows/cols |
+
+Policy rejections: `.docm/.xlsm/.pptm/.dotm` (macro-enabled), `.heic`
+(needs pillow-heif — ⚪ v2), everything else not listed.
+
+**Old-PC load profile (during a print job only — the service idles at
+~100 MB):** PDF/Sumatra ~100 MB for 1–2 s; image conversion 50–200 MB for
+<1 s; text conversion ~50 MB for <1 s; LibreOffice 300–500 MB for 5–30 s,
+then the process exits and frees everything. Only LibreOffice is a real
+cost, and there is no lighter alternative — any DOCX printer must load a
+layout engine.
+
+**Office kill switch:** office formats are printable only when
+`ENABLE_OFFICE=1` (default) *and* LibreOffice is actually found.
+Otherwise office uploads get a friendly 415 ("convert to PDF first");
+PDF/images/text keep working. No uninstall needed to disable office.
+
+## 7. Print-quality reality check (honest caveats) 🔵
+
+- **DOCX — fonts are risk #1.** LibreOffice renders with fonts installed on
+  the *server*; missing fonts get substituted and line breaks shift.
+  Mitigation: install a reasonable font pack on the server; document it.
+- **XLSX is the least predictable format** regardless of tool: sheets saved
+  without a print area paginate all columns; wide sheets split arbitrarily.
+  LibreOffice honors stored print areas/scaling/orientation. Document "set
+  a print area in Excel for best results"; fit-to-width is a ⚪ v2 knob.
+- **PPTX** is reliable: slide size becomes page size; 16:9 decks print
+  landscape. Speaker notes are not printed.
+- **Images:** honor EXIF orientation, alpha → white, fit-to-page centered
+  with configurable margin, auto-landscape for wide images, downscale to
+  ≤300 effective DPI.
+- **PDF pass-through** is untouched; `paper=A4,fit` handles odd sizes.
+
+## 8. Print job lifecycle 🔵
+
+States: `received → queued → converting → printing → done | failed |
+cancelled` (`printing` finally gets set; `converting` explains slow office
+jobs to the phone).
+
+1. `POST /print` → validate (extension allowlist → magic bytes → size cap →
+   category availability) → save as `uploads/<job_id>.<ext>` → create job
+   (format recorded) → **201 immediately**.
+2. Worker thread: detect category → pick processor → status `converting` →
+   produce `uploads/<job_id>.pdf` (conversions serialized by a lock —
+   the old-PC guard).
+3. Status `printing` → `submit_pdf(pdf_path)`.
+4. done → delete original + intermediate; failed → keep both + human
+   error; startup sweep clears leftovers.
+
+Edge cases: printer offline → Sumatra exit 4/5 → FAILED with mapped
+message (spooler-side stalls after acceptance can't be seen via exit code —
+Phase 5 adds a pywin32 pre-check + retry). Conversion crash → timeout +
+`taskkill /T`, FAILED with stderr tail. Corrupted file → passes magic,
+fails converter → FAILED with converter error. Two users at once →
+thread-per-job stays; one conversion lock serializes conversions; the
+spooler serializes printing. Huge file → size cap + conversion timeout;
+phone already got its 201. Restart mid-job → in-memory history lost
+(accepted trade-off); sweep clears partials; Phase 5 adds SQLite +
+startup recovery.
+
+## 9. Security (practical, layered) 🔵
+
+Keep: PIN + LAN-only + private-profile firewall; magic-byte validation
+(generalized); **server-generated filenames** (client filename stored for
+display only — kills path traversal); arg-list subprocess (never
+`shell=True`); startup sweep.
+Add: hard-reject macro formats; LibreOffice invoked as
+`--headless --norestore --nolockcheck -env:UserInstallation=<private
+profile>` (isolated profile, no network) with timeout + process-tree kill;
+pinned dependencies.
+Explicitly NOT in MVP: dedicated low-priv conversion account, sandboxing,
+AV scanning — ⚪ v2+ options.
+
+## 10. Phased roadmap
+
+- **Phase 0 — hardware spike (real PC, real paper):** T5/T6/T7 below.
+- **Phase 1 (p10) — refactor PDF pipeline, no behavior change:**
+  detection + Processor layer + generalized uploads + conversion lock +
+  `converting`/`printing` states; all tests stay green.
+- **Phase 2 (p11) — images:** Pillow processor; web page accept/copy;
+  `PAPER_SIZE` wiring (default empty = driver chooses, per the de-risking
+  decision); cancel cleanup must delete `<job_id>.<ext>` too
+  (`uploads.delete_job_files`). Code landed in p11 — physical check pending
+  T5 (`spike_t5_images.py`), which is this phase's acceptance gate.
+- **Phase 3 (p12) — office:** install LibreOffice (run T6 first);
+  `office.py` adapter (timeout, taskkill, profile isolation,
+  `ENABLE_OFFICE` kill switch); friendly error mapping; font-pack docs;
+  verify a table-heavy DOCX and a print-area XLSX on real paper.
+  Code landed in p12 (fresh throwaway profile per conversion instead of a
+  shared one — crash-proof, ~1 s warmup cost). Physical check pending T6
+  (`spike_t6_office.py`, needs `pip install python-docx openpyxl
+  python-pptx` spike-only) — this phase's acceptance gate.
+- **Phase 4 (p13) — text/CSV:** reportlab renderer — TXT = monospace text
+  with wrap; CSV = bordered grid with row/col caps + "truncated" notice.
+  Code landed in p13 (all four MVP categories now registered). Physical
+  check pending T7 (`spike_t7_text.py`) — with T5/T6 this completes the
+  MVP's paper verification.
+- **Phase 5 (p14) — queue management:** cancel while queued/converting;
+  spooler purge via `win32print.SetJob` once printed; retry failed jobs;
+  SQLite persistence (SOURCE_OF_TRUTH §12 upgrade path) + startup recovery.
+  **Landed in p14:** the job store moved to SQLite (`JOB_DB_PATH`, default
+  `logs/jobs.sqlite3`) behind the same function surface; cancellation now
+  works in every pre-done state (the pipeline checks between stages and
+  never marks a cancelled job done; the cancel endpoint purges our spooler
+  jobs by document name); `POST /jobs/{id}/retry` + a web Retry button
+  re-print failed jobs from the stored upload; startup recovery flips
+  interrupted jobs to failed.
+- **Phase 6 (p15) — reliability:** pre-dispatch printer-status check; error
+  catalog (exit code → message); log rotation; startup recovery.
+  **Landed in p15:** `printer_ready()` checks the spooler's status flags
+  (offline / not available / out of paper / jam / door open / error, plus
+  the `WORK_OFFLINE` attribute Windows sets when a USB printer is off)
+  BEFORE SumatraPDF runs — a known-bad printer fails with that reason
+  instead of a generic exit code; best-effort (a query hiccup never blocks
+  printing; verified against the real Epson's GetPrinter shape). Exit
+  codes 2/3/4/5/6 now map to human messages. Log rotation was already in
+  place since p8; startup recovery landed with p14.
+- **Phase 7 (v2) — print options & dialog UI:** optional per-request
+  options on `POST /print`: `copies` (1–99 → `3x` + `collate`), `pages`
+  (range `2-6`, `odd`/`even` — strict allowlist regex before it touches a
+  command line), `paper` (A4 / short bond Letter / long bond 8.5×13 via
+  `paper=215.9mm x 330.2mm` or driver paper name — one spike line), 
+  `color_mode` (`color`/`monochrome`). One `print-settings` builder in the
+  pipeline; stored on the job; web page gains dropdown/inputs in its
+  vanilla-JS style. Works for **all** formats automatically because
+  everything is a PDF by print time. Duplex/quality/tray hidden (L3210 has
+  no duplex hardware, one tray). A print preview (serve the intermediate
+  PDF to the phone before printing) comes nearly free later.
+  **Landed in p16:** `PrintOptions` + strict validation
+  (`validate_print_options`, 422 on violations), `build_print_settings()`
+  in the print engine (request paper overrides `PAPER_SIZE`; defaults
+  still build NO settings — the T4-proven command), options stored on the
+  job (JSON column + migration for older DBs) and reused by retry, web
+  page gains the collapsible print-options dialog, `spike_t5 --paper
+  long-bond` ready for the 8.5×13 check.
+
+Each phase: ruff + pytest + ≥90 % coverage gate; README +
+SOURCE_OF_TRUTH updated; one commit per phase (p10, p11, …).
+
+## 11. MVP / v2 / future
+
+- **MVP (Phases 0–4):** PDF, JPG/PNG/WebP, DOCX/XLSX/PPTX (+ legacy + ODF),
+  TXT/CSV.
+- **v2 (Phases 5–7):** queue management, reliability hardening, print
+  options & dialog UI; plus HEIC via pillow-heif, pypdf pre-validation,
+  multi-image jobs, printer-offline retry parking, per-format size caps,
+  print preview.
+- **Future (do NOT build):** everything in SOURCE_OF_TRUTH §16 (internet
+  exposure, cloud, Docker, multi-user, dashboards), an IPP server, direct
+  USB/Epson protocol, distributed anything.
+
+## 12. Printer note
+
+Stay on the Windows printing stack: SumatraPDF → spooler → Epson driver →
+USB, exactly as today. Direct USB communication (ESC/P-R via libusb) only
+pays off for real-time status/ink management and is a large, brittle,
+printer-firmware-coupled build — rejected.
+
+## 13. Assumptions that need the spike 🔴
+
+1. LibreOffice headless behaves under the Task-Scheduler startup session on
+   the target PC (T6).
+2. The target OS runs current LibreOffice — ≤4 GB RAM is fine; if it turns
+   out to be Win 7/8.1, pin LibreOffice 7.6.x (last branch supporting it).
+3. The Epson driver honors `paper=A4` from Sumatra's `-print-settings`
+   (today nothing pins paper size).
+4. LibreOffice fidelity on *your* real documents (table-heavy DOCX,
+   print-area XLSX).
+5. ~1.2 GB free disk for LibreOffice; serialized conversions keep RAM safe
+   on the ≤4 GB PC.
+6. Long-bond paper (8.5×13) prints correctly via Sumatra custom paper size
+   or the Epson driver's named paper (Phase 7 spike line).
+
+## 14. Spike protocol (Phase 0)
+
+Extend the T1–T4 convention in `spike_print_test.py` (T4 = SumatraPDF chain,
+PASS with real paper). Same output style: print `T<n> PASS/FAIL` plus
+timings, and record results in SOURCE_OF_TRUTH §5.
+
+### T5 — Images → PDF → paper
+1. `pip install pillow` (dev only for the spike).
+2. Python: create three test images with Pillow (a photo-like gradient JPEG,
+   a PNG with transparency, a WebP), then fit each onto an A4/Letter page
+   (white background, centered) and save as PDF.
+3. Print each via the T4 command (`SumatraPDF.exe -print-to "EPSON L3210
+   Series" -silent <file.pdf>`).
+**PASS =** three pages on paper, correct orientation, transparency rendered
+white (not black), no clipping.
+
+### T6 — Office → PDF → paper (needs LibreOffice installed)
+1. Install LibreOffice (default install; note the disk usage).
+2. `soffice --headless --norestore --convert-to pdf --outdir %TEMP% test.docx`
+   with (a) a table-heavy DOCX, (b) an XLSX with a defined print area, (c) a
+   16:9 PPTX. Open each PDF and compare against the source app.
+3. Print each PDF via the T4 command.
+4. Measure: `powershell Measure-Command { soffice ... }` per file; watch RAM
+   in Task Manager during conversion.
+5. Repeat one conversion while the service runs under Task Scheduler
+   ("at startup", before logon) to verify session-0 behavior.
+**PASS =** PDFs open correctly, layouts acceptable, paper output matches,
+conversion ≤ 30 s and RAM ≤ ~500 MB on the target PC.
+
+### T7 — TXT/CSV → PDF → paper
+1. `pip install reportlab` (dev only for the spike).
+2. Python: render a wrapped TXT (long lines, unicode) and a CSV (20×6 grid)
+   to PDF with reportlab; print via T4.
+**PASS =** readable monospace text with wrapping; CSV grid aligned, nothing
+cut off at the right margin.
+
+## 15. Open items
+
+- [x] Phase 1 refactor (p10), images (p11), office (p12), text/CSV (p13) —
+      code committed and pushed.
+- [x] Branch pushed; CI runs on PR #1 — merge when green.
+- [x] **T6 office spike PASSED** (2026-08-29, LibreOffice 26.8.0): print
+      area honored in landscape, table fits, slides landscape — the last
+      MVP gate is closed.
+- [x] T5 images spike PASSED (2026-08-29), including the `paper=A4`
+      driver check. · [x] T7 text/CSV spike PASSED (2026-08-29).
+- [ ] Merge PR #1 into `main` when CI is green.
+- [ ] Set `PAPER_SIZE=A4` in `.env` whenever desired (verified by T5;
+      optional — empty = driver chooses).
+- [x] Windows version confirmed: Windows 11 (current LibreOffice fine,
+      no 7.6.x pin needed).
+- [ ] Phase 7: verify long-bond paper (8.5×13) on the Epson driver —
+      `python spike_t5_images.py --paper long-bond` (custom mm size, the
+      exact token the print-settings builder uses).
diff --git a/docs/SOURCE_OF_TRUTH.md b/docs/SOURCE_OF_TRUTH.md
index 77cfa77..c8773f4 100644
--- a/docs/SOURCE_OF_TRUTH.md
+++ b/docs/SOURCE_OF_TRUTH.md
@@ -1,7 +1,7 @@
 # Printer Service — Source of Truth
 
 **Project:** Android → Network → Python Service → USB → Epson L3210
-**Status:** ✅ MVP working end-to-end (spike T4 PASS: real page printed via SumatraPDF; phone → service → paper verified). ✅ Automated test suite (90 tests, 95%+ coverage gate) + ruff lint + GitHub Actions CI — service *logic* is verified on every push; hardware is verified by the spike on the real PC. Living document. Update this file whenever a decision changes.
+**Status:** 🟢 **Multi-format MVP VERIFIED on real hardware** (2026-08-29): p10–p13 code + spikes **T4/T5/T6/T7 all PASS** on the Epson L3210 — PDF, images, office, TXT/CSV all print end-to-end. 193 automated tests, ≈97 % coverage, ruff clean. Branch pushed; PR #1 open; CI running. Living document. Update this file whenever a decision changes.
 **Audience:** Beginner learning networking, servers, and Python.
 **Quickstart & pre-setup checklist:** see the root [README.md](../README.md).
 
@@ -196,6 +196,15 @@ None of these should be assumed to work out of the box on your specific old PC w
 
 🔵 **Decision:** **SumatraPDF** (`SumatraPDF.exe -print-to "<printer>" -silent <file.pdf>`) is the primary PDF printing method; the print verb remains a code fallback (default printer only); PDF→image conversion is the unimplemented last resort. Implemented in `app/printer/windows.py`; submission runs in a background thread (`app/services/pipeline.py`) so `POST /print` returns `"queued"` immediately and job status moves `queued → done/failed`. **Status: confirmed working end-to-end via the spike (real page printed).** Re-confirm on the old PC at deploy time.
 
+🟢 **Multi-format extension of the same decision (p10–p13):** every format is normalized to PDF *before* the print engine — format processors (images via Pillow, office via LibreOffice Headless, text/CSV via reportlab) feed the unchanged `submit_pdf()`, so SumatraPDF remains the only component that ever talks to the printer. The office converter is gated by `ENABLE_OFFICE` plus LibreOffice presence (the kill switch). Full decision record: [MULTI_FORMAT_PLAN.md](MULTI_FORMAT_PLAN.md).
+
+🟢 **SPIKE RESULTS for the new formats (run on the print-server PC, 2026-08-29):**
+- **T5 PASS** (`spike_t5_images.py --paper A4`) — 4 test images (JPEG gradient, PNG with transparency, WebP, EXIF-rotated JPEG) converted by the real ImageProcessor in 0.19–0.35 s each and printed via SumatraPDF to `EPSON L3210 Series`. Paper judged good: all pages upright, nothing clipped, transparency corners white (not black), EXIF image upright. The extra `-print-settings "paper=A4,fit"` page also came out A4 → **the driver honors the flag**, so `PAPER_SIZE` may now be set in `.env` if wanted (still optional; empty = driver chooses).
+- **T7 PASS** (`spike_t7_text.py`) — TXT (wrap + pagination) and a 40×6 CSV with quoted cells rendered by the real TextProcessor and printed. Paper judged good: margins clean, nothing clipped, grid/borders drawn.
+- **T6 PASS** (`spike_t6_office.py`, 2026-08-29) — LibreOffice 26.8.0 installed on the print-server PC (Windows 11 — no 7.6.x pin needed; installed via the CLI curl recipe now in README §1 after winget stalled). Table-heavy DOCX (20.8 s), print-area XLSX in landscape (10.5 s) and 16:9 PPTX (10.9 s) converted by the real OfficeProcessor and printed — well under the 120 s `CONVERT_TIMEOUT_S`. Paper judged good: table fits with borders, **only the print area printed** (the "OUTSIDE" cell stayed out), slides landscape.
+
+🟢 **With T4/T5/T6/T7 all PASS, the multi-format MVP is fully verified on real hardware — every supported format prints end-to-end.**
+
 ---
 
 ## 6. Android Side
@@ -309,6 +318,51 @@ This is a home-lab project, so the goal is **sensible defaults**, not enterprise
 - Basic queue management if multiple jobs arrive close together.
 - Logging, and automatic cleanup of temp files.
 
