A Word OLE link can change without an embedded payload

An OLE object in a Word package does not always live as opaque bytes under word/embeddings. Legacy VML can instead carry an OLE object explicitly typed as a link, whose source is identified through an external oleObject relationship.

That is a separate review boundary from an embedded OLE payload: ordinary stored text, the VML object carrier, and the full package-member set can remain unchanged while the linked source is retargeted.

Document Change Assurance Benchmark (DCAB) 0.15.0 adds a deterministic case for it: external.vml_linked_ole_object_target_retargeted.

word/document.xml
  w:object
    v:shape id="fixed placeholder" o:ole=""
    o:OLEObject Type="Link" r:id="rIdLinkedOleObject"

word/_rels/document.xml.rels
  rIdLinkedOleObject --oleObject, External--> private source

Microsoft's VML o:OLEObject reference documents the Word w:object carrier, relationship lookup through r:id, VML placeholder association via ShapeID, and the link-specific UpdateMode. Its Office compatibility notes describe the type as distinguishing an object stored externally from one included in the package.

The pair fixes one w:object carrier, one sibling VML placeholder, Type="Link", the ProgID, shape/object IDs, visual aspect, update mode, relationship ID, package members, and stored w:t values. It has no word/embeddings payload part. The only changed member is word/_rels/document.xml.rels, where a synthetic example.invalid target changes.

The benchmark remains deliberately static: it does not open Word, render VML, resolve or retrieve a source, parse or activate an OLE object, launch an application, authenticate to a target, or claim client update/display behavior. The public truth exposes only a target-free fact and reference review convention.

The optional DocFence adapter maps aggregate external_relationships_changed, embedded_object_inventory_changed, and word_vml_linked_ole_object_inventory_changed evidence without publishing targets, IDs, ProgIDs, update modes, paths, or document text. Hosted CI passes on Python 3.11–3.13 plus a clean pinned adapter job; fresh release installs and the public Hugging Face dataset mirror validate the complete 26-case corpus.

python -m pip install https://github.com/SybilGambleyyu/document-change-benchmark/releases/download/v0.15.0/document_change_benchmark-0.15.0-py3-none-any.whl
dcab validate
dcab docfence-observations --executable docfence --output observations.json
dcab score --observations observations.json --strict

The full release note explains the topology, evidence, and non-goals: A Word OLE link can change without an embedded payload.