+### Multi-Format Printing (current stage — p10 onward)
+The service grows from PDF-only to a general multi-format print service
+(images, office documents, text/CSV) with PDF as the one internal print
+format and SumatraPDF kept as the print engine. The full investigation,
+decision record, phased roadmap and spike protocol (T5–T7) live in
+[MULTI_FORMAT_PLAN.md](MULTI_FORMAT_PLAN.md); its hardware spikes extend
+Section 5's T1–T4 convention before any new format prints real paper.
+
+**Status — stage CLOSED (2026-08-29): 🟢 code complete through Phase 4 AND all paper gates passed (T5/T6/T7). The multi-format MVP is verified.**
+
+- 🟢 **Done** (commits on `multiple-types-compatibility`, pushed; PR #1
+  open, CI running):
+  - `56afce6 docs:` decision record + roadmap (MULTI_FORMAT_PLAN.md).
+  - `d078d41 p10:` detection (magic bytes per format, extension
+    allowlist, macro rejection) + processor registry + generalized
+    uploads + conversion lock; `converting`/`printing` states now set.
+  - `b928e11 p11:` images via Pillow (EXIF, alpha→white, fit/center,
+    300-DPI cap, 10-page frame cap); `-print-settings` wired but
+    `PAPER_SIZE` defaults to empty = the T4-proven driver behavior.
+  - `19a7223 p12:` office via LibreOffice headless (fresh profile per
+    conversion, timeout + process-tree kill, `ENABLE_OFFICE` kill
+    switch; `available()` gate separates "later phase" from
+    "unavailable on this server").
+  - `0be3eab p13:` text/CSV via reportlab (TXT wrap/paginate, CSV grid
+    with repeated header + truncation notices, verified decoding).
+    All four MVP categories registered.
+  - Suite: 193 tests, ≈97 % coverage (gate 90 %), ruff clean. Web page
+    and API accept every MVP extension. Office uploads currently return
+    the kill-switch 415 because LibreOffice is not installed — designed
+    behavior, not a bug.
+- ✅ **Since the morning of 2026-08-29:** branch pushed (PR #1 open, CI
+  running); **T5 PASS, T7 PASS, then LibreOffice 26.8.0 installed (CLI
+  curl recipe) and T6 PASS** — all recorded in Section 5.
+- ✅ **Remaining follow-ups (non-blocking):**
+  1. Merge PR #1 into `main` when CI is green.
+  2. `PAPER_SIZE` may now be set in `.env` (e.g. `A4`) — T5 verified the
+     driver honors `-print-settings`; still optional (empty = driver
+     chooses).
+  3. One real print of each format from the phone as a final smile-check
+     now that LibreOffice is installed.
+- ⚪ **Next stage:** Phase 5 (queue management: cancel-while-converting,
+  spooler purge via `win32print.SetJob`, retry, SQLite persistence +
+  startup recovery), then Phase 6 (reliability), Phase 7/v2 (print
+  options UI). Designed in MULTI_FORMAT_PLAN.md §10, not yet built.
+
 ---
 
 ## 10. Project Folder Structure 🔵
@@ -345,12 +399,13 @@ Keep it this flat at first — you can split `api/`, `printer/`, etc. further on
 |---|---|---|---|---|
 | `/health` | GET | none | `{"status": "ok"}` | Lets you (or the phone) quickly confirm the server is reachable and running, independent of printing logic — the first thing to check when something's wrong. |
 | `/printers` | GET | none | List of available printer names (from `pywin32`) | Confirms Windows/the driver can see the L3210 at all, and leaves room for multiple printers later. |
-| `/print` | POST | A file upload (PDF) + optional printer name | `{"job_id": "...", "status": "queued"}` | The core action: accept a file and start a print job. |
+| `/print` | POST | A file upload (any supported format) + **optional print options**: `copies` (1–99), `pages` (`2-6`, `1,3,5`, `odd`/`even` — strict allowlist), `paper` (a4/letter/legal/a3/a5/long-bond), `color_mode` (color/monochrome) — Phase 7 | `{"job_id": "...", "status": "queued"}` | The core action: accept a file and start a print job. Options apply to every format because everything is normalized to PDF before the engine runs; they're stored on the job so a retry reprints identically. |
 | `/jobs` | GET | none | List of recent jobs and their statuses | Lets the phone (or you) see what's happened/is happening, without re-printing. |
 | `/jobs/{id}` | GET | job id in URL | Status of one specific job | Lets the UI poll "is my print done yet?" |
 | `/jobs/{id}` | DELETE | job id in URL | Confirmation / error | Lets you cancel a queued job — useful once you've accidentally queued the wrong file (you will). |
+| `/jobs/{id}/retry` | POST | job id in URL | The job re-queued | Re-print a failed job from its stored upload (p14) — no re-upload needed. |
 
-Nothing here is over-engineered: every endpoint maps directly to something you'll actually need while testing the system by hand in Phase 3–6.
+Nothing here is over-engineered: every endpoint maps directly to something you'll actually need while testing the system by hand.
 
 ---
 
@@ -358,11 +413,9 @@ Nothing here is over-engineered: every endpoint maps directly to something you'l
 
 **Do you need one for v1? No.**
 
-For a single-server, single-user, home-lab MVP, an **in-memory Python dictionary** (job ID → job info) is enough: it's simple, requires no setup, and is easy to reason about while you're still learning. Its one real downside — job history disappears if the service restarts — is not a problem worth solving yet.
+🟢 **As of p14 the store is SQLite** (`logs/jobs.sqlite3` by default, `JOB_DB_PATH` in `.env`) — the upgrade path below was taken once multi-format office jobs (tens of seconds each) made losing a queued job to a restart expensive, and "retry failed" needed the uploaded file's location to outlive the request. The function surface (`create_job`, `get_job`, `list_jobs`, `update_status`, `cancel_job`) is unchanged, so nothing outside `app/services/jobs.py` moved. Startup recovery marks jobs left in active states by a crashed run as failed — their uploads are already swept, so they can't be retried.
 
-- **In-memory storage** 🔵 recommended for v1 — zero setup, perfect for learning, data doesn't survive a restart (acceptable for now).
-- **JSON file** 🟡 alternative — barely more effort than in-memory, and survives restarts; reasonable "Phase 6" upgrade if you want job history to persist.
-- **SQLite** ⚪ future improvement — worth learning once you actually feel the pain of losing history, or if you want to practice real database concepts (queries, schemas) as a deliberate next-step exercise, not before.
+The progression was: **in-memory dict** (v1 — zero setup, ideal while learning) → **SQLite** (p14 — one file, no server). A JSON file was considered as the intermediate step but SQLite came at the same effort. Anything heavier (Postgres, a DB server) would only make sense with many machines or users — explicitly out of scope (§16).
 
 ---
 
@@ -390,17 +443,18 @@ The table above is the *hardware/network* test plan. On top of it sits an automa
 
 | What the suite verifies | How |
 |---|---|
-| Upload validation: extension, `%PDF-` magic bytes, size limit — including the exact boundary (`>` vs `>=`) | Unit tests with parametrized inputs (table row #8, automated) |
-| Job lifecycle `received → queued → done/failed/cancelled`, error/printer recording, cancellation rules | Unit tests against the in-memory store (row #6's locking, via a concurrency smoke test) |
-| Print submission *decisions*: SumatraPDF command line, printer-name override, print-verb fallback and its "default printer only" refusal, loud failure without pywin32 | Unit tests with a **fake `win32print` module** injected into `sys.modules` and mocked `subprocess`/`os.startfile` |
-| Whole-API behavior: `/health`, `/`, `/print` (201/401/413/415/500), `/jobs` CRUD, `/printers` (200/503/500) | API tests through FastAPI's `TestClient` — no network needed (rows #2/#3's logic) |
-| Pipeline threading: `queued` visible while the thread runs, temp file deleted after `done`, kept after `failed` | Unit tests waiting on fakes with bounded polling (deterministic, no `sleep`) |
+| Format detection & the upload gate: magic bytes per format (PDF, JPEG/PNG/WebP, ZIP containers sniffed for OOXML/ODF parts, OLE), extension allowlist (a lying `.exe` is refused even when it contains a PDF), macro-format policy rejection, the two availability gates (unregistered = "later phase", office kill switch = actionable message), size limit | Unit tests with parametrized inputs (table row #8, generalized to every format) |
+| Format processors: images (EXIF orientation, alpha→white, fit/center geometry, 300-DPI cap, frame cap — real Pillow), office (headless invocation shape, fresh profile per conversion, timeout → process-tree kill, nonzero-exit / no-output mapping, kill switch — LibreOffice faked at `subprocess.Popen`), text/CSV (word-wrap, decode chain, grid widths, truncation notices — real reportlab) | Unit tests; produced PDFs are asserted at byte level (`%PDF-` magic, page-object counts, drawn text is visible because page compression is off) |
+| Job lifecycle `received → queued → converting → printing → done/failed/cancelled`, error/printer recording, cancellation rules | Unit tests against the in-memory store (row #6's locking, via a concurrency smoke test) |
+| Print submission *decisions*: SumatraPDF command line (incl. optional `-print-settings` when `PAPER_SIZE` is set), printer-name override, print-verb fallback and its "default printer only" refusal, loud failure without pywin32 | Unit tests with a **fake `win32print` module** injected into `sys.modules` and mocked `subprocess`/`os.startfile` |
+| Whole-API behavior: `/health`, `/`, `/print` (201/401/413/415/500) for every category, `/jobs` CRUD, `/printers` (200/503/500) | API tests through FastAPI's `TestClient` — no network needed (rows #2/#3's logic) |
+| Pipeline threading: `converting`/`printing` visible while the thread runs, temp files deleted after `done`, kept after `failed`, conversions serialized one-at-a-time by the conversion lock (the ≤4 GB guard) | Unit tests waiting on fakes with bounded polling (deterministic, no `sleep`) |
 
-**Key design rule:** tests never touch machine state — no real printer, no real SumatraPDF, no real `.env`, real `uploads/` redirected to a temp dir. That's what lets the same suite pass on a Windows dev box and the Ubuntu CI runner. It's possible at all because `win32print` is imported lazily *inside* `app/printer/windows.py`'s functions — a v1 design choice (Section 4) that turned out to make CI possible for free.
+**Key design rule:** tests never touch machine state — no real printer, no real SumatraPDF, no real LibreOffice, no real `.env`, real `uploads/` redirected to a temp dir. That's what lets the same suite pass on a Windows dev box and the Ubuntu CI runner. It's possible at all because `win32print` is imported lazily *inside* `app/printer/windows.py`'s functions — a v1 design choice (Section 4) that turned out to make CI possible for free. Pillow and reportlab, being Python libraries, run *inside* the tests; LibreOffice, being an external executable, is only ever faked.
 
-**What stays manual:** anything physical or environmental — rows #1, #5, #7, #9, #10, #11, and the "did paper come out" half of #4/#5. `spike_print_test.py` on the actual print-server PC remains the hardware truth (Section 5).
+**What stays manual:** anything physical or environmental — rows #1, #5, #7, #9, #10, #11, the "did paper come out" half of #4/#5, and the multi-format spikes T5/T6/T7 (Section 5). `spike_print_test.py` plus the three new spike scripts on the actual print-server PC remain the hardware truth.
 
-**Quality gates in CI (`.github/workflows/ci.yml`, Ubuntu + Python 3.12):** `ruff check .` (lint only — no formatter enforcement, so working code never gets reformatted wholesale) then `pytest` with `--cov-fail-under=90` (configured in `pyproject.toml`; measured coverage ≈95%, the gap is mostly `logging_setup.py`, which tests deliberately don't execute to keep global logging state pristine). The same two commands run locally from the project root after `pip install -r requirements-dev.txt`.
+**Quality gates in CI (`.github/workflows/ci.yml`, Ubuntu + Python 3.12):** `ruff check .` (lint only — no formatter enforcement, so working code never gets reformatted wholesale) then `pytest` with `--cov-fail-under=90` (configured in `pyproject.toml`; measured coverage ≈97 % across 193 tests — the gap is mostly `logging_setup.py`, which tests deliberately don't execute to keep global logging state pristine). The same two commands run locally from the project root after `pip install -r requirements-dev.txt`.
 
 ---
 
@@ -508,8 +562,8 @@ This MVP deliberately has **no database, no authentication beyond "same Wi-Fi ne
 
 ## Open Items Requiring Testing (Summary)
 
-- 🟢 **Resolved (spike run):** the spooler path works and the printer is detected; the Windows "print" verb has no PDF handler on the tested machine, so **SumatraPDF is the chosen PDF method** (Section 5 now records the decision). Still to confirm: T4 PASS after installing SumatraPDF, then a real end-to-end print — on this machine and again on the old PC at deploy time.
-- 🔴 Confirm `pywin32` correctly detects and can submit jobs to the specific Epson L3210 driver installed on your PC (Section 4, Section 9 Phase 4). *(Spike T1/T2 confirm detection and spooler acceptance.)*
+- 🟢 **Resolved (spikes run):** the spooler path works, the printer is detected, and the Windows "print" verb has no PDF handler on the tested machine — so **SumatraPDF is the chosen print engine** (Section 5 records the decision and the T4 PASS with real paper). Still worth re-confirming the whole chain on the old PC at deploy time.
+- 🟢 **Multi-format hardware gates — ALL PASS (2026-08-29):** T5 (images), T6 (office, LibreOffice 26.8.0), T7 (TXT/CSV) — details in Section 5. The multi-format MVP is verified end-to-end. Follow-ups: merge PR #1, optionally set `PAPER_SIZE=A4` in `.env`, phone smile-check per format.
 - 🔴 If you later pursue Option C (Android's native `PrintService` framework, Section 6), treat IPP support and the `PrintService` implementation itself as a separate research phase — do not assume it's a small extension of the MVP.
 
 ---
diff --git a/docs/logo/README.md b/docs/logo/README.md
new file mode 100644
index 0000000..8c202b7
--- /dev/null
+++ b/docs/logo/README.md
@@ -0,0 +1,54 @@
+# PrinterService logo
+
+The mark tells the story of the project in one glance: a **phone** (magenta) is fed
+into the printer's paper-input slot, and the printer outputs a page carrying a
+**Wi-Fi symbol** (cyan) — *mobile → printing → wireless*.
+
+Palette is CMYK-inspired:
+
+| Color     | Hex       | Role                          |
+| --------- | --------- | ----------------------------- |
+| Cyan      | `#00AEEF` | Wi-Fi symbol, status LED      |
+| Magenta   | `#E6007E` | phone, "Service" wordmark     |
+| Yellow    | `#FFD84D` | printed page                  |
+| Dark      | `#24272E` | printer body, "Printer"       |
+| White     | `#FFFFFF` | slot openings, phone screen   |
+
+The background is transparent; the body color is lifted slightly so the silhouette
+also reads on dark backgrounds.
+
+## Files
+
+| File                            | Use                                              |
+| ------------------------------- | ------------------------------------------------ |
+| `printerservice-icon.svg`       | Symbol only — favicons, app icons, inline badges |
+| `printerservice-logo.svg`       | Horizontal lockup for **light** backgrounds      |
+| `printerservice-logo-dark-bg.svg` | Horizontal lockup for **dark** backgrounds     |
+
+## Usage
+
+Icon only:
+
+```markdown
+![PrinterService](docs/logo/printerservice-icon.svg)
+```
+
+Lockup that adapts to GitHub light/dark theme:
+
+```html
+<picture>
+  <source media="(prefers-color-scheme: dark)"
+          srcset="docs/logo/printerservice-logo-dark-bg.svg">
+  <img src="docs/logo/printerservice-logo.svg" alt="PrinterService" width="400">
+</picture>
+```
+
+## Editing
+
+- All colors are inline `fill` attributes — change them per element; groups are
+  named (`#phone`, `#wifi`, `#page`, `#body`, …).
+- The mark is duplicated between the three files (no external references), so
+  apply any shape change to all of them.
+- The wordmark is a real `<text>` element using a system font stack
+  (`Segoe UI` / system sans). It stays trivially editable; convert to outlines
+  first if you need pixel-identical rendering everywhere.
diff --git a/docs/logo/printerservice-icon.svg b/docs/logo/printerservice-icon.svg
new file mode 100644
index 0000000..bd39ab0
--- /dev/null
+++ b/docs/logo/printerservice-icon.svg
@@ -0,0 +1,48 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" width="512" height="512" role="img" aria-labelledby="ps-title ps-desc">
+  <title id="ps-title">PrinterService</title>
+  <desc id="ps-desc">A smartphone feeding into a printer that prints a page carrying a Wi-Fi symbol.</desc>
+
+  <!--
+    PrinterService logo mark
+    Palette (CMYK-inspired):
+      Cyan    #00AEEF  wireless / status
+      Magenta #E6007E  phone
+      Yellow  #FFD84D  printed page
+      Black   #24272E  printer body (ink outline on page: #1A1C20)
+    Neutral: #FFFFFF (slot openings, phone screen)
+  -->
+  <g id="printerservice-mark" transform="translate(256 256) scale(1.15) translate(-256 -256)">
+
+    <!-- Printer body -->
+    <rect id="body" x="112" y="197" width="288" height="174" rx="30" fill="#24272E"/>
+
+    <!-- Output page (yellow, outlined) emerging from the front slot -->
+    <rect id="page" x="194" y="325" width="124" height="120" rx="10" fill="#FFD84D" stroke="#1A1C20" stroke-width="9"/>
+    <!-- Front output slot, drawn over the page so the page reads as exiting it -->
+    <rect id="output-slot" x="188" y="319" width="136" height="14" rx="7" fill="#FFFFFF"/>
+
+    <!-- Wi-Fi symbol printed on the page -->
+    <g id="wifi" fill="none" stroke="#00AEEF" stroke-width="8" stroke-linecap="round">
+      <path d="M 228.4 399.4 A 39 39 0 0 1 283.6 399.4"/>
+      <path d="M 236.9 407.9 A 27 27 0 0 1 275.1 407.9"/>
+      <path d="M 245.4 416.4 A 15 15 0 0 1 266.6 416.4"/>
+    </g>
+    <circle id="wifi-dot" cx="256" cy="427" r="6.5" fill="#00AEEF"/>
+
+    <!-- Paper-input slot (top opening) -->
+    <rect id="input-slot" x="184" y="207" width="144" height="22" rx="11" fill="#FFFFFF"/>
+
+    <!-- Smartphone fed into the input slot -->
+    <g id="phone">
+      <rect x="204" y="67" width="104" height="160" rx="26" fill="#E6007E"/>
+      <rect x="216" y="81" width="80" height="112" rx="13" fill="#FFFFFF"/>
+      <rect x="236" y="207" width="40" height="6" rx="3" fill="#FFFFFF"/>
+    </g>
+    <!-- Slot front lip, overlaps the phone base so it reads as inserted -->
+    <rect id="input-slot-lip" x="184" y="221" width="144" height="8" fill="#24272E"/>
+
+    <!-- Status LED -->
+    <circle id="led" cx="350" cy="267" r="9" fill="#00AEEF"/>
+
+  </g>
+</svg>
diff --git a/docs/logo/printerservice-logo-dark-bg.svg b/docs/logo/printerservice-logo-dark-bg.svg
new file mode 100644
index 0000000..72b6b10
--- /dev/null
+++ b/docs/logo/printerservice-logo-dark-bg.svg
@@ -0,0 +1,48 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 582 200" width="582" height="200" role="img" aria-labelledby="pswd-title pswd-desc">
+  <title id="pswd-title">PrinterService</title>
+  <desc id="pswd-desc">PrinterService wordmark: a smartphone feeding into a printer that prints a page carrying a Wi-Fi symbol.</desc>
+
+  <!--
+    PrinterService horizontal lockup for DARK backgrounds (icon + wordmark)
+    Uses the same mark as printerservice-icon.svg.
+    Palette (CMYK-inspired):
+      Cyan    #00AEEF  wireless / status
+      Magenta #E6007E  phone + "Service"
+      Yellow  #FFD84D  printed page
+      Dark    #24272E  printer body + "Printer"
+  -->
+  <g id="lockup">
+
+    <!-- Mark -->
+    <g transform="translate(20 28) scale(0.28)">
+      <g id="printerservice-mark" transform="translate(256 256) scale(1.15) translate(-256 -256)">
+        <!-- Printer body -->
+        <rect id="body" x="112" y="197" width="288" height="174" rx="30" fill="#24272E"/>
+        <!-- Output page emerging from the front slot -->
+        <rect id="page" x="194" y="325" width="124" height="120" rx="10" fill="#FFD84D" stroke="#1A1C20" stroke-width="9"/>
+        <rect id="output-slot" x="188" y="319" width="136" height="14" rx="7" fill="#FFFFFF"/>
+        <!-- Wi-Fi symbol printed on the page -->
+        <g id="wifi" fill="none" stroke="#00AEEF" stroke-width="8" stroke-linecap="round">
+          <path d="M 228.4 399.4 A 39 39 0 0 1 283.6 399.4"/>
+          <path d="M 236.9 407.9 A 27 27 0 0 1 275.1 407.9"/>
+          <path d="M 245.4 416.4 A 15 15 0 0 1 266.6 416.4"/>
+        </g>
+        <circle id="wifi-dot" cx="256" cy="427" r="6.5" fill="#00AEEF"/>
+        <!-- Paper-input slot with phone -->
+        <rect id="input-slot" x="184" y="207" width="144" height="22" rx="11" fill="#FFFFFF"/>
+        <g id="phone">
+          <rect x="204" y="67" width="104" height="160" rx="26" fill="#E6007E"/>
+          <rect x="216" y="81" width="80" height="112" rx="13" fill="#FFFFFF"/>
+          <rect x="236" y="207" width="40" height="6" rx="3" fill="#FFFFFF"/>
+        </g>
+        <rect id="input-slot-lip" x="184" y="221" width="144" height="8" fill="#24272E"/>
+        <!-- Status LED -->
+        <circle id="led" cx="350" cy="267" r="9" fill="#00AEEF"/>
+      </g>
+    </g>
+
+    <!-- Wordmark -->
+    <text id="wordmark" x="190" y="120" font-family="'Segoe UI', -apple-system, 'Helvetica Neue', Arial, sans-serif" font-size="56" font-weight="600" letter-spacing="-0.5"><tspan fill="#F0F2F5">Printer</tspan><tspan fill="#E6007E">Service</tspan></text>
+
+  </g>
+</svg>
diff --git a/docs/logo/printerservice-logo.svg b/docs/logo/printerservice-logo.svg
new file mode 100644
index 0000000..462406e
--- /dev/null
+++ b/docs/logo/printerservice-logo.svg
@@ -0,0 +1,48 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 582 200" width="582" height="200" role="img" aria-labelledby="psw-title psw-desc">
+  <title id="psw-title">PrinterService</title>
+  <desc id="psw-desc">PrinterService wordmark: a smartphone feeding into a printer that prints a page carrying a Wi-Fi symbol.</desc>
+
+  <!--
+    PrinterService horizontal lockup (icon + wordmark)
+    Uses the same mark as printerservice-icon.svg.
+    Palette (CMYK-inspired):
+      Cyan    #00AEEF  wireless / status
+      Magenta #E6007E  phone + "Service"
+      Yellow  #FFD84D  printed page
+      Dark    #24272E  printer body + "Printer"
+  -->
+  <g id="lockup">
+
+    <!-- Mark -->
+    <g transform="translate(20 28) scale(0.28)">
+      <g id="printerservice-mark" transform="translate(256 256) scale(1.15) translate(-256 -256)">
+        <!-- Printer body -->
+        <rect id="body" x="112" y="197" width="288" height="174" rx="30" fill="#24272E"/>
+        <!-- Output page emerging from the front slot -->
+        <rect id="page" x="194" y="325" width="124" height="120" rx="10" fill="#FFD84D" stroke="#1A1C20" stroke-width="9"/>
+        <rect id="output-slot" x="188" y="319" width="136" height="14" rx="7" fill="#FFFFFF"/>
+        <!-- Wi-Fi symbol printed on the page -->
+        <g id="wifi" fill="none" stroke="#00AEEF" stroke-width="8" stroke-linecap="round">
+          <path d="M 228.4 399.4 A 39 39 0 0 1 283.6 399.4"/>
+          <path d="M 236.9 407.9 A 27 27 0 0 1 275.1 407.9"/>
+          <path d="M 245.4 416.4 A 15 15 0 0 1 266.6 416.4"/>
+        </g>
+        <circle id="wifi-dot" cx="256" cy="427" r="6.5" fill="#00AEEF"/>
+        <!-- Paper-input slot with phone -->
+        <rect id="input-slot" x="184" y="207" width="144" height="22" rx="11" fill="#FFFFFF"/>
+        <g id="phone">
+          <rect x="204" y="67" width="104" height="160" rx="26" fill="#E6007E"/>
+          <rect x="216" y="81" width="80" height="112" rx="13" fill="#FFFFFF"/>
+          <rect x="236" y="207" width="40" height="6" rx="3" fill="#FFFFFF"/>
+        </g>
+        <rect id="input-slot-lip" x="184" y="221" width="144" height="8" fill="#24272E"/>
+        <!-- Status LED -->
+        <circle id="led" cx="350" cy="267" r="9" fill="#00AEEF"/>
+      </g>
+    </g>
+
+    <!-- Wordmark -->
+    <text id="wordmark" x="190" y="120" font-family="'Segoe UI', -apple-system, 'Helvetica Neue', Arial, sans-serif" font-size="56" font-weight="600" letter-spacing="-0.5"><tspan fill="#24272E">Printer</tspan><tspan fill="#E6007E">Service</tspan></text>
+
+  </g>
+</svg>
diff --git a/requirements.txt b/requirements.txt
index d6d4685..17dcc66 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -7,3 +7,11 @@ python-multipart>=0.0.9
 
 # Windows printing API (README Section 4) — Windows only
 pywin32>=306; sys_platform == "win32"
+
+# Image processing (Phase 2, multi-format plan): converts JPG/PNG/WebP into
+# print-ready PDF pages. 10.3+ has the image-parsing security fixes.
+pillow>=10.3
+
+# Text/CSV rendering (Phase 4, multi-format plan): authors PDF pages for
+# TXT (monospace, wrapped) and CSV (bordered grid).
+reportlab>=4.0
diff --git a/spike_t5_images.py b/spike_t5_images.py
new file mode 100644
index 0000000..6d07405
--- /dev/null
+++ b/spike_t5_images.py
@@ -0,0 +1,223 @@
+"""
+spike_t5_images.py — Image Printing Spike (docs/MULTI_FORMAT_PLAN.md §14, T5)
+
+Run this ON the print-server PC, from the project root:
+
+    .venv\\Scripts\\pip install pillow
+    .venv\\Scripts\\python spike_t5_images.py [--paper A4]
+
+Uses the service's REAL image processor (app/processors/images.py) to
+convert generated test images into PDFs, then prints them via SumatraPDF
+exactly like the service does, timing each step:
+
+  1. JPEG — photo-like gradient          (portrait page)
+  2. PNG  — with transparency            (corners must print WHITE, not black)
+  3. WebP — the modern web format
+  4. JPEG — with EXIF rotation           (must come out upright, matching #1)
+
+With --paper A4|letter|legal|a5|a3, one extra copy of image 1 is printed
+with -print-settings "paper=<X>,fit" to check the Epson driver honors the
+paper size (plan assumption #3) BEFORE setting PAPER_SIZE in .env.
+
+PASS criteria — judge the PAPER (the script cannot see it):
+  [ ] every page upright, nothing clipped, even white margins
+  [ ] image 2's corners white, not black
+  [ ] image 4 upright (EXIF respected — same orientation as image 1)
+  [ ] --paper copy actually matches the requested paper size
+Record the summary in SOURCE_OF_TRUTH Section 5, like the T4 entry.
+"""
+
+import argparse
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+from pathlib import Path
+
+LINE = "=" * 64
+
+
+def banner(text: str) -> None:
+    print("\n" + LINE)
+    print(text)
+    print(LINE)
+
+
+def find_printer() -> str:
+    """Prefer the L3210 by name, fall back to the Windows default."""
+    import win32print
+
+    flags = win32print.PRINTER_ENUM_LOCAL | win32print.PRINTER_ENUM_CONNECTIONS
+    names = sorted(p[2] for p in win32print.EnumPrinters(flags))
+    if not names:
+        raise RuntimeError("No printers found — is the Epson installed on this PC?")
+    for name in names:
+        if "L3210" in name:
+            return name
+    return names[0]
+
+
+def make_test_images(folder: Path) -> list[tuple[str, Path]]:
+    """Generate the four spike images (no binary fixtures in the repo)."""
+    from PIL import Image, ImageDraw
+
+    # A smooth color gradient, built small and resized (fast, looks like a
+    # photo's tonal range on paper).
+    small = Image.new("RGB", (12, 16))
+    for y in range(16):
+        for x in range(12):
+            small.putpixel((x, y), (x * 255 // 11, y * 255 // 15, 128))
+    gradient = small.resize((1200, 1600), Image.Resampling.LANCZOS)
+
+    out: list[tuple[str, Path]] = []
+
+    path = folder / "t5_1_gradient.jpg"
+    gradient.save(path, quality=90)
+    out.append(("1 JPEG gradient (portrait)", path))
+
+    # Transparent background + opaque circle: the corners must print WHITE.
+    rgba = Image.new("RGBA", (800, 800), (255, 0, 0, 0))
+    draw = ImageDraw.Draw(rgba)
+    draw.ellipse((100, 100, 700, 700), fill=(0, 0, 255, 255))
+    path = folder / "t5_2_alpha.png"
+    rgba.save(path)
+    out.append(("2 PNG with transparency", path))
+
+    path = folder / "t5_3_modern.webp"
+    gradient.save(path, quality=90)
+    out.append(("3 WebP", path))
+
+    # Same gradient WITH an EXIF orientation tag: must print like image 1,
+    # not rotated 90°.
+    exif = Image.Exif()
+    exif[274] = 6  # orientation: rotate 90° to display upright
+    path = folder / "t5_4_exif.jpg"
+    gradient.save(path, quality=90, exif=exif)
+    out.append(("4 JPEG with EXIF rotation", path))
+
+    return out
+
+
+def print_pdf(
+    sumatra: str, pdf_path: Path, printer_name: str, settings: str | None = None
+) -> None:
+    """The service's exact print invocation (see app/printer/windows.py)."""
+    cmd = [sumatra, "-print-to", printer_name]
+    if settings:
+        cmd += ["-print-settings", settings]
+    cmd += ["-silent", str(pdf_path)]
+    result = subprocess.run(cmd, capture_output=True, timeout=180)
+    if result.returncode != 0:
+        raise RuntimeError(
+            f"SumatraPDF exited with code {result.returncode}: "
+            f"{result.stderr.decode(errors='replace').strip()}"
+        )
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--paper",
+        choices=["a4", "letter", "legal", "a5", "a3", "long-bond"],
+        type=str.lower,
+        help="also print one copy with -print-settings paper=<X>,fit",
+    )
+    args = parser.parse_args()
+
+    banner("T5 IMAGE SPIKE — run this ON the PC the printer is plugged into")
+
+    try:
+        from app.printer.windows import find_sumatra
+        from app.processors.images import ImageProcessor
+    except ImportError as exc:
+        print(f"Cannot import the app ({exc}). Run from the project root:")
+        print("    .venv\\Scripts\\python spike_t5_images.py")
+        return 1
+
+    try:
+        import win32print  # noqa: F401  (pywin32 presence check, like T1)
+    except ImportError:
+        print("pywin32 is not installed here:  pip install pywin32")
+        return 1
+
+    printer_name = find_printer()
+    sumatra = find_sumatra()
+    if not sumatra:
+        print("SumatraPDF not found — install it or set SUMATRA_PATH in .env")
+        return 1
+
+    print(f"\nPrinter:  {printer_name}")
+    print(f"Sumatra:  {sumatra}")
+    print("\n>>> Keep paper loaded and watch the physical printer.")
+    input("Press Enter when ready...")
+
+    processor = ImageProcessor()
+    temp_dir = Path(tempfile.mkdtemp(prefix="spike_t5_"))
+    results: list[tuple[str, str, str]] = []
+    try:
+        for name, image_path in make_test_images(temp_dir):
+            try:
+                started = time.perf_counter()
+                pdf_path = processor.process(image_path, temp_dir)
+                seconds = time.perf_counter() - started
+                print_pdf(sumatra, pdf_path, printer_name)
+                results.append(
+                    (
+                        f"T5 {name}",
+                        "PASS",
+                        f"converted in {seconds:.2f}s, print accepted — CHECK PAPER",
+                    )
+                )
+            except Exception as exc:
+                results.append((f"T5 {name}", "FAIL", str(exc)))
+
+        if args.paper:
+            try:
+                pdf_path = processor.process(temp_dir / "t5_1_gradient.jpg", temp_dir)
+                # long-bond (8.5×13") goes as Sumatra's custom mm size —
+                # the exact token the service's print-settings builder uses.
+                settings_token = (
+                    "paper=215.9mm x 330.2mm"
+                    if args.paper == "long-bond"
+                    else f"paper={args.paper}"
+                )
+                print_pdf(
+                    sumatra, pdf_path, printer_name, settings_token + ",fit"
+                )
+                results.append(
+                    (
+                        f"T5 paper={args.paper} via -print-settings",
+                        "PASS",
+                        "print accepted — verify the paper size matches on paper",
+                    )
+                )
+            except Exception as exc:
+                results.append(
+                    (f"T5 paper={args.paper} via -print-settings", "FAIL", str(exc))
+                )
+    finally:
+        shutil.rmtree(temp_dir, ignore_errors=True)
+
+    banner("SUMMARY")
+    for name, status, detail in results:
+        print(f"[{status:4}] {name}: {detail}")
+
+    print(
+        "\nNow judge the paper:\n"
+        "  [ ] all pages upright, nothing clipped, even white margins\n"
+        "  [ ] image 2's corners WHITE (black = alpha flattening bug)\n"
+        "  [ ] image 4 upright, same orientation as image 1 (EXIF works)\n"
+        + (
+            f"  [ ] --paper {args.paper} copy really is {args.paper} size\n"
+            if args.paper
+            else ""
+        )
+        + "\nRecord the results in SOURCE_OF_TRUTH Section 5 (like the T4 entry) —\n"
+        "they are the Phase 2 acceptance gate (docs/MULTI_FORMAT_PLAN.md §14)."
+    )
+    return 0 if all(r[1] == "PASS" for r in results) else 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/spike_t6_office.py b/spike_t6_office.py
new file mode 100644
index 0000000..76f075d
--- /dev/null
+++ b/spike_t6_office.py
@@ -0,0 +1,210 @@
+"""
+spike_t6_office.py — Office Printing Spike (docs/MULTI_FORMAT_PLAN.md §14, T6)
+
+Run this ON the print-server PC, from the project root, AFTER installing
+LibreOffice (https://www.libreoffice.org, or: winget install TheDocumentFoundation.LibreOffice):
+
+    .venv\\Scripts\\pip install python-docx openpyxl python-pptx
+    .venv\\Scripts\\python spike_t6_office.py
+
+Generates three REAL office documents, converts each with the service's
+real OfficeProcessor (LibreOffice headless — the exact production path,
+including its timeout and fresh-profile handling), prints the PDFs via
+SumatraPDF, and times every conversion:
+
+  1. DOCX — a table-heavy document (a 12x4 bordered table + headings)
+  2. XLSX — a spreadsheet with a defined PRINT AREA + landscape page setup
+  3. PPTX — a 16:9 deck (2 slides, landscape)
+
+PASS criteria — judge the PAPER (the script cannot see it):
+  [ ] DOCX: table fits the page width, borders visible, no cut columns
+  [ ] XLSX: ONLY the print area prints, in landscape, on one page
+  [ ] PPTX: slides fill the page in landscape (16:9)
+Also note each conversion time — if the machine takes > 30 s per document,
+consider raising CONVERT_TIMEOUT_S in .env.
+Record the summary in SOURCE_OF_TRUTH Section 5, like the T4/T5 entries.
+These results are the Phase 3 acceptance gate.
+"""
+
+import argparse
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+from pathlib import Path
+
+LINE = "=" * 64
+
+
+def banner(text: str) -> None:
+    print("\n" + LINE)
+    print(text)
+    print(LINE)
+
+
+def find_printer() -> str:
+    """Prefer the L3210 by name, fall back to the Windows default."""
+    import win32print
+
+    flags = win32print.PRINTER_ENUM_LOCAL | win32print.PRINTER_ENUM_CONNECTIONS
+    names = sorted(p[2] for p in win32print.EnumPrinters(flags))
+    if not names:
+        raise RuntimeError("No printers found — is the Epson installed on this PC?")
+    for name in names:
+        if "L3210" in name:
+            return name
+    return names[0]
+
+
+def make_test_documents(folder: Path) -> list[tuple[str, Path]]:
+    """Generate the three spike documents with the python-* helper libs."""
+    out: list[tuple[str, Path]] = []
+
+    # 1. DOCX — table-heavy (the documented DOCX quality check).
+    import docx
+
+    doc = docx.Document()
+    doc.add_heading("T6 office spike — table layout check", 1)
+    doc.add_paragraph(
+        "If this table fits the page width with visible borders and no cut "
+        "columns, DOCX table conversion works on this machine."
+    )
+    table = doc.add_table(rows=12, cols=4)
+    table.style = "Table Grid"
+    for row in range(12):
+        for col in range(4):
+            table.cell(row, col).text = f"r{row + 1}c{col + 1} — some cell content"
+    path = folder / "t6_1_table.docx"
+    doc.save(path)
+    out.append(("1 DOCX table-heavy", path))
+
+    # 2. XLSX — print area + landscape (the documented XLSX quality check:
+    #    ONLY the print area may come out of the printer, in landscape).
+    import openpyxl
+
+    workbook = openpyxl.Workbook()
+    sheet = workbook.active
+    sheet.title = "Spike"
+    for row in range(1, 21):
+        for col in range(1, 5):
+            sheet.cell(row=row, column=col, value=f"cell r{row}c{col}")
+    sheet.cell(row=1, column=6, value="OUTSIDE the print area — must NOT print")
+    sheet.print_area = "A1:D20"
+    sheet.page_setup.orientation = "landscape"
+    path = folder / "t6_2_printarea.xlsx"
+    workbook.save(path)
+    out.append(("2 XLSX with print area", path))
+
+    # 3. PPTX — 16:9 deck (slide size should drive a landscape PDF page).
+    from pptx import Presentation
+    from pptx.util import Inches
+
+    deck = Presentation()
+    deck.slide_width = Inches(13.333)
+    deck.slide_height = Inches(7.5)
+    for number in (1, 2):
+        slide = deck.slides.add_slide(deck.slide_layouts[6])  # blank layout
+        box = slide.shapes.add_textbox(Inches(1), Inches(3), Inches(11), Inches(1.5))
+        box.text_frame.text = f"T6 office spike — slide {number} of 2 (16:9)"
+    path = folder / "t6_3_deck.pptx"
+    deck.save(path)
+    out.append(("3 PPTX 16:9 deck", path))
+
+    return out
+
+
+def print_pdf(sumatra: str, pdf_path: Path, printer_name: str) -> None:
+    """The service's exact print invocation (see app/printer/windows.py)."""
+    result = subprocess.run(
+        [sumatra, "-print-to", printer_name, "-silent", str(pdf_path)],
+        capture_output=True,
+        timeout=180,
+    )
+    if result.returncode != 0:
+        raise RuntimeError(
+            f"SumatraPDF exited with code {result.returncode}: "
+            f"{result.stderr.decode(errors='replace').strip()}"
+        )
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.parse_args()
+
+    banner("T6 OFFICE SPIKE — run this ON the PC the printer is plugged into")
+
+    try:
+        from app.printer.windows import find_sumatra
+        from app.processors.office import OfficeProcessor, find_soffice
+    except ImportError as exc:
+        print(f"Cannot import the app ({exc}). Run from the project root:")
+        print("    .venv\\Scripts\\python spike_t6_office.py")
+        return 1
+
+    try:
+        import win32print  # noqa: F401  (pywin32 presence check, like T1)
+    except ImportError:
+        print("pywin32 is not installed here:  pip install pywin32")
+        return 1
+
+    processor = OfficeProcessor()
+    if not processor.available():
+        print(
+            "Office conversion is NOT available on this machine:\n"
+            "  - install LibreOffice (winget install TheDocumentFoundation.LibreOffice)\n"
+            "  - and/or set ENABLE_OFFICE=1 / LO_PATH in .env\n"
+            f"  find_soffice() -> {find_soffice()!r}, ENABLE_OFFICE from .env"
+        )
+        return 1
+
+    printer_name = find_printer()
+    sumatra = find_sumatra()
+    if not sumatra:
+        print("SumatraPDF not found — install it or set SUMATRA_PATH in .env")
+        return 1
+
+    print(f"\nPrinter:    {printer_name}")
+    print(f"Sumatra:    {sumatra}")
+    print(f"LibreOffice: {find_soffice()}")
+    print("\n>>> Keep paper loaded and watch the physical printer.")
+    input("Press Enter when ready...")
+
+    temp_dir = Path(tempfile.mkdtemp(prefix="spike_t6_"))
+    results: list[tuple[str, str, str]] = []
+    try:
+        for name, doc_path in make_test_documents(temp_dir):
+            try:
+                started = time.perf_counter()
+                pdf_path = processor.process(doc_path, temp_dir)
+                seconds = time.perf_counter() - started
+                print_pdf(sumatra, pdf_path, printer_name)
+                results.append(
+                    (
+                        f"T6 {name}",
+                        "PASS",
+                        f"converted in {seconds:.1f}s, print accepted — CHECK PAPER",
+                    )
+                )
+            except Exception as exc:
+                results.append((f"T6 {name}", "FAIL", str(exc)))
+    finally:
+        shutil.rmtree(temp_dir, ignore_errors=True)
+
+    banner("SUMMARY")
+    for name, status, detail in results:
+        print(f"[{status:4}] {name}: {detail}")
+
+    print(
+        "\nNow judge the paper:\n"
+        "  [ ] DOCX table fits the width, borders visible, no cut columns\n"
+        "  [ ] XLSX: ONLY A1:D20 printed (no 'OUTSIDE' cell!), landscape\n"
+        "  [ ] PPTX slides fill the page, landscape (16:9)\n"
+        "\nRecord the results in SOURCE_OF_TRUTH Section 5 (like the T4/T5\n"
+        "entries) — they are the Phase 3 acceptance gate."
+    )
+    return 0 if all(r[1] == "PASS" for r in results) else 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/spike_t7_text.py b/spike_t7_text.py
new file mode 100644
index 0000000..144c1c9
--- /dev/null
+++ b/spike_t7_text.py
@@ -0,0 +1,171 @@
+"""
+spike_t7_text.py — Text/CSV Printing Spike (docs/MULTI_FORMAT_PLAN.md §14, T7)
+
+Run this ON the print-server PC, from the project root:
+
+    .venv\\Scripts\\python spike_t7_text.py
+
+(No extra installs — reportlab ships in requirements.txt.)
+
+Generates a TXT and a CSV, converts each with the service's REAL
+TextProcessor (reportlab — the exact production path), prints the PDFs via
+SumatraPDF, and reports page counts:
+
+  1. TXT — paragraphs + lines much longer than the page width
+           (word-wrap must keep everything inside the margins)
+  2. CSV — 40 rows x 6 columns with quoted cells containing commas
+           (grid must stay aligned, header repeated on page 2)
+
+PASS criteria — judge the PAPER (the script cannot see it):
+  [ ] TXT: nothing clipped at either margin, no orphan single words
+      making a mess, readable monospace
+  [ ] CSV: all 6 columns visible with borders, nothing cut to "...",
+      header row repeated on every page
+  [ ] conversion was instant (text should print with no wait at all)
+Record the summary in SOURCE_OF_TRUTH Section 5, like the T4/T5/T6
+entries. These results are the Phase 4 acceptance gate — the last one
+before the whole MVP format set is verified on real paper.
+"""
+
+import argparse
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+LINE = "=" * 64
+
+
+def banner(text: str) -> None:
+    print("\n" + LINE)
+    print(text)
+    print(LINE)
+
+
+def find_printer() -> str:
+    """Prefer the L3210 by name, fall back to the Windows default."""
+    import win32print
+
+    flags = win32print.PRINTER_ENUM_LOCAL | win32print.PRINTER_ENUM_CONNECTIONS
+    names = sorted(p[2] for p in win32print.EnumPrinters(flags))
+    if not names:
+        raise RuntimeError("No printers found — is the Epson installed on this PC?")
+    for name in names:
+        if "L3210" in name:
+            return name
+    return names[0]
+
+
+def make_test_files(folder: Path) -> list[tuple[str, Path]]:
+    out: list[tuple[str, Path]] = []
+
+    # 1. TXT — short lines, plus lines far wider than the page (the wrap
+    #    check), plus an empty-line rhythm.
+    prose = [
+        "T7 text spike — TXT rendering check",
+        "",
+        "The next line is a single unbroken stream far wider than the page:",
+        "word " * 60,
+        "Then normal paragraphs resume. " * 3,
+        "Final line of page one, hopefully.",
+        "",
+    ] * 15
+    path = folder / "t7_1_notes.txt"
+    path.write_text("\n".join(prose), encoding="utf-8")
+    out.append(("1 TXT (wrap + pagination)", path))
+
+    # 2. CSV — quoted cells containing commas, 40 rows x 6 columns (multi-
+    #    page grid with a repeated header).
+    rows = ["item,qty,unit price,location,checked by,remark"]
+    for number in range(1, 41):
+        rows.append(
+            f'"widget {number}, type A",{number},9.99,shelf {number % 7},'
+            f'"crew, night shift",ok'
+        )
+    path = folder / "t7_2_inventory.csv"
+    path.write_text("\n".join(rows), encoding="utf-8")
+    out.append(("2 CSV (40x6 grid, quoted cells)", path))
+
+    return out
+
+
+def print_pdf(sumatra: str, pdf_path: Path, printer_name: str) -> None:
+    """The service's exact print invocation (see app/printer/windows.py)."""
+    result = subprocess.run(
+        [sumatra, "-print-to", printer_name, "-silent", str(pdf_path)],
+        capture_output=True,
+        timeout=180,
+    )
+    if result.returncode != 0:
+        raise RuntimeError(
+            f"SumatraPDF exited with code {result.returncode}: "
+            f"{result.stderr.decode(errors='replace').strip()}"
+        )
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.parse_args()
+
+    banner("T7 TEXT SPIKE — run this ON the PC the printer is plugged into")
+
+    try:
+        from app.printer.windows import find_sumatra
+        from app.processors.text import TextProcessor
+    except ImportError as exc:
+        print(f"Cannot import the app ({exc}). Run from the project root:")
+        print("    .venv\\Scripts\\python spike_t7_text.py")
+        return 1
+
+    try:
+        import win32print  # noqa: F401  (pywin32 presence check, like T1)
+    except ImportError:
+        print("pywin32 is not installed here:  pip install pywin32")
+        return 1
+
+    printer_name = find_printer()
+    sumatra = find_sumatra()
+    if not sumatra:
+        print("SumatraPDF not found — install it or set SUMATRA_PATH in .env")
+        return 1
+
+    print(f"\nPrinter:  {printer_name}")
+    print(f"Sumatra:  {sumatra}")
+    print("\n>>> Keep paper loaded and watch the physical printer.")
+    input("Press Enter when ready...")
+
+    processor = TextProcessor()
+    temp_dir = Path(tempfile.mkdtemp(prefix="spike_t7_"))
+    results: list[tuple[str, str, str]] = []
+    try:
+        for name, file_path in make_test_files(temp_dir):
+            try:
+                pdf_path = processor.process(file_path, temp_dir)
+                print_pdf(sumatra, pdf_path, printer_name)
+                results.append(
+                    (f"T7 {name}", "PASS", "print accepted — CHECK PAPER")
+                )
+            except Exception as exc:
+                results.append((f"T7 {name}", "FAIL", str(exc)))
+    finally:
+        shutil.rmtree(temp_dir, ignore_errors=True)
+
+    banner("SUMMARY")
+    for name, status, detail in results:
+        print(f"[{status:4}] {name}: {detail}")
+
+    print(
+        "\nNow judge the paper:\n"
+        "  [ ] TXT: nothing clipped at either margin; wrapping is clean\n"
+        "  [ ] CSV: all 6 columns visible, borders drawn, no '...' cuts\n"
+        "  [ ] CSV: header row repeated on page 2\n"
+        "\nRecord the results in SOURCE_OF_TRUTH Section 5 (like the T4/T5/T6\n"
+        "entries) — they are the Phase 4 acceptance gate. With this pass, the\n"
+        "whole MVP format set is verified on real paper."
+    )
+    return 0 if all(r[1] == "PASS" for r in results) else 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/api/test_health_web.py b/tests/api/test_health_web.py
index ddf055d..e750df1 100644
--- a/tests/api/test_health_web.py
+++ b/tests/api/test_health_web.py
@@ -31,3 +31,17 @@ def test_page_has_upload_form_and_print_button(self, client):
         assert 'type="file"' in page  # the PDF picker
         assert ">Print<" in page  # the button that POSTs /print
         assert "/print" in page  # the endpoint the page's JS calls
+        assert 'href="/favicon.svg"' in page
+
+    def test_favicon_svg_served(self, client):
+        response = client.get("/favicon.svg")
+        assert response.status_code == 200
+        assert "image/svg+xml" in response.headers["content-type"]
+        assert "<svg" in response.text
+
+    def test_favicon_ico_served(self, client):
+        response = client.get("/favicon.ico")
+        assert response.status_code == 200
+        assert "image/svg+xml" in response.headers["content-type"]
+        assert "<svg" in response.text
+
diff --git a/tests/api/test_jobs_api.py b/tests/api/test_jobs_api.py
index 9526e2d..25a541f 100644
--- a/tests/api/test_jobs_api.py
+++ b/tests/api/test_jobs_api.py
@@ -69,6 +69,23 @@ def test_cancelling_a_printed_job_conflicts_409(self, client, tmp_upload_dir):
     def test_cancelling_unknown_job_404(self, client):
         assert client.delete("/jobs/ghost").status_code == 404
 
+    def test_cancelling_while_printing_purges_the_spooler(
+        self, client, tmp_upload_dir, fake_win32print
+    ):
+        # p14: a printing-stage cancel is best-effort — our queued spooler
+        # jobs are purged, the job is marked cancelled either way.
+        seed_job(tmp_upload_dir, "abc123")
+        jobs.update_status("abc123", JobStatus.PRINTING)
+        fake_win32print._spooler_jobs = [{"JobId": 42, "pDocument": "abc123.pdf"}]
+
+        response = client.delete("/jobs/abc123")
+
+        assert response.status_code == 200
+        assert response.json()["status"] == JobStatus.CANCELLED
+        assert fake_win32print.setjob_calls == [
+            ("handle:EPSON L3210 Series", 42, fake_win32print.JOB_CONTROL_DELETE)
+        ]
+
     def test_pin_enforced_on_cancel_when_configured(self, client, tmp_upload_dir, monkeypatch):
         monkeypatch.setattr("app.services.auth.API_PIN", "1234")
         seed_job(tmp_upload_dir, "abc123")
@@ -80,3 +97,74 @@ def test_pin_enforced_on_cancel_when_configured(self, client, tmp_upload_dir, mo
         assert no_header.status_code == 401
         assert wrong_pin.status_code == 401
         assert correct.status_code == 200
+
+
+class TestRetryJob:
+    def test_requeues_a_failed_job_from_its_stored_upload(
+        self, client, tmp_upload_dir, mock_print, wait_for_status
+    ):
+        seed_job(tmp_upload_dir, "abc123")
+        jobs.update_status("abc123", JobStatus.FAILED, error="printer offline")
+
+        response = client.post("/jobs/abc123/retry")
+
+        assert response.status_code == 200
+        assert response.json()["status"] == JobStatus.QUEUED
+
+        job = wait_for_status("abc123", JobStatus.DONE)
+        assert job.error is None  # the retry started clean and succeeded
+
+    def test_retry_reuses_the_original_print_options(
+        self, client, tmp_upload_dir, mock_print, wait_for_status
+    ):
+        src = tmp_upload_dir / "abc123.pdf"
+        src.write_bytes(b"%PDF-1.4 x")
+        options = {
+            "copies": 2,
+            "pages": "",
+            "paper": "a4",
+            "color_mode": "monochrome",
+        }
+        jobs.create_job("abc123", "file.pdf", 9, src, format="pdf", options=options)
+        jobs.update_status("abc123", JobStatus.FAILED, error="printer offline")
+
+        response = client.post("/jobs/abc123/retry")
+
+        assert response.status_code == 200
+        wait_for_status("abc123", JobStatus.DONE)
+        assert mock_print.options == options  # the retry prints like the original
+
+    def test_retry_unknown_job_404(self, client):
+        assert client.post("/jobs/ghost/retry").status_code == 404
+
+    def test_retry_refused_for_non_failed_jobs(self, client, tmp_upload_dir):
+        seed_job(tmp_upload_dir, "abc123")  # still just 'received'
+
+        response = client.post("/jobs/abc123/retry")
+
+        assert response.status_code == 409
+        assert "only failed jobs" in response.json()["detail"]
+
+    def test_retry_refused_when_the_upload_is_gone(self, client, tmp_upload_dir):
+        seed_job(tmp_upload_dir, "abc123", pdf=False)  # no file on disk
+        jobs.update_status("abc123", JobStatus.FAILED, error="printer offline")
+
+        response = client.post("/jobs/abc123/retry")
+
+        assert response.status_code == 409
+        assert "gone" in response.json()["detail"]
+
+    def test_pin_enforced_on_retry_when_configured(
+        self, client, tmp_upload_dir, monkeypatch, mock_print
+    ):
+        monkeypatch.setattr("app.services.auth.API_PIN", "1234")
+        seed_job(tmp_upload_dir, "abc123")
+        jobs.update_status("abc123", JobStatus.FAILED, error="x")
+
+        no_header = client.post("/jobs/abc123/retry")
+        wrong_pin = client.post("/jobs/abc123/retry", headers={"X-API-PIN": "0000"})
+        correct = client.post("/jobs/abc123/retry", headers={"X-API-PIN": "1234"})
+
+        assert no_header.status_code == 401
+        assert wrong_pin.status_code == 401
+        assert correct.status_code == 200
diff --git a/tests/api/test_print_api.py b/tests/api/test_print_api.py
index 2973187..7636289 100644
--- a/tests/api/test_print_api.py
+++ b/tests/api/test_print_api.py
@@ -7,6 +7,10 @@
 Event it signals.
 """
 
+import zipfile
+from io import BytesIO
+
+from PIL import Image
 
 ONE_MB = 1024 * 1024
 
@@ -16,6 +20,21 @@ def post_pdf(client, data, name="report.pdf", **kwargs):
     return client.post("/print", files=files, **kwargs)
 
 
+def make_png_bytes():
+    """A tiny real PNG, generated by Pillow (no binary fixtures in the repo)."""
+    buffer = BytesIO()
+    Image.new("RGB", (8, 8), (200, 30, 30)).save(buffer, "PNG")
+    return buffer.getvalue()
+
+
+def make_docx_bytes():
+    """The smallest ZIP detection treats as a DOCX (a word/ part inside)."""
+    buffer = BytesIO()
+    with zipfile.ZipFile(buffer, "w") as archive:
+        archive.writestr("word/document.xml", b"<xml/>")
+    return buffer.getvalue()
+
+
 class TestPrintHappyPath:
     def test_upload_returns_201_with_queued_job(self, client, pdf_bytes, mock_print):
         response = post_pdf(client, pdf_bytes)
@@ -41,6 +60,93 @@ def test_job_reaches_done_and_temp_file_is_deleted(
             message="printed job's temp file should be deleted",
         )
 
+    def test_png_upload_prints_via_the_image_processor(
+        self, client, mock_print, tmp_upload_dir, wait_for_status, wait_until
+    ):
+        response = client.post(
+            "/print", files={"file": ("shot.png", make_png_bytes(), "image/png")}
+        )
+
+        assert response.status_code == 201
+        job_id = response.json()["job_id"]
+
+        job = wait_for_status(job_id, "done")
+        assert job.format == "image"
+
+        # The engine only ever sees a PDF (the converted page), never raw
+        # image bytes — and it is named <job_id>.pdf so cleanup finds it.
+        assert mock_print.pdf_path.suffix == ".pdf"
+        assert mock_print.pdf_path.stem == job_id
+
+        # Both the source upload and the converted page are cleaned up.
+        wait_until(
+            lambda: not list(tmp_upload_dir.glob(f"{job_id}.*")),
+            message="image job's temp files should be deleted",
+        )
+
+    def test_docx_upload_prints_via_the_office_processor(
+        self, client, mock_print, monkeypatch, tmp_upload_dir, wait_for_status, wait_until
+    ):
+        # LibreOffice itself is never run in tests (external executable):
+        # available() is patched on and process() fakes the conversion,
+        # exactly the seam spike T6 covers on real hardware.
+        monkeypatch.setattr(
+            "app.processors.office.OfficeProcessor.available", lambda self: True
+        )
+
+        def fake_convert(self, src, out_dir):
+            pdf = out_dir / f"{src.stem}.pdf"
+            pdf.write_bytes(b"%PDF- converted by (mocked) LibreOffice")
+            return pdf
+
+        monkeypatch.setattr(
+            "app.processors.office.OfficeProcessor.process", fake_convert
+        )
+
+        response = client.post(
+            "/print", files={"file": ("invoice.docx", make_docx_bytes(), "application/zip")}
+        )
+
+        assert response.status_code == 201
+        job_id = response.json()["job_id"]
+
+        job = wait_for_status(job_id, "done")
+        assert job.format == "office"
+        assert mock_print.pdf_path.suffix == ".pdf"  # engine only ever sees PDF
+        assert mock_print.pdf_path.stem == job_id
+
+        wait_until(
+            lambda: not list(tmp_upload_dir.glob(f"{job_id}.*")),
+            message="office job's temp files should be deleted",
+        )
+
+    def test_txt_upload_prints_via_the_real_text_renderer(
+        self, client, mock_print, tmp_upload_dir, wait_for_status, wait_until
+    ):
+        # No mocking needed: reportlab is a Python library, so this runs
+        # the REAL conversion inside the API flow.
+        content = "hello from the phone\nline two with more text\n" * 10
+        response = client.post(
+            "/print", files={"file": ("notes.txt", content.encode(), "text/plain")}
+        )
+
+        assert response.status_code == 201
+        job_id = response.json()["job_id"]
+
+        job = wait_for_status(job_id, "done")
+        assert job.format == "text"
+
+        # The engine only ever sees a PDF named <job_id>.pdf. Its CONTENT
+        # can't be read here — cleanup deletes it right after "done" — the
+        # unit tests assert the rendered bytes.
+        assert mock_print.pdf_path.suffix == ".pdf"
+        assert mock_print.pdf_path.name == f"{job_id}.pdf"
+
+        wait_until(
+            lambda: not list(tmp_upload_dir.glob(f"{job_id}.*")),
+            message="text job's temp files should be deleted",
+        )
+
 
 class TestPrintRejections:
     """Section 13 test #8 — bad files must be refused before printing."""
@@ -66,10 +172,76 @@ def test_rejected_files_never_reach_the_store(self, client, mock_print, tmp_uplo
         assert mock_print.called.is_set() is False  # no print attempted
         assert list(tmp_upload_dir.glob("*.pdf")) == []  # nothing stored
 
+    def test_unsupported_image_type_rejected_with_415(self, client, mock_print):
+        # HEIC (iPhone photos) is a Phase-2 rejection: detected as unknown
+        # extension, refused with the "what IS supported" message.
+        response = client.post(
+            "/print", files={"file": ("photo.heic", b"whatever", "image/heic")}
+        )
+        assert response.status_code == 415
+        assert "pdf" in response.json()["detail"].lower()
+
+
+    def test_print_options_reach_the_pipeline(
+        self, client, pdf_bytes, mock_print, wait_for_status
+    ):
+        response = client.post(
+            "/print",
+            files={"file": ("report.pdf", pdf_bytes, "application/pdf")},
+            data={
+                "copies": "2",
+                "pages": "1-3",
+                "paper": "a4",
+                "color_mode": "monochrome",
+            },
+        )
+
+        assert response.status_code == 201
+        job_id = response.json()["job_id"]
+        wait_for_status(job_id, "done")
+
+        assert mock_print.options == {
+            "copies": 2,
+            "pages": "1-3",
+            "paper": "a4",
+            "color_mode": "monochrome",
+        }
+
+    def test_defaults_store_safe_print_options(
+        self, client, pdf_bytes, mock_print, wait_for_status
+    ):
+        job_id = post_pdf(client, pdf_bytes).json()["job_id"]
+        wait_for_status(job_id, "done")
+
+        # No options sent → the defaults, which build NO print-settings —
+        # the exact command spike T4 proved on real paper.
+        assert mock_print.options == {
+            "copies": 1,
+            "pages": "",
+            "paper": "",
+            "color_mode": "color",
+        }
+
+    def test_invalid_print_options_rejected_with_422(self, client, pdf_bytes, mock_print):
+        for bad_data in (
+            {"copies": "100"},
+            {"pages": "drop tables"},
+            {"paper": "glossy"},
+            {"color_mode": "sepia"},
+        ):
+            response = client.post(
+                "/print",
+                files={"file": ("report.pdf", pdf_bytes, "application/pdf")},
+                data=bad_data,
+            )
+            assert response.status_code == 422, bad_data
+
+        assert mock_print.called.is_set() is False  # nothing ever printed
+
 
 class TestPrintErrors:
     def test_disk_failure_returns_500(self, client, pdf_bytes, monkeypatch, mock_print):
-        def broken_save(data):
+        def broken_save(data, ext=".pdf"):
             raise OSError("disk full")
 
         monkeypatch.setattr("app.api.print.save_upload", broken_save)
diff --git a/tests/conftest.py b/tests/conftest.py
index 2e5bfd9..5a607bd 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -42,9 +42,15 @@
 
 
 @pytest.fixture(autouse=True)
-def fresh_job_store(monkeypatch):
-    """Empty in-memory job store for every test (Section 12's dict)."""
-    monkeypatch.setattr(jobs, "_jobs", {})
+def fresh_job_store(tmp_path, monkeypatch):
+    """A fresh SQLite job store for every test (Section 12 → p14).
+
+    jobs.py keeps a module-level connection; pointing _db_path at a temp
+    file and dropping the cached connection makes every test start from an
+    empty database — the equivalent of the old fresh dict.
+    """
+    monkeypatch.setattr(jobs, "_db_path", tmp_path / "jobs.sqlite3")
+    monkeypatch.setattr(jobs, "_conn", None)
 
 
 @pytest.fixture(autouse=True)
@@ -103,6 +109,26 @@ def fake_win32print(monkeypatch) -> types.ModuleType:
         ("", "", TEST_PRINTER),
     ]
     fake.GetDefaultPrinter = lambda: TEST_PRINTER
+
+    # Spooler-queue surface for the p14 cancel purge. Tests populate
+    # _spooler_jobs with level-1 dicts (JobId, pDocument) and read
+    # setjob_calls to verify what was purged.
+    fake.JOB_CONTROL_DELETE = 3
+    fake._spooler_jobs = []
+    fake.setjob_calls = []
+    fake.OpenPrinter = lambda name: f"handle:{name}"
+    fake.ClosePrinter = lambda handle: None
+    fake.EnumJobs = lambda handle, first, count, level: list(fake._spooler_jobs)
+
+    def _set_job(handle, job_id, level, info, command):
+        fake.setjob_calls.append((handle, job_id, command))
+
+    fake.SetJob = _set_job
+
+    # Level-2 printer info for the p15 readiness check: a healthy printer
+    # by default (Status 0, no WORK_OFFLINE attribute). Tests override.
+    fake.GetPrinter = lambda handle, level: {"Status": 0, "Attributes": 0}
+
     monkeypatch.setitem(sys.modules, "win32print", fake)
     return fake
 
@@ -121,10 +147,12 @@ def __init__(self):
         self.error: Exception | None = None
         self.pdf_path: Path | None = None
         self.printer_name: str | None = None
+        self.options: dict | None = None
 
-    def __call__(self, pdf_path, printer_name=None):
+    def __call__(self, pdf_path, printer_name=None, options=None):
         self.pdf_path = pdf_path
         self.printer_name = printer_name
+        self.options = options
         self.called.set()
         if self.gate is not None:
             self.gate.wait(timeout=10)
diff --git a/tests/unit/test_detection.py b/tests/unit/test_detection.py
new file mode 100644
index 0000000..efdcd3f
--- /dev/null
+++ b/tests/unit/test_detection.py
@@ -0,0 +1,97 @@
+"""Unit tests for format detection (app/detection.py).
+
+Detection is pure logic — no HTTP, no disk, no status codes — so these
+tests pin its rules:
+  - extension is only a hint (category_for);
+  - magic bytes are the evidence (magic_category);
+  - ZIP/OLE containers are sniffed to confirm they really are office docs;
+  - text has no signature, so it is classified by extension only.
+"""
+
+import io
+import zipfile
+
+import pytest
+
+from app.detection import category_for, magic_category
+
+JPEG = b"\xff\xd8\xff\xe0" + b"\x00" * 8
+PNG = b"\x89PNG\r\n\x1a\n" + b"\x00" * 8
+WEBP = b"RIFF\x24\x00\x00\x00WEBP" + b"\x00" * 4
+OLE = b"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1" + b"\x00" * 8
+ZIP_PLAIN = b"PK\x03\x04" + b"\x00" * 8  # a zip that is not an office document
+RUBBISH = b"definitely not any known format"
+
+
+def build_ooxml(part_prefix: str) -> bytes:
+    """A real (small) zip whose entry names look like an OOXML document."""
+    buffer = io.BytesIO()
+    with zipfile.ZipFile(buffer, "w") as archive:
+        archive.writestr(f"{part_prefix}/document.xml", b"<xml/>")
+    return buffer.getvalue()
+
+
+class TestMagicCategory:
+    def test_pdf_magic(self):
+        assert magic_category(b"%PDF-1.7 trailing bytes") == "pdf"
+
+    def test_jpeg_magic(self):
+        assert magic_category(JPEG) == "image"
+
+    def test_png_magic(self):
+        assert magic_category(PNG) == "image"
+
+    def test_webp_magic_needs_the_riff_subtype(self):
+        assert magic_category(WEBP) == "image"
+        # "RIFF" alone (e.g. a WAV file) is not an image — offset 8 must say WEBP.
+        assert magic_category(b"RIFF\x24\x00\x00\x00WAVE") is None
+        assert magic_category(b"RIFF") is None  # truncated: no decision either way
+
+    def test_ole_magic_is_office(self):
+        assert magic_category(OLE) == "office"
+
+    def test_ooxml_containers_are_office(self):
+        for prefix in ("word", "xl", "ppt"):
+            assert magic_category(build_ooxml(prefix)) == "office"
+
+    def test_odf_mimetype_entry_is_office(self):
+        buffer = io.BytesIO()
+        with zipfile.ZipFile(buffer, "w") as archive:
+            archive.writestr("mimetype", "application/vnd.oasis.opendocument.text")
+        assert magic_category(buffer.getvalue()) == "office"
+
+    def test_plain_zip_is_not_office(self):
+        assert magic_category(ZIP_PLAIN) is None
+
+    def test_corrupt_zip_is_not_office(self):
+        assert magic_category(b"PK\x03\x04this is not really a zip") is None
+
+    def test_rubbish_is_unknown(self):
+        assert magic_category(RUBBISH) is None
+
+    def test_empty_bytes_are_unknown(self):
+        assert magic_category(b"") is None
+
+
+class TestCategoryFor:
+    @pytest.mark.parametrize(
+        ("filename", "expected"),
+        [
+            ("report.pdf", "pdf"),
+            ("REPORT.PDF", "pdf"),
+            ("photo.jpg", "image"),
+            ("photo.JPEG", "image"),
+            ("shot.webp", "image"),
+            ("invoice.docx", "office"),
+            ("sheet.xls", "office"),
+            ("deck.pptx", "office"),
+            ("notes.txt", "text"),
+            ("data.csv", "text"),
+        ],
+    )
+    def test_known_extensions(self, filename, expected):
+        assert category_for(filename) == expected
+
+    @pytest.mark.parametrize("filename", ["virus.exe", "archive.zip", "", "noext"])
+    def test_unknown_or_absent_extensions_return_none(self, filename):
+        assert category_for(filename) is None
diff --git a/tests/unit/test_images.py b/tests/unit/test_images.py
new file mode 100644
index 0000000..8425691
--- /dev/null
+++ b/tests/unit/test_images.py
@@ -0,0 +1,124 @@
+"""Unit tests for the image processor (app/processors/images.py).
+
+The processor composites each frame onto a white page canvas and saves the
+canvas as the PDF page. The geometry is pure math (layout()), so the
+fit/center/orientation rules are asserted exactly; the PDF bytes themselves
+are only checked structurally (%PDF- magic, source untouched) — reading
+pages back would need another PDF library, and the plan says avoid
+unnecessary dependencies. Paper-level quality (transparency white, EXIF
+upright, nothing clipped) is spike T5's job on real hardware.
+"""
+
+import pytest
+from PIL import Image
+
+from app.processors import base as processor_base
+from app.processors import images
+from app.processors.base import ConversionError, page_size_pt
+from app.processors.images import MAX_UPSCALE, ImageProcessor, layout
+
+A4_PT = (595, 842)
+
+
+class TestLayout:
+    def test_portrait_photo_fits_the_printable_area_centered(self):
+        canvas = (round(595 * 300 / 72), round(842 * 300 / 72))  # A4 at 300 DPI
+        (canvas_w, canvas_h), (x, y, box_w, box_h) = layout(3000, 4000, A4_PT)
+
+        assert (canvas_w, canvas_h) == canvas
+        margin = round(36 * 300 / 72)  # 150 px
+        assert box_w <= canvas_w - 2 * margin  # inside the margins
+        assert box_h <= canvas_h - 2 * margin
+        assert abs((canvas_w - box_w) - 2 * x) <= 1  # centered (±1 px rounding)
+        assert abs((canvas_h - box_h) - 2 * y) <= 1
+
+    def test_wide_photo_rotates_the_page_not_the_pixels(self):
+        # A landscape photo gets a landscape canvas — rotating the pixels
+        # would fight EXIF orientation and resample the image a second time.
+        (canvas_w, canvas_h), _ = layout(4000, 3000, A4_PT)
+        assert canvas_w > canvas_h
+
+    def test_small_images_upscale_is_capped(self):
+        # A 200 px thumbnail must not be blown up to full-page blur: the
+        # upscale stops at MAX_UPSCALE (= 300 effective DPI from 96).
+        _, (_, _, box_w, _) = layout(200, 100, A4_PT)
+        assert box_w == round(200 * MAX_UPSCALE)
+
+
+class TestPageSize:
+    def test_empty_and_unknown_config_fall_back_to_a4(self, monkeypatch):
+        for value in ("", "bogus"):
+            monkeypatch.setattr(processor_base, "PAPER_SIZE", value)
+            assert page_size_pt() == (595, 842)
+
+    def test_known_names_are_case_insensitive(self, monkeypatch):
+        monkeypatch.setattr(processor_base, "PAPER_SIZE", "Letter")
+        assert page_size_pt() == (612, 792)
+
+
+class TestPrintable:
+    def test_alpha_is_flattened_onto_white_not_black(self):
+        # Fully transparent red pixels: the printer has no "transparent
+        # paper", so unflattened alpha would print as black.
+        rgba = Image.new("RGBA", (4, 4), (255, 0, 0, 0))
+
+        flat = images._printable(rgba)
+
+        assert flat.mode == "RGB"
+        assert flat.getpixel((0, 0)) == (255, 255, 255)
+
+    def test_exif_orientation_is_applied(self, tmp_path):
+        wide = Image.new("RGB", (20, 10), "red")
+        exif = Image.Exif()
+        exif[274] = 6  # orientation tag: display rotated 90°
+        path = tmp_path / "phone_photo.jpg"
+        wide.save(path, exif=exif)
+
+        with Image.open(path) as img:
+            assert images._printable(img).size == (10, 20)  # dimensions swapped
+
+    def test_plain_rgb_needs_no_flattening(self):
+        assert images._printable(Image.new("RGB", (3, 3), "blue")).mode == "RGB"
+
+
+class TestProcess:
+    def test_jpeg_becomes_a_pdf_next_to_the_source(self, tmp_path):
+        src = tmp_path / "job-1.jpg"
+        Image.new("RGB", (40, 30), "green").save(src)
+
+        pdf = ImageProcessor().process(src, tmp_path)
+
+        assert pdf == tmp_path / "job-1.pdf"  # <job_id>.pdf, per the pipeline
+        assert pdf.read_bytes().startswith(b"%PDF-")
+        assert src.read_bytes().startswith(b"\xff\xd8")  # source untouched
+
+    def test_corrupt_image_raises_a_human_error(self, tmp_path):
+        src = tmp_path / "job-2.png"
+        src.write_bytes(b"definitely not image data")
+
+        with pytest.raises(ConversionError, match="corrupt"):
+            ImageProcessor().process(src, tmp_path)
+
+    def test_multipage_tiff_becomes_a_multipage_pdf(self, tmp_path):
+        frames = [Image.new("RGB", (30, 20), color) for color in ("red", "green", "blue")]
+        src = tmp_path / "job-3.tif"
+        frames[0].save(src, save_all=True, append_images=frames[1:])
+
+        pdf = ImageProcessor().process(src, tmp_path)
+
+        assert pdf.read_bytes().startswith(b"%PDF-")
+
+    def test_too_many_frames_are_refused_before_memory_blows_up(self, tmp_path):
+        # An animated GIF with more frames than MAX_FRAMES must fail fast —
+        # the guard fires DURING frame collection, not after rendering all
+        # of them into canvases on a 4 GB PC. Frames differ per color
+        # because GIF writers optimize identical frames away.
+        frames = [
+            Image.new("RGB", (2, 2), (number, 0, 0))
+            for number in range(images.MAX_FRAMES + 1)
+        ]
+        src = tmp_path / "job-4.gif"
+        frames[0].save(src, save_all=True, append_images=frames[1:])
+
+        with pytest.raises(ConversionError, match="frames"):
+            ImageProcessor().process(src, tmp_path)
diff --git a/tests/unit/test_jobs.py b/tests/unit/test_jobs.py
index 74c47fa..a23e21a 100644
--- a/tests/unit/test_jobs.py
+++ b/tests/unit/test_jobs.py
@@ -8,6 +8,8 @@
 import threading
 from pathlib import Path
 
+import pytest
+
 from app.models.printing import JobStatus
 from app.services import jobs
 
@@ -81,12 +83,38 @@ def test_received_job_can_be_cancelled(self):
         assert ok is True
         assert jobs.get_job("job-1").status == JobStatus.CANCELLED
 
+    @pytest.mark.parametrize("status", [JobStatus.QUEUED, JobStatus.CONVERTING])
+    def test_pre_print_states_are_cancellable(self, status):
+        make_job()
+        jobs.update_status("job-1", status)
+        ok, _ = jobs.cancel_job("job-1")
+        assert ok is True
+        assert jobs.get_job("job-1").status == JobStatus.CANCELLED
+
+    def test_printing_job_is_cancellable_best_effort(self):
+        # p14: the pipeline checks between stages, so a cancel during
+        # printing wins over the DONE marker; the spooler purge itself is
+        # the cancel endpoint's job (app/printer/windows.py).
+        make_job()
+        jobs.update_status("job-1", JobStatus.PRINTING)
+        ok, _ = jobs.cancel_job("job-1")
+        assert ok is True
+        assert jobs.get_job("job-1").status == JobStatus.CANCELLED
+
     def test_already_cancelled_job_cannot_be_cancelled_again(self):
         make_job()
         jobs.cancel_job("job-1")
         ok, _ = jobs.cancel_job("job-1")
         assert ok is False
 
+    def test_failed_job_cannot_be_cancelled(self):
+        # Failed jobs are retried, not cancelled (p14 retry endpoint).
+        make_job()
+        jobs.update_status("job-1", JobStatus.FAILED, error="printer offline")
+        ok, message = jobs.cancel_job("job-1")
+        assert ok is False
+        assert "failed" in message
+
     def test_printed_job_cannot_be_cancelled(self):
         make_job()
         jobs.update_status("job-1", JobStatus.DONE, printer="EPSON L3210 Series")
@@ -101,6 +129,92 @@ def test_unknown_job_cannot_be_cancelled(self):
         assert "No such job" in message
 
 
+class TestSourceAndRetry:
+    def test_create_records_the_source_for_retry(self, tmp_path):
+        src = tmp_path / "job-1.jpg"
+        jobs.create_job("job-1", "photo.jpg", 10, src, format="image")
+
+        path, category = jobs.get_source("job-1")
+        assert path == src
+        assert category == "image"
+
+    def test_source_of_unknown_job_is_none(self):
+        assert jobs.get_source("ghost") is None
+
+    def test_options_roundtrip(self, tmp_path):
+        src = tmp_path / "job-1.pdf"
+        options = {
+            "copies": 2,
+            "pages": "1-3",
+            "paper": "a4",
+            "color_mode": "monochrome",
+        }
+        jobs.create_job("job-1", "file.pdf", 9, src, format="pdf", options=options)
+
+        assert jobs.get_job("job-1").options == options
+
+    def test_job_without_options_reads_as_none(self, tmp_path):
+        jobs.create_job("job-1", "file.pdf", 9, tmp_path / "job-1.pdf")
+
+        assert jobs.get_job("job-1").options is None
+
+    def test_corrupt_options_json_never_breaks_the_store(self, tmp_path):
+        jobs.create_job("job-1", "file.pdf", 9, tmp_path / "job-1.pdf")
+        with jobs._lock:
+            jobs._get_conn().execute(
+                "UPDATE jobs SET options = '{not json' WHERE job_id = 'job-1'"
+            )
+            jobs._get_conn().commit()
+
+        assert jobs.get_job("job-1").options is None
+
+    def test_reset_for_retry_revives_only_failed_jobs(self, tmp_path):
+        src = tmp_path / "job-1.pdf"
+        jobs.create_job("job-1", "file.pdf", 9, src)
+        jobs.update_status("job-1", JobStatus.FAILED, error="printer offline")
+
+        assert jobs.reset_for_retry("job-1") is True
+        job = jobs.get_job("job-1")
+        assert job.status == JobStatus.RECEIVED
+        assert job.error is None  # a fresh chance starts clean
+
+    def test_reset_refuses_non_failed_jobs(self):
+        make_job()
+        assert jobs.reset_for_retry("job-1") is False
+        assert jobs.get_job("job-1").status == JobStatus.RECEIVED
+
+    def test_unknown_job_reset_is_refused(self):
+        assert jobs.reset_for_retry("ghost") is False
+
+
+class TestRecovery:
+    def test_jobs_left_active_by_a_crash_become_failed(self, tmp_path):
+        for number, status in enumerate(
+            [JobStatus.RECEIVED, JobStatus.QUEUED, JobStatus.CONVERTING, JobStatus.PRINTING]
+        ):
+            job_id = f"job-{number}"
+            jobs.create_job(job_id, "f.pdf", 1, tmp_path / f"{job_id}.pdf")
+            jobs.update_status(job_id, status)
+
+        recovered = jobs.recover_interrupted()
+
+        assert recovered == 4
+        for number in range(4):
+            job = jobs.get_job(f"job-{number}")
+            assert job.status == JobStatus.FAILED
+            assert "restarted" in job.error
+
+    def test_terminal_states_are_untouched_by_recovery(self, tmp_path):
+        jobs.create_job("done-1", "f.pdf", 1, tmp_path / "done-1.pdf")
+        jobs.update_status("done-1", JobStatus.DONE, printer="EPSON")
+        jobs.create_job("cancel-1", "f.pdf", 1, tmp_path / "cancel-1.pdf")
+        jobs.cancel_job("cancel-1")
+
+        assert jobs.recover_interrupted() == 0
+        assert jobs.get_job("done-1").status == JobStatus.DONE
+        assert jobs.get_job("cancel-1").status == JobStatus.CANCELLED
+
+
 class TestConcurrency:
     def test_simultaneous_creates_from_many_threads_do_not_lose_jobs(self):
         # The lock exists because uvicorn runs sync endpoints in a thread
diff --git a/tests/unit/test_office.py b/tests/unit/test_office.py
new file mode 100644
index 0000000..bf18eea
--- /dev/null
+++ b/tests/unit/test_office.py
@@ -0,0 +1,266 @@
+"""Unit tests for the office processor (app/processors/office.py).
+
+LibreOffice is an EXTERNAL executable — the tests replace subprocess.Popen
+with fakes that write the output PDF soffice would have written, so the
+suite pins down everything EXCEPT LibreOffice itself:
+
+  - the exact invocation shape (headless, private profile, convert-to pdf);
+  - the failure mapping: nonzero exit / timeout / no output file / cannot
+    start → ConversionError with a message a phone user can act on;
+  - the kill switch: available() = ENABLE_OFFICE AND LibreOffice found.
+
+Whether LibreOffice actually renders a DOCX correctly is T6's job on real
+hardware (spike_t6_office.py) — that stays outside the automated suite,
+like every paper test.
+"""
+
+import subprocess
+import zipfile
+from io import BytesIO
+from pathlib import Path
+
+import pytest
+
+from app.processors import office
+from app.processors.base import ConversionError
+from app.processors.office import OfficeProcessor, find_soffice
+
+
+def make_docx_bytes() -> bytes:
+    """The smallest ZIP that detection/office code treats as a DOCX."""
+    buffer = BytesIO()
+    with zipfile.ZipFile(buffer, "w") as archive:
+        archive.writestr("word/document.xml", b"<xml/>")
+    return buffer.getvalue()
+
+
+class FakeProcess:
+    """Stands in for subprocess.Popen's return value."""
+
+    def __init__(self, returncode=0, stderr=b"", raises_timeout=False):
+        self.pid = 4242
+        self.returncode = returncode
+        self._stderr = stderr
+        self._raises_timeout = raises_timeout
+        self.kill_calls = 0
+        self.communicate_calls = 0
+
+    def communicate(self, timeout=None):
+        self.communicate_calls += 1
+        # Only the FIRST wait can time out — after the kill, the reap must
+        # return normally (that's the real subprocess contract the code
+        # relies on).
+        if self._raises_timeout and self.communicate_calls == 1:
+            raise subprocess.TimeoutExpired(cmd="soffice", timeout=timeout)
+        return b"", self._stderr
+
+    def kill(self):
+        self.kill_calls += 1
+
+
+# ---------------------------------------------------------------------------
+# find_soffice — search order and the "explicit path is authoritative" rule
+# ---------------------------------------------------------------------------
+
+
+class TestFindSoffice:
+    def test_explicit_path_wins_when_it_exists(self, tmp_path, monkeypatch):
+        exe = tmp_path / "soffice.exe"
+        exe.write_bytes(b"MZ")
+        monkeypatch.setattr(office, "LO_PATH", str(exe))
+        assert find_soffice() == str(exe)
+
+    def test_explicit_missing_path_is_authoritative_loudly(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(office, "LO_PATH", str(tmp_path / "missing.exe"))
+        monkeypatch.setattr(
+            office.shutil, "which", lambda name: "C:/elsewhere/soffice.exe"
+        )
+        assert find_soffice() is None
+
+    def test_found_on_path_when_no_explicit_config(self, monkeypatch):
+        monkeypatch.setattr(office, "LO_PATH", "")
+        monkeypatch.setattr(
+            office.shutil,
+            "which",
+            lambda name: "C:/LibreOffice/soffice.exe" if "soffice" in name else None,
+        )
+        assert find_soffice() == "C:/LibreOffice/soffice.exe"
+
+    def test_found_among_standard_install_candidates(self, tmp_path, monkeypatch):
+        exe = tmp_path / "soffice.exe"
+        exe.write_bytes(b"MZ")
+        monkeypatch.setattr(office, "LO_PATH", "")
+        monkeypatch.setattr(office.shutil, "which", lambda name: None)
+        monkeypatch.setattr(office, "SOFFICE_CANDIDATES", [str(exe)])
+        assert find_soffice() == str(exe)
+
+    def test_returns_none_when_nowhere_to_be_found(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(office, "LO_PATH", "")
+        monkeypatch.setattr(office.shutil, "which", lambda name: None)
+        monkeypatch.setattr(office, "SOFFICE_CANDIDATES", [str(tmp_path / "nope.exe")])
+        assert find_soffice() is None
+
+
+# ---------------------------------------------------------------------------
+# available() — the office kill switch
+# ---------------------------------------------------------------------------
+
+
+class TestAvailable:
+    def test_disabled_by_config_even_when_installed(self, monkeypatch):
+        monkeypatch.setattr(office, "ENABLE_OFFICE", False)
+        monkeypatch.setattr(office, "find_soffice", lambda: "C:/soffice.exe")
+        assert OfficeProcessor().available() is False
+
+    def test_unavailable_when_libreoffice_missing(self, monkeypatch):
+        monkeypatch.setattr(office, "ENABLE_OFFICE", True)
+        monkeypatch.setattr(office, "find_soffice", lambda: None)
+        assert OfficeProcessor().available() is False
+
+    def test_available_when_enabled_and_installed(self, monkeypatch):
+        monkeypatch.setattr(office, "ENABLE_OFFICE", True)
+        monkeypatch.setattr(office, "find_soffice", lambda: "C:/soffice.exe")
+        assert OfficeProcessor().available() is True
+
+
+# ---------------------------------------------------------------------------
+# process() — the subprocess contract, with LibreOffice faked
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture
+def soffice_found(monkeypatch):
+    monkeypatch.setattr(office, "find_soffice", lambda: "C:/LibreOffice/soffice.exe")
+
+
+class TestProcess:
+    def test_converts_with_the_documented_headless_invocation(
+        self, tmp_path, monkeypatch, soffice_found
+    ):
+        src = tmp_path / "job-1.docx"
+        src.write_bytes(make_docx_bytes())
+        calls = {}
+
+        def fake_popen(cmd, **kwargs):
+            calls["cmd"] = cmd
+            outdir = Path(cmd[cmd.index("--outdir") + 1])
+            (outdir / "job-1.pdf").write_bytes(b"%PDF- converted")
+            return FakeProcess()
+
+        monkeypatch.setattr(office.subprocess, "Popen", fake_popen)
+
+        pdf = OfficeProcessor().process(src, tmp_path)
+
+        assert pdf == tmp_path / "job-1.pdf"  # <job_id>.pdf, per the pipeline
+        cmd = calls["cmd"]
+        assert cmd[0] == "C:/LibreOffice/soffice.exe"
+        assert "--headless" in cmd and "--norestore" in cmd and "--nolockcheck" in cmd
+        assert cmd[cmd.index("--convert-to") + 1] == "pdf"
+        assert cmd[cmd.index("--outdir") + 1] == str(tmp_path)
+        assert cmd[-1] == str(src)
+        # A fresh throwaway profile per run, passed as a file URI.
+        profile_flag = next(flag for flag in cmd if flag.startswith("-env:UserInstallation="))
+        assert profile_flag.startswith("-env:UserInstallation=file:///")
+
+    def test_each_conversion_gets_a_fresh_profile(
+        self, tmp_path, monkeypatch, soffice_found
+    ):
+        src = tmp_path / "job-2.docx"
+        src.write_bytes(make_docx_bytes())
+        profiles = []
+
+        def fake_popen(cmd, **kwargs):
+            profiles.append(
+                next(f for f in cmd if f.startswith("-env:UserInstallation="))
+            )
+            outdir = Path(cmd[cmd.index("--outdir") + 1])
+            src = Path(cmd[-1])
+            (outdir / f"{src.stem}.pdf").write_bytes(b"%PDF-")
+            return FakeProcess()
+
+        monkeypatch.setattr(office.subprocess, "Popen", fake_popen)
+        for number in range(2):
+            (tmp_path / f"job-2-{number}.docx").write_bytes(make_docx_bytes())
+            OfficeProcessor().process(tmp_path / f"job-2-{number}.docx", tmp_path)
+
+        assert profiles[0] != profiles[1]  # a crashed run can't poison the next
+
+    def test_nonzero_exit_becomes_a_conversion_error_with_stderr(
+        self, tmp_path, monkeypatch, soffice_found
+    ):
+        (tmp_path / "job-3.docx").write_bytes(make_docx_bytes())
+
+        def fake_popen(cmd, **kwargs):
+            return FakeProcess(returncode=3, stderr=b"Error: source could not be loaded\n")
+
+        monkeypatch.setattr(office.subprocess, "Popen", fake_popen)
+
+        with pytest.raises(ConversionError, match="exit 3.*could not be loaded"):
+            OfficeProcessor().process(tmp_path / "job-3.docx", tmp_path)
+
+    def test_timeout_kills_the_process_tree_and_explains_itself(
+        self, tmp_path, monkeypatch, soffice_found
+    ):
+        (tmp_path / "job-4.docx").write_bytes(make_docx_bytes())
+        processes = []
+
+        def fake_popen(cmd, **kwargs):
+            process = FakeProcess(raises_timeout=True)
+            processes.append(process)
+            return process
+
+        monkeypatch.setattr(office.subprocess, "Popen", fake_popen)
+        # Task Manager for robots: record whatever kill mechanism runs.
+        kills = []
+        monkeypatch.setattr(
+            office.subprocess, "run", lambda cmd, **kw: kills.append(cmd)
+        )
+
+        with pytest.raises(ConversionError, match="did not finish within"):
+            OfficeProcessor().process(tmp_path / "job-4.docx", tmp_path)
+
+        process = processes[0]
+        # Reaped after the kill attempt, on every platform (taskkill on
+        # Windows, kill() elsewhere).
+        assert process.communicate_calls == 2
+        if process.kill_calls:
+            assert kills == []  # kill() path means no taskkill was needed
+        else:
+            assert kills and kills[0][0] == "taskkill"
+
+    def test_missing_output_pdf_is_an_error_even_at_exit_zero(
+        self, tmp_path, monkeypatch, soffice_found
+    ):
+        (tmp_path / "job-5.docx").write_bytes(make_docx_bytes())
+
+        def fake_popen(cmd, **kwargs):
+            return FakeProcess()  # exit 0, but writes nothing
+
+        monkeypatch.setattr(office.subprocess, "Popen", fake_popen)
+
+        with pytest.raises(ConversionError, match="produced no PDF"):
+            OfficeProcessor().process(tmp_path / "job-5.docx", tmp_path)
+
+    def test_failure_to_start_libreoffice_is_a_conversion_error(
+        self, tmp_path, monkeypatch, soffice_found
+    ):
+        (tmp_path / "job-6.docx").write_bytes(make_docx_bytes())
+
+        def fake_popen(cmd, **kwargs):
+            raise OSError("soffice vanished")
+
+        monkeypatch.setattr(office.subprocess, "Popen", fake_popen)
+
+        with pytest.raises(ConversionError, match="Could not start LibreOffice"):
+            OfficeProcessor().process(tmp_path / "job-6.docx", tmp_path)
+
+    def test_missing_libreoffice_fails_with_an_actionable_message(
+        self, tmp_path, monkeypatch
+    ):
+        # The pipeline-side safety net for a machine that changed after the
+        # upload was accepted (config flip, uninstall).
+        monkeypatch.setattr(office, "find_soffice", lambda: None)
+
+        (tmp_path / "job-7.docx").write_bytes(make_docx_bytes())
+        with pytest.raises(ConversionError, match="Convert it to PDF first"):
+            OfficeProcessor().process(tmp_path / "job-7.docx", tmp_path)
diff --git a/tests/unit/test_pipeline.py b/tests/unit/test_pipeline.py
index 339e00c..b46be77 100644
--- a/tests/unit/test_pipeline.py
+++ b/tests/unit/test_pipeline.py
@@ -4,8 +4,14 @@
 threading.Event so each test waits deterministically for that thread
 instead of sleeping. This is where the documented lifecycle lives:
 
-    received → queued → done   (file deleted)
-                       ↘ failed (file kept for diagnosis)
+    received → queued → converting → printing → done   (files deleted)
+                                              ↘ failed (files kept)
+
+Since p10 the pipeline has a conversion stage between upload and print:
+the processor turns the source file into the service's one print format
+(a PDF). Phase 1 registers only the PDF pass-through, so the PDF path is
+a no-op conversion — the office/image/text stages arrive in later phases
+(docs/MULTI_FORMAT_PLAN.md §10).
 """
 
 import threading
@@ -13,6 +19,7 @@
 import pytest
 
 from app.models.printing import JobStatus
+from app.processors.base import ConversionError
 from app.services import jobs, pipeline
 
 TEST_PRINTER = "EPSON L3210 Series"
@@ -29,19 +36,19 @@ def job_with_pdf(tmp_upload_dir):
 
 
 class TestStartJob:
-    def test_job_is_queued_while_the_print_thread_is_still_running(
+    def test_job_is_in_printing_state_while_the_print_thread_is_running(
         self, job_with_pdf, mock_print, wait_for_status
     ):
-        # The fake is so fast the thread could finish before this test even
-        # reads the store — so freeze it with a gate to observe "queued",
-        # the state the phone's 201 response reflects.
+        # The fake is frozen mid-print so the test can observe the transient
+        # "printing" state. The phone's 201 still says "queued" — this is
+        # what polling sees on the way to done.
         gate = threading.Event()
         mock_print.gate = gate
 
         pipeline.start_job("job-1", job_with_pdf)
 
         assert mock_print.called.wait(timeout=5)
-        assert jobs.get_job("job-1").status == JobStatus.QUEUED
+        assert jobs.get_job("job-1").status == JobStatus.PRINTING
 
         gate.set()
         wait_for_status("job-1", JobStatus.DONE)  # completes once released
@@ -79,6 +86,141 @@ def test_hands_the_right_file_to_the_printer(
 
         wait_for_status("job-1", JobStatus.DONE)
 
+        # The PDF processor is a pass-through: Sumatra receives the upload
+        # exactly as stored — same contract spike T4 proved on real paper.
         assert mock_print.pdf_path == job_with_pdf
         # printer_name=None means "let windows.py resolve PRINTER_NAME/default".
         assert mock_print.printer_name is None
+
+
+class TestConversionStage:
+    """The conversion stage between upload and print (p10 groundwork)."""
+
+    def test_conversion_failure_marks_failed_and_never_prints(
+        self, job_with_pdf, mock_print, monkeypatch, wait_for_status
+    ):
+        class FailingProcessor:
+            def process(self, src, out_dir):
+                raise ConversionError("LibreOffice crashed mid-conversion")
+
+        monkeypatch.setattr(pipeline, "for_category", lambda category: FailingProcessor())
+
+        pipeline.start_job("job-1", job_with_pdf, category="office")
+
+        job = wait_for_status("job-1", JobStatus.FAILED)
+        assert "crashed" in job.error
+        assert job_with_pdf.exists()  # kept for diagnosis
+        assert mock_print.called.is_set() is False  # nothing reached the printer
+
+    def test_conversions_run_one_at_a_time(
+        self, tmp_upload_dir, mock_print, monkeypatch, wait_for_status, wait_until
+    ):
+        # The old-PC guard: with a ≤4 GB machine and a future heavyweight
+        # converter (LibreOffice), two jobs must never convert at once.
+        class SlowProcessor:
+            def __init__(self):
+                self.in_process = 0
+                self.max_in_process = 0
+                self.release = threading.Event()
+
+            def process(self, src, out_dir):
+                self.in_process += 1
+                self.max_in_process = max(self.max_in_process, self.in_process)
+                self.release.wait(timeout=5)
+                self.in_process -= 1
+                return src
+
+        slow = SlowProcessor()
+        monkeypatch.setattr(pipeline, "for_category", lambda category: slow)
+
+        tmp_upload_dir.mkdir(parents=True, exist_ok=True)
+        for number in ("1", "2"):
+            path = tmp_upload_dir / f"job-{number}.pdf"
+            path.write_bytes(b"%PDF-1.4 test")
+            jobs.create_job(f"job-{number}", "file.pdf", 13, path, format="office")
+            pipeline.start_job(f"job-{number}", path, category="office")
+
+        wait_until(lambda: slow.in_process >= 1, message="first conversion never started")
+
+        slow.release.set()
+        wait_for_status("job-1", JobStatus.DONE)
+        wait_for_status("job-2", JobStatus.DONE)
+
+        assert slow.max_in_process == 1  # the second never overlapped the first
+
+
+class TestCancellation:
+    """p14: a cancel wins over the next print stage, wherever it lands."""
+
+    @pytest.fixture
+    def gated_processor(self, monkeypatch):
+        """A converter that parks mid-conversion until its test releases it."""
+
+        class GatedProcessor:
+            def __init__(self):
+                self.entered = threading.Event()
+                self.release = threading.Event()
+
+            def process(self, src, out_dir):
+                self.entered.set()
+                self.release.wait(timeout=5)
+                return src
+
+        gated = GatedProcessor()
+        monkeypatch.setattr(pipeline, "for_category", lambda category: gated)
+        return gated
+
+    def test_cancel_during_conversion_never_prints(
+        self, job_with_pdf, mock_print, gated_processor, wait_until
+    ):
+        pipeline.start_job("job-1", job_with_pdf, category="office")
+        assert gated_processor.entered.wait(timeout=5)
+
+        ok, _ = jobs.cancel_job("job-1")  # while the conversion is parked
+        assert ok is True
+
+        gated_processor.release.set()
+        wait_until(
+            lambda: not job_with_pdf.exists(),
+            message="cancelled job's files should be cleaned up",
+        )
+
+        assert mock_print.called.is_set() is False  # nothing reached the printer
+        assert jobs.get_job("job-1").status == JobStatus.CANCELLED
+
+    def test_cancel_while_printing_keeps_cancelled_after_submit(
+        self, job_with_pdf, mock_print, tmp_upload_dir, wait_for_status, wait_until
+    ):
+        gate = threading.Event()
+        mock_print.gate = gate
+        pipeline.start_job("job-1", job_with_pdf)
+        wait_for_status("job-1", JobStatus.PRINTING)
+
+        ok, _ = jobs.cancel_job("job-1")  # the spooler purge runs in the API
+        assert ok is True
+
+        gate.set()
+        wait_until(
+            lambda: not job_with_pdf.exists(),
+            message="cancelled job's files should be cleaned up",
+        )
+
+        # Sumatra was handed the file (paper may come out — documented), but
+        # the pipeline must NOT mark the cancelled job done.
+        assert mock_print.called.is_set() is True
+        assert jobs.get_job("job-1").status == JobStatus.CANCELLED
+
+    def test_cancelled_before_the_thread_starts_is_never_processed(
+        self, job_with_pdf, mock_print
+    ):
+        jobs.cancel_job("job-1")  # cancel between create and start
+        pipeline.start_job("job-1", job_with_pdf)
+
+        import time
+
+        deadline = time.monotonic() + 2
+        while time.monotonic() < deadline and not mock_print.called.is_set():
+            time.sleep(0.01)
+
+        assert mock_print.called.is_set() is False
+        assert jobs.get_job("job-1").status == JobStatus.CANCELLED
diff --git a/tests/unit/test_print_options.py b/tests/unit/test_print_options.py
new file mode 100644
index 0000000..4a23c51
--- /dev/null
+++ b/tests/unit/test_print_options.py
@@ -0,0 +1,124 @@
+"""Unit tests for print options (Phase 7): validation and the SumatraPDF
+print-settings builder.
+
+The design rules pinned here:
+  - defaults mean NO -print-settings at all (byte-identical to the
+    T4-proven command);
+  - the request's paper beats the PAPER_SIZE config; "fit" only rides
+    along with a paper size;
+  - `pages` is a strict allowlist (it goes into a command line);
+  - the paper keys are shared between validation, page layout and the
+    print engine — they must never drift apart.
+"""
+
+import pytest
+
+from app.models.printing import (
+    PAPER_CHOICES,
+    PrintOptions,
+    validate_print_options,
+)
+from app.printer import windows
+from app.printer.windows import build_print_settings
+from app.processors import base as processor_base
+
+
+class TestValidatePrintOptions:
+    def test_defaults_normalize_to_the_default_model(self):
+        assert validate_print_options(1, "", "", "color") == PrintOptions()
+
+    def test_input_is_normalized(self):
+        options = validate_print_options(3, " 1-3,5 ", " A4 ", " Monochrome ")
+        assert options.copies == 3
+        assert options.pages == "1-3,5"
+        assert options.paper == "a4"
+        assert options.color_mode == "monochrome"
+
+    @pytest.mark.parametrize("copies", [0, -1, 100])
+    def test_copies_bounds(self, copies):
+        with pytest.raises(ValueError, match="between 1 and 99"):
+            validate_print_options(copies, "", "", "color")
+
+    @pytest.mark.parametrize("pages", ["1;2", "drop tables", "1--2", "abc", "1-3,"])
+    def test_pages_is_an_allowlist(self, pages):
+        with pytest.raises(ValueError, match="Pages must look like"):
+            validate_print_options(1, pages, "", "color")
+
+    @pytest.mark.parametrize("pages", ["5", "2-6", "1-3,5,8-10", "odd", "even", "10-8"])
+    def test_pages_accepts_documented_shapes(self, pages):
+        # 10-8 is a REVERSED range — SumatraPDF prints it back-to-front,
+        # so it's allowed on purpose.
+        assert validate_print_options(1, pages, "", "color").pages == pages
+
+    def test_pages_length_cap(self):
+        with pytest.raises(ValueError, match="too long"):
+            validate_print_options(1, "1," * 60, "", "color")
+
+    def test_paper_allowlist(self):
+        with pytest.raises(ValueError, match="Paper must be one of"):
+            validate_print_options(1, "", "glossy", "color")
+
+    def test_color_mode_allowlist(self):
+        with pytest.raises(ValueError, match="Color mode"):
+            validate_print_options(1, "", "", "sepia")
+
+
+class TestBuildPrintSettings:
+    def test_defaults_mean_no_settings_at_all(self, monkeypatch):
+        monkeypatch.setattr(windows, "PAPER_SIZE", "")
+        assert build_print_settings(None) is None
+        assert build_print_settings(PrintOptions()) is None
+
+    def test_paper_token_gains_fit(self, monkeypatch):
+        monkeypatch.setattr(windows, "PAPER_SIZE", "")
+        assert build_print_settings(PrintOptions(paper="a4")) == "paper=A4,fit"
+
+    def test_long_bond_uses_the_custom_mm_size(self, monkeypatch):
+        monkeypatch.setattr(windows, "PAPER_SIZE", "")
+        assert build_print_settings(PrintOptions(paper="long-bond")) == (
+            "paper=215.9mm x 330.2mm,fit"
+        )
+
+    def test_config_paper_size_is_the_fallback(self, monkeypatch):
+        monkeypatch.setattr(windows, "PAPER_SIZE", "letter")
+        assert build_print_settings(PrintOptions()) == "paper=letter,fit"
+
+    def test_request_paper_overrides_config(self, monkeypatch):
+        monkeypatch.setattr(windows, "PAPER_SIZE", "a4")
+        assert build_print_settings(PrintOptions(paper="legal")) == "paper=legal,fit"
+
+    def test_copies_multiply_and_collate(self, monkeypatch):
+        monkeypatch.setattr(windows, "PAPER_SIZE", "")
+        assert build_print_settings(PrintOptions(copies=3)) == "3x,collate"
+
+    def test_pages_pass_through_verbatim(self, monkeypatch):
+        monkeypatch.setattr(windows, "PAPER_SIZE", "")
+        assert build_print_settings(PrintOptions(pages="2-6")) == "2-6"
+
+    def test_monochrome_token(self, monkeypatch):
+        monkeypatch.setattr(windows, "PAPER_SIZE", "")
+        assert (
+            build_print_settings(PrintOptions(color_mode="monochrome"))
+            == "monochrome"
+        )
+
+    def test_full_combination(self, monkeypatch):
+        monkeypatch.setattr(windows, "PAPER_SIZE", "")
+        options = PrintOptions(
+            copies=2, pages="2-6", paper="letter", color_mode="monochrome"
+        )
+        assert build_print_settings(options) == (
+            "paper=letter,fit,2x,collate,2-6,monochrome"
+        )
+
+
+class TestPaperKeyConsistency:
+    def test_every_choice_has_a_layout_and_an_engine_token(self):
+        # One list of paper keys feeds validation (models), page layout
+        # (processors/base) and the print engine (windows) — a drift here
+        # would let a validated paper produce no layout or no token.
+        for key in PAPER_CHOICES:
+            if key == "":
+                continue
+            assert key in processor_base.PAGE_SIZES_PT
+            assert key in windows.PAPER_TOKENS
diff --git a/tests/unit/test_printer_windows.py b/tests/unit/test_printer_windows.py
index 5aa7655..377ab2a 100644
--- a/tests/unit/test_printer_windows.py
+++ b/tests/unit/test_printer_windows.py
@@ -91,6 +91,7 @@ def test_success_builds_the_documented_command_line(
     ):
         pdf = tmp_path / "doc.pdf"
         pdf.write_bytes(b"%PDF-")
+        monkeypatch.setattr(windows, "PAPER_SIZE", "")  # hermetic: no print settings
         monkeypatch.setattr(windows, "find_sumatra", lambda: "C:/SumatraPDF.exe")
 
         method, printer = windows.submit_pdf(pdf)
@@ -139,6 +140,56 @@ def failing_run(cmd, **kwargs):
             windows.submit_pdf(tmp_path / "doc.pdf")
 
 
+    def test_print_options_build_the_settings_flag(
+        self, fake_win32print, tmp_path, monkeypatch, recorded_run
+    ):
+        from app.models.printing import PrintOptions
+
+        monkeypatch.setattr(windows, "PAPER_SIZE", "")
+        monkeypatch.setattr(windows, "find_sumatra", lambda: "C:/SumatraPDF.exe")
+        options = PrintOptions(
+            copies=2, pages="2-6", paper="a4", color_mode="monochrome"
+        )
+
+        windows.submit_pdf(tmp_path / "doc.pdf", options=options)
+
+        assert recorded_run["cmd"][3:5] == [
+            "-print-settings",
+            "paper=A4,fit,2x,collate,2-6,monochrome",
+        ]
+        assert recorded_run["cmd"][5:] == ["-silent", str(tmp_path / "doc.pdf")]
+
+
+class TestPrintSettings:
+    """PAPER_SIZE is opt-in (docs/MULTI_FORMAT_PLAN.md §13 assumption #3):
+    empty = no print-settings flag at all, the driver chooses the paper —
+    the exact command spike T4 proved on real paper."""
+
+    def test_set_paper_size_adds_the_print_settings_flag(
+        self, fake_win32print, tmp_path, monkeypatch, recorded_run
+    ):
+        pdf = tmp_path / "doc.pdf"
+        pdf.write_bytes(b"%PDF-")
+        monkeypatch.setattr(windows, "PAPER_SIZE", "A4")
+        monkeypatch.setattr(windows, "find_sumatra", lambda: "C:/SumatraPDF.exe")
+
+        windows.submit_pdf(pdf)
+
+        cmd = recorded_run["cmd"]
+        assert cmd[3:5] == ["-print-settings", "paper=A4,fit"]
+        assert cmd[5:] == ["-silent", str(pdf)]  # file still last, -silent still present
+
+    def test_empty_paper_size_sends_no_print_settings(
+        self, fake_win32print, tmp_path, monkeypatch, recorded_run
+    ):
+        monkeypatch.setattr(windows, "PAPER_SIZE", "")
+        monkeypatch.setattr(windows, "find_sumatra", lambda: "C:/SumatraPDF.exe")
+
+        windows.submit_pdf(tmp_path / "doc.pdf")
+
+        assert "-print-settings" not in recorded_run["cmd"]
+
+
 # ---------------------------------------------------------------------------
 # submit_pdf — the print-verb fallback (only when SumatraPDF is absent)
 # ---------------------------------------------------------------------------
@@ -177,6 +228,144 @@ def test_print_verb_refused_for_a_non_default_printer(
 # ---------------------------------------------------------------------------
 
 
+# ---------------------------------------------------------------------------
+# cancel_spooler_jobs — the p14 printing-stage cancel (best-effort purge)
+# ---------------------------------------------------------------------------
+
+
+class TestCancelSpoolerJobs:
+    def test_purges_only_jobs_whose_document_matches_the_job_id(
+        self, fake_win32print
+    ):
+        # SumatraPDF names spooler documents after the file it prints —
+        # <job_id>.pdf — so a prefix match finds OUR jobs (including
+        # multi-digit id prefixes like abc123-old) without tracking
+        # Windows job ids.
+        fake_win32print._spooler_jobs = [
+            {"JobId": 7, "pDocument": "abc123.pdf"},
+            {"JobId": 8, "pDocument": "other.pdf"},
+            {"JobId": 9, "pDocument": "abc123-old.pdf"},
+        ]
+
+        removed = windows.cancel_spooler_jobs(TEST_PRINTER, "abc123")
+
+        assert removed == 2
+        assert [call[1] for call in fake_win32print.setjob_calls] == [7, 9]
+        assert all(
+            call[2] == fake_win32print.JOB_CONTROL_DELETE
+            for call in fake_win32print.setjob_calls
+        )
+
+    def test_empty_queue_removes_nothing(self, fake_win32print):
+        assert windows.cancel_spooler_jobs(TEST_PRINTER, "abc123") == 0
+        assert fake_win32print.setjob_calls == []
+
+    def test_entries_without_a_document_name_are_tolerated(self, fake_win32print):
+        fake_win32print._spooler_jobs = [{"JobId": 5}]  # malformed entry
+
+        assert windows.cancel_spooler_jobs(TEST_PRINTER, "abc123") == 0
+
+
+# ---------------------------------------------------------------------------
+# printer_ready — the p15 pre-dispatch readiness check
+# ---------------------------------------------------------------------------
+
+
+class TestPrinterReady:
+    def test_healthy_printer_is_ready(self, fake_win32print):
+        fake_win32print.GetPrinter = lambda handle, level: {
+            "Status": 0,
+            "Attributes": 0,
+        }
+        assert windows.printer_ready(TEST_PRINTER) == (True, "")
+
+    def test_offline_status_is_not_ready(self, fake_win32print):
+        fake_win32print.GetPrinter = lambda handle, level: {
+            "Status": 0x00000080,  # PRINTER_STATUS_OFFLINE
+            "Attributes": 0,
+        }
+        ready, reason = windows.printer_ready(TEST_PRINTER)
+        assert ready is False
+        assert "offline" in reason
+
+    def test_windows_work_offline_attribute_is_not_ready(self, fake_win32print):
+        # What Windows sets when a USB printer is powered off — the most
+        # common real-world "why did nothing print" state.
+        fake_win32print.GetPrinter = lambda handle, level: {
+            "Status": 0,
+            "Attributes": 0x00000400,  # PRINTER_ATTRIBUTE_WORK_OFFLINE
+        }
+        ready, reason = windows.printer_ready(TEST_PRINTER)
+        assert ready is False
+        assert "offline" in reason
+
+    def test_out_of_paper_is_reported(self, fake_win32print):
+        fake_win32print.GetPrinter = lambda handle, level: {
+            "Status": 0x00000010,  # PRINTER_STATUS_PAPER_OUT
+            "Attributes": 0,
+        }
+        ready, reason = windows.printer_ready(TEST_PRINTER)
+        assert ready is False
+        assert "out of paper" in reason
+
+    def test_query_failure_never_blocks_printing(self, fake_win32print):
+        # Best-effort by design: a spooler query hiccup must not stop a
+        # job that might have printed fine.
+        def broken(handle, level):
+            raise RuntimeError("spooler grumbled")
+
+        fake_win32print.GetPrinter = broken
+        assert windows.printer_ready(TEST_PRINTER) == (True, "")
+
+    def test_not_ready_printer_refuses_dispatch_before_sumatra(
+        self, fake_win32print, tmp_path, monkeypatch, recorded_run
+    ):
+        fake_win32print.GetPrinter = lambda handle, level: {
+            "Status": 0x00000080,
+            "Attributes": 0,
+        }
+        monkeypatch.setattr(windows, "find_sumatra", lambda: "C:/SumatraPDF.exe")
+
+        with pytest.raises(RuntimeError, match="offline"):
+            windows.submit_pdf(tmp_path / "doc.pdf")
+
+        assert "cmd" not in recorded_run  # Sumatra never even started
+
+
+class TestSumatraExitCatalog:
+    def test_documented_exit_codes_map_to_human_messages(
+        self, fake_win32print, tmp_path, monkeypatch
+    ):
+        cases = {
+            2: "corrupt or password-protected",
+            4: "printer was not found",
+            5: "paper, ink and USB",
+        }
+        for code, expected in cases.items():
+            def failing_run(cmd, **kwargs):
+                return subprocess.CompletedProcess(cmd, returncode=code, stdout=b"", stderr=b"")
+
+            monkeypatch.setattr(windows.subprocess, "run", failing_run)
+            monkeypatch.setattr(windows, "find_sumatra", lambda: "C:/SumatraPDF.exe")
+
+            with pytest.raises(RuntimeError, match=expected):
+                windows.submit_pdf(tmp_path / "doc.pdf")
+
+    def test_unknown_exit_code_still_includes_stderr(
+        self, fake_win32print, tmp_path, monkeypatch
+    ):
+        def failing_run(cmd, **kwargs):
+            return subprocess.CompletedProcess(
+                cmd, returncode=99, stdout=b"", stderr=b"driver grumbled\n"
+            )
+
+        monkeypatch.setattr(windows.subprocess, "run", failing_run)
+        monkeypatch.setattr(windows, "find_sumatra", lambda: "C:/SumatraPDF.exe")
+
+        with pytest.raises(RuntimeError, match="driver grumbled"):
+            windows.submit_pdf(tmp_path / "doc.pdf")
+
+
 class TestPywin32Presence:
     def test_missing_pywin32_fails_fast(self, monkeypatch, tmp_path):
         # Setting a sys.modules entry to None makes `import win32print`
diff --git a/tests/unit/test_processors.py b/tests/unit/test_processors.py
new file mode 100644
index 0000000..889dbe4
--- /dev/null
+++ b/tests/unit/test_processors.py
@@ -0,0 +1,49 @@
+"""Unit tests for the processor registry (app/processors).
+
+These tests pin the registry contract:
+  - for_category() returns a processor whose process() yields a PDF path;
+  - unregistered categories return None — the "not enabled yet" signal the
+    upload gate and the pipeline both rely on.
+All four MVP categories are registered as of Phase 4 (docs/
+MULTI_FORMAT_PLAN.md §10); a future format phase extends these expectations.
+"""
+
+from app.processors import for_category, supported_categories
+
+
+class TestRegistry:
+    def test_all_mvp_categories_have_processors(self):
+        assert for_category("pdf") is not None
+        assert for_category("image") is not None
+        assert for_category("office") is not None
+        assert for_category("text") is not None
+
+    def test_unknown_category_returns_none(self):
+        assert for_category("holodeck") is None
+
+    def test_supported_categories_are_pinned_after_phase_4(self):
+        assert supported_categories() == ("image", "office", "pdf", "text")
+
+    def test_office_availability_depends_on_the_machine(self):
+        # Registered everywhere, but its available() gate is what refuses
+        # uploads when LibreOffice is missing or ENABLE_OFFICE=0. The
+        # gate's own logic lives in tests/unit/test_office.py.
+        assert for_category("office").available() in (True, False)
+
+
+class TestPdfProcessor:
+    def test_process_returns_the_source_unchanged(self, tmp_path):
+        src = tmp_path / "doc.pdf"
+        src.write_bytes(b"%PDF-1.4 test")
+
+        result = for_category("pdf").process(src, tmp_path)
+
+        assert result == src  # pass-through: same path, nothing new written
+        assert src.read_bytes() == b"%PDF-1.4 test"  # source untouched
+
+
+class TestImageProcessorRegistration:
+    def test_image_processor_is_the_registered_instance(self):
+        from app.processors.images import IMAGE_PROCESSOR
+
+        assert for_category("image") is IMAGE_PROCESSOR
diff --git a/tests/unit/test_text.py b/tests/unit/test_text.py
new file mode 100644
index 0000000..19d3e63
--- /dev/null
+++ b/tests/unit/test_text.py
@@ -0,0 +1,194 @@
+"""Unit tests for the text/CSV processor (app/processors/text.py).
+
+reportlab is a Python library, so these tests run the REAL renderer and
+assert on the produced PDF bytes: the %PDF- magic, page counts (counting
+/Type /Page objects), and the truncation notices (pageCompression is off
+in the processor precisely so drawn text is visible in the bytes).
+"""
+
+import re
+
+import pytest
+
+from app.processors.base import ConversionError
+from app.processors.text import (
+    CSV_MAX_COLS,
+    CSV_MAX_ROWS,
+    MAX_TXT_PAGES,
+    TextProcessor,
+    decode_text,
+    grid_columns,
+    sniff_dialect,
+    wrap_line,
+)
+
+A4_AVAIL_W = 595 - 2 * 54  # A4 minus the text margins
+LINE_H = 12
+
+
+def count_pages(pdf_bytes: bytes) -> int:
+    """Count page objects ("Pages" is the tree node — excluded)."""
+    return len(re.findall(rb"/Type /Page(?![a-zA-Z])", pdf_bytes))
+
+
+class TestWrapLine:
+    def test_short_line_passes_through(self):
+        assert wrap_line("hello", 10) == ["hello"]
+
+    def test_breaks_at_spaces_when_possible(self):
+        assert wrap_line("hello world foo", 5) == ["hello", "world", "foo"]
+
+    def test_long_words_are_hard_split(self):
+        chunks = wrap_line("a" * 25, 10)
+        assert chunks == ["a" * 10, "a" * 10, "a" * 5]
+
+    def test_empty_line_yields_one_empty_chunk(self):
+        assert wrap_line("", 10) == [""]
+
+
+class TestDecodeText:
+    def test_utf8(self):
+        assert decode_text("héllo wörld".encode("utf-8")) == "héllo wörld"
+
+    def test_utf16_with_bom(self):
+        assert decode_text("héllo wörld".encode("utf-16")) == "héllo wörld"
+
+    def test_windows_1252(self):
+        # Smart quotes + é: invalid as UTF-8, valid as cp1252.
+        raw = "café “quoted”".encode("cp1252")
+        assert decode_text(raw) == "café “quoted”"
+
+    def test_undecodable_binary_fails_instead_of_printing_mojibake(self):
+        # 0x81/0x8D/0x8F/0x90/0x9D are undefined in cp1252, 0x80+ breaks
+        # UTF-8 — a binary file pretending to be .txt lands here.
+        with pytest.raises(ConversionError, match="does not decode"):
+            decode_text(b"\x81\x8d\x8f\x90\x9d\xff\xfe\x00\x01")
+
+
+class TestSniffDialect:
+    def test_semicolons_detected(self):
+        assert sniff_dialect("a;b;c\n1;2;3").delimiter == ";"
+
+    def test_comma_fallback(self):
+        assert sniff_dialect("plain words only").delimiter == ","
+
+
+class TestGridColumns:
+    def test_grid_never_exceeds_the_printable_width(self):
+        rows = [["x" * 200] * 5]  # five monster cells
+        widths = grid_columns(rows, A4_AVAIL_W)
+        assert sum(widths) <= A4_AVAIL_W + 1e-6  # float rounding guard
+
+    def test_narrow_content_is_not_stretched(self):
+        rows = [["a", "b", "c"]]
+        widths = grid_columns(rows, A4_AVAIL_W)
+        assert sum(widths) < A4_AVAIL_W / 2  # left-aligned, natural size
+
+    def test_short_cells_keep_their_content_after_padding(self):
+        # The regression this pins: padding is part of the width accounting,
+        # so a 2-character cell is never clipped down to "...".
+        from app.processors.text import _clip_cell
+
+        widths = grid_columns([["a1"]], A4_AVAIL_W)
+        assert _clip_cell("a1", widths[0]) == "a1"
+
+
+class TestProcessTxt:
+    def test_renders_a_real_pdf_next_to_the_source(self, tmp_path):
+        src = tmp_path / "job-1.txt"
+        src.write_text("hello from a text file\n" * 10, encoding="utf-8")
+
+        pdf = TextProcessor().process(src, tmp_path)
+
+        assert pdf == tmp_path / "job-1.pdf"
+        data = pdf.read_bytes()
+        assert data.startswith(b"%PDF-")
+        assert count_pages(data) == 1
+        assert b"hello from a text file" in data  # compression is off on purpose
+        assert src.read_bytes().startswith(b"hello")  # source untouched
+
+    def test_long_lines_wrap_and_fill_pages(self, tmp_path):
+        # 100 wrapped lines of prose — several pages' worth (61 lines/page).
+        src = tmp_path / "job-2.txt"
+        src.write_text(
+            "\n".join("word " * 30 for _ in range(100)), encoding="utf-8"
+        )
+
+        pdf = TextProcessor().process(src, tmp_path)
+
+        assert count_pages(pdf.read_bytes()) > 1
+
+    def test_very_long_files_are_capped_with_a_notice(self, tmp_path):
+        src = tmp_path / "job-3.txt"
+        lines_per_page = int((842 - 2 * 54) // LINE_H)
+        src.write_text(
+            "line of text\n" * (MAX_TXT_PAGES * lines_per_page + 50),
+            encoding="utf-8",
+        )
+
+        pdf = TextProcessor().process(src, tmp_path)
+
+        data = pdf.read_bytes()
+        assert count_pages(data) == MAX_TXT_PAGES
+        assert b"truncated" in data
+
+    def test_empty_file_is_an_error(self, tmp_path):
+        src = tmp_path / "job-4.txt"
+        src.write_bytes(b"   \n  ")
+        with pytest.raises(ConversionError, match="empty"):
+            TextProcessor().process(src, tmp_path)
+
+    def test_binary_in_disguise_is_an_error(self, tmp_path):
+        src = tmp_path / "job-5.txt"
+        src.write_bytes(b"\x81\x8d\x8f\x90\x9d" * 4)
+        with pytest.raises(ConversionError, match="does not decode"):
+            TextProcessor().process(src, tmp_path)
+
+
+class TestProcessCsv:
+    def test_renders_a_grid_with_a_bold_header(self, tmp_path):
+        src = tmp_path / "job-6.csv"
+        src.write_text("name,qty,note\nbolt,12,galvanized\nnut,7,", encoding="utf-8")
+
+        pdf = TextProcessor().process(src, tmp_path)
+
+        data = pdf.read_bytes()
+        assert data.startswith(b"%PDF-")
+        assert count_pages(data) == 1
+        assert b"galvanized" in data  # cell text visible in the bytes
+        assert b"truncated" not in data
+
+    def test_semicolon_files_are_detected_and_split(self, tmp_path):
+        src = tmp_path / "job-7.csv"
+        src.write_text("a1;a2;a3\nb1;b2;b3", encoding="utf-8")
+
+        pdf = TextProcessor().process(src, tmp_path)
+
+        data = pdf.read_bytes()
+        assert b"a1" in data and b"b3" in data  # drawn as separate cells
+
+    def test_row_overflow_is_capped_with_a_notice(self, tmp_path):
+        src = tmp_path / "job-8.csv"
+        rows = ["index,value"] + [f"{i},row {i}" for i in range(CSV_MAX_ROWS + 100)]
+        src.write_text("\n".join(rows), encoding="utf-8")
+
+        pdf = TextProcessor().process(src, tmp_path)
+
+        data = pdf.read_bytes()
+        assert count_pages(data) > 1
+        assert b"truncated" in data
+
+    def test_column_overflow_is_capped_with_a_notice(self, tmp_path):
+        src = tmp_path / "job-9.csv"
+        header = ",".join(f"col{i}" for i in range(CSV_MAX_COLS + 5))
+        src.write_text(header, encoding="utf-8")
+
+        pdf = TextProcessor().process(src, tmp_path)
+
+        assert b"truncated" in pdf.read_bytes()
+
+    def test_empty_csv_is_an_error(self, tmp_path):
+        src = tmp_path / "job-10.csv"
+        src.write_text(",,\n,,", encoding="utf-8")  # nothing but blank cells
+        with pytest.raises(ConversionError, match="no rows"):
+            TextProcessor().process(src, tmp_path)
diff --git a/tests/unit/test_uploads.py b/tests/unit/test_uploads.py
index 18b6ff9..1d260f6 100644
--- a/tests/unit/test_uploads.py
+++ b/tests/unit/test_uploads.py
@@ -1,58 +1,148 @@
 """Unit tests for upload handling (app/services/uploads.py).
 
-validate_pdf() is the single most security-relevant pure-logic function in
-the service (SOURCE_OF_TRUTH Section 8), so it gets the boundary treatment:
-what's accepted, what's rejected, and exactly WHERE the line sits.
+validate_upload() is the single most security-relevant pure-logic function
+in the service (SOURCE_OF_TRUTH Section 8), so it gets the boundary
+treatment: what's accepted, what's rejected, and exactly WHERE the line
+sits. Phase 1 registers only the PDF processor, so the image/office/text
+cases here prove files are DETECTED correctly and then refused until their
+phase lands (docs/MULTI_FORMAT_PLAN.md §10).
 """
 
+import zipfile
+from io import BytesIO
+
 import pytest
 
 from app.services import uploads
 from app.services.uploads import (
     UploadError,
+    delete_job_files,
     save_upload,
     sweep_stale_uploads,
     upload_path,
-    validate_pdf,
+    validate_upload,
 )
 
 
-class TestValidatePdf:
+def make_docx_bytes() -> bytes:
+    """The smallest ZIP that detection treats as a DOCX (word/ part)."""
+    buffer = BytesIO()
+    with zipfile.ZipFile(buffer, "w") as archive:
+        archive.writestr("word/document.xml", b"<xml/>")
+    return buffer.getvalue()
+
+
+class TestValidateUpload:
     def test_accepts_a_real_pdf(self):
-        validate_pdf("report.pdf", b"%PDF-1.4 rest of the document")  # no raise
+        assert validate_upload("report.pdf", b"%PDF-1.4 rest of the document") == "pdf"
 
     def test_empty_filename_skips_extension_check_but_still_checks_magic(self):
         # curl/some clients send no filename; the content check must still fire.
-        validate_pdf("", b"%PDF-1.4")  # no raise
+        assert validate_upload("", b"%PDF-1.4") == "pdf"
+
+    @pytest.mark.parametrize("name", ["REPORT.PDF", "Report.Pdf", "x.pDf"])
+    def test_extension_check_is_case_insensitive(self, name):
+        assert validate_upload(name, b"%PDF-1.4") == "pdf"
 
-    def test_wrong_extension_rejected_with_415(self):
+    def test_unsupported_extension_rejected_with_415(self):
         with pytest.raises(UploadError) as exc_info:
-            validate_pdf("notes.txt", b"%PDF-1.4")
+            validate_upload("virus.exe", b"MZ\x90\x00")
         assert exc_info.value.status_code == 415
+        assert "pdf" in str(exc_info.value).lower()  # the message names what IS allowed
 
-    @pytest.mark.parametrize("name", ["REPORT.PDF", "Report.Pdf", "x.pDf"])
-    def test_extension_check_is_case_insensitive(self, name):
-        validate_pdf(name, b"%PDF-1.4")  # no raise
+    def test_recognizable_content_with_a_lying_extension_is_still_refused(self):
+        # Even PDF bytes don't smuggle a file in under an unknown extension:
+        # the allowlist stays explicit (plan Section 9) — the client must
+        # name the file correctly too.
+        with pytest.raises(UploadError, match="Unsupported file type"):
+            validate_upload("report.exe", b"%PDF-1.4 real pdf")
 
     def test_renamed_text_file_rejected_by_magic_bytes_with_415(self):
         # A .txt renamed to .pdf passes the extension check — the %PDF- magic
-        # bytes are what catch it (config.py's PDF_MAGIC).
+        # bytes are what catch it (detection.py, fed by config.PDF_MAGIC).
         with pytest.raises(UploadError, match="not a PDF") as exc_info:
-            validate_pdf("fake.pdf", b"just some text, definitely not a pdf")
+            validate_upload("fake.pdf", b"just some text, definitely not a pdf")
+        assert exc_info.value.status_code == 415
+
+    def test_empty_pdf_rejected_by_magic_bytes(self):
+        # An empty file carries no signature — same fate as a renamed one.
+        with pytest.raises(UploadError, match="not a PDF"):
+            validate_upload("empty.pdf", b"")
+
+    def test_text_extension_with_binary_content_is_a_mismatch(self):
+        # The extension says "text", the bytes say "PDF" — extensions lie,
+        # and detection must say so instead of guessing.
+        with pytest.raises(UploadError, match="does not match"):
+            validate_upload("notes.txt", b"%PDF-1.4")
+
+    def test_images_are_now_printable(self):
+        # Phase 2 registered the image processor: a real JPEG is accepted
+        # and its category flows to the job/pipeline.
+        assert validate_upload("photo.jpg", b"\xff\xd8\xff\xe0" + b"x" * 32) == "image"
+
+    def test_office_file_accepted_when_libreoffice_is_available(self, monkeypatch):
+        # Phase 3 registered the office processor; acceptance depends on
+        # the machine having LibreOffice (patched here — the dev/CI boxes
+        # don't have it, which is exactly the state the next test pins).
+        monkeypatch.setattr(
+            "app.processors.office.OfficeProcessor.available", lambda self: True
+        )
+        assert validate_upload("invoice.docx", make_docx_bytes()) == "office"
+
+    def test_office_file_refused_with_an_actionable_message_when_unavailable(
+        self, monkeypatch
+    ):
+        # The kill switch / missing LibreOffice: registered, but not
+        # runnable — the message must say what to DO, not just "no".
+        monkeypatch.setattr(
+            "app.processors.office.OfficeProcessor.available", lambda self: False
+        )
+        with pytest.raises(UploadError, match="LibreOffice") as exc_info:
+            validate_upload("invoice.docx", make_docx_bytes())
+        assert exc_info.value.status_code == 415
+
+    def test_text_files_are_now_printable(self):
+        # Phase 4 registered the text processor; text has no magic bytes,
+        # so the extension is the trusted signal here (detection.py).
+        assert validate_upload("notes.txt", b"just some plain text content") == "text"
+        assert validate_upload("data.csv", b"a,b,c\n1,2,3") == "text"
+
+    def test_unregistered_category_refused_until_its_phase(self, monkeypatch):
+        # All current categories are registered, so the "later phase" gate
+        # has no natural case left — simulate a future category whose
+        # processor isn't registered yet to keep the branch honest.
+        monkeypatch.setattr(
+            "app.services.uploads.for_category", lambda category: None
+        )
+        with pytest.raises(UploadError, match="later phase") as exc_info:
+            validate_upload("notes.txt", b"just some plain text content")
+        assert exc_info.value.status_code == 415
+
+    def test_no_filename_and_unknown_content_is_unsupported(self):
+        # No extension to hint from AND no magic to prove anything with —
+        # the honest answer is "unsupported", not a guess.
+        with pytest.raises(UploadError, match="no extension"):
+            validate_upload("", b"random junk")
+
+    def test_macro_office_formats_rejected_by_policy(self):
+        # Macro-enabled formats are refused before anything else looks at
+        # the content (plan Section 9) — policy, not a content check.
+        with pytest.raises(UploadError, match="[Mm]acro") as exc_info:
+            validate_upload("invoice.docm", b"PK\x03\x04 whatever")
         assert exc_info.value.status_code == 415
 
     def test_too_large_rejected_with_413(self, monkeypatch):
         monkeypatch.setattr(uploads, "MAX_UPLOAD_MB", 1)
         five_bytes_over = b"%PDF-" + b"x" * (1024 * 1024)
         with pytest.raises(UploadError, match="limit is 1 MB") as exc_info:
-            validate_pdf("big.pdf", five_bytes_over)
+            validate_upload("big.pdf", five_bytes_over)
         assert exc_info.value.status_code == 413
 
     def test_exactly_at_limit_passes(self, monkeypatch):
         # The check is strictly '>' — a file AT the limit is legitimate.
         monkeypatch.setattr(uploads, "MAX_UPLOAD_MB", 1)
         exactly_one_mb = b"%PDF-" + b"x" * (1024 * 1024 - 5)
-        validate_pdf("big.pdf", exactly_one_mb)  # no raise
+        assert validate_upload("big.pdf", exactly_one_mb) == "pdf"
 
 
 class TestSaveUpload:
@@ -61,6 +151,12 @@ def test_stores_bytes_under_job_id_name(self, tmp_upload_dir):
         assert path == tmp_upload_dir / f"{job_id}.pdf"
         assert path.read_bytes() == b"%PDF-hello"
 
+    def test_extension_is_stored_with_the_file(self, tmp_upload_dir):
+        # Non-PDF phases will store the real extension; the mechanism
+        # already works (and keeps a client's ".JPG" lowercase).
+        job_id, path = save_upload(b"\xff\xd8\xffjpg-bytes", ext=".jpg")
+        assert path == tmp_upload_dir / f"{job_id}.jpg"
+
     def test_job_ids_are_unique(self, tmp_upload_dir):
         first_id, _ = save_upload(b"%PDF-a")
         second_id, _ = save_upload(b"%PDF-b")
@@ -76,24 +172,45 @@ class TestUploadPath:
     def test_job_id_maps_to_pdf_file_in_upload_dir(self, tmp_upload_dir):
         assert upload_path("abc123") == tmp_upload_dir / "abc123.pdf"
 
+    def test_extension_parameter_maps_the_same_way(self, tmp_upload_dir):
+        assert upload_path("abc123", ".jpg") == tmp_upload_dir / "abc123.jpg"
+
+
+class TestDeleteJobFiles:
+    def test_deletes_every_file_of_a_job_and_reports_count(self, tmp_upload_dir):
+        # A job can own several files (source upload + converted PDF once
+        # non-PDF formats land) — cleanup must take them all, only them.
+        tmp_upload_dir.mkdir(parents=True)
+        (tmp_upload_dir / "job-1.pdf").write_bytes(b"x")
+        (tmp_upload_dir / "job-1.jpg").write_bytes(b"x")
+        (tmp_upload_dir / "other.pdf").write_bytes(b"x")
+
+        assert delete_job_files("job-1") == 2
+        assert (tmp_upload_dir / "other.pdf").exists()
+
+    def test_missing_job_is_a_clean_no_op(self, tmp_upload_dir):
+        tmp_upload_dir.mkdir(parents=True)
+        assert delete_job_files("ghost") == 0
+
 
 class TestSweepStaleUploads:
-    def test_removes_only_pdfs_and_reports_count(self, tmp_upload_dir):
+    def test_removes_every_stale_file_and_reports_count(self, tmp_upload_dir):
+        # uploads/ is service-managed (every name in it is server-generated),
+        # so ANY file left by a previous run is stale — including files of
+        # formats that didn't exist when the sweep was PDF-only.
         tmp_upload_dir.mkdir(parents=True)
-        for name in ("a.pdf", "b.pdf", "c.pdf"):
+        for name in ("a.pdf", "b.pdf", "c.jpg"):
             (tmp_upload_dir / name).write_bytes(b"%PDF-x")
-        (tmp_upload_dir / "keep.txt").write_bytes(b"not a pdf")
 
         removed = sweep_stale_uploads()
 
         assert removed == 3
-        assert list(tmp_upload_dir.glob("*.pdf")) == []
-        assert (tmp_upload_dir / "keep.txt").exists()
+        assert list(tmp_upload_dir.iterdir()) == []
 
     def test_directory_named_like_a_pdf_never_crashes_the_sweep(self, tmp_upload_dir):
-        # A directory called "weird.pdf" matches the glob but can't be
-        # unlink()ed — the OSError guard must swallow it (Section 8: cleanup
-        # must never crash the service).
+        # A directory called "weird.pdf" must be skipped (is_file check),
+        # not crash the sweep (Section 8: cleanup must never crash the
+        # service) and not be deleted either.
         tmp_upload_dir.mkdir(parents=True)
         (tmp_upload_dir / "weird.pdf").mkdir()
         (tmp_upload_dir / "good.pdf").write_bytes(b"%PDF-x")