diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 83c92b7..1360115 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -81,6 +81,57 @@ jobs:
       - name: Test
         run: vendor/bin/pest
 
+  # The decks the library writes, checked against the schema Microsoft's own validator
+  # reads.
+  #
+  # Its own job rather than a step in the test matrix, because the validator is a .NET
+  # program: the SDK it is built and run with is a second toolchain, and the job that
+  # installs it is the job that runs the gate.
+  #
+  # `--fail-on-skipped` because the test skips itself where the .NET SDK is missing, and
+  # a skipped test is a green tick for a check that never ran. The rasteriser is
+  # installed for the same reason: the deck carrying an SVG cannot be written without
+  # one, and a gate that checked one deck fewer than the gallery holds would be a gate
+  # that says less than it says.
+  conformance:
+    name: valid OOXML
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        with:
+          php-version: '8.5'
+          coverage: none
+          tools: composer:v2
+          extensions: imagick
+
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
+        with:
+          dotnet-version: '8.0.x'
+
+      # The delegate ImageMagick hands an SVG to. Without one that can draw a letter the
+      # picture in the deck is refused rather than drawn, and the deck is not written at
+      # all — which would leave the gate checking one deck fewer than the gallery holds.
+      - name: A rasteriser that can draw an SVG
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends librsvg2-bin
+
+      - name: Install
+        run: composer install --prefer-dist --no-interaction --no-progress
+
+      - name: What the runner has
+        run: |
+          php -r 'var_dump(extension_loaded("imagick"));'
+          php -r 'print_r(Imagick::queryFormats("*SVG*"));'
+          convert -list format 2>/dev/null | grep -i svg || echo "no convert"
+          convert -list delegate 2>/dev/null | grep -i svg || echo "no delegate"
+          fc-list 2>/dev/null | head -3 || echo "no fonts"
+
+      - name: The decks are valid OOXML
+        run: vendor/bin/pest --testsuite=conformance --fail-on-skipped
+
   coverage:
     name: coverage
     runs-on: ubuntu-latest
diff --git a/.gitignore b/.gitignore
index 646b245..48b1714 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,6 +30,10 @@
 # The OOXML schemas `tools/install-ooxml-schemas.php` fetches and checksums.
 /tools/ooxml-schemas/
 
+# The validator's own build output, which the .NET SDK writes beside the project.
+/tools/ooxml-validator/bin/
+/tools/ooxml-validator/obj/
+
 # The fonts `tools/generate-font-metrics.php` fetches and checksums.
 /tools/fonts/
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a816266..98e8614 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,34 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+
+- **Every deck the library writes is checked against the schema Microsoft's own validator
+  reads.** Nothing in the suite could see that before: the decks were checked against the
+  parts they carry, and a deck whose XML is outside the schema passes every one of those
+  checks and opens in PowerPoint as `[Repaired]`.
+
+  The validator is Microsoft's own — the one the Open XML SDK Productivity Tool uses — and
+  it is a program in `tools/ooxml-validator/` rather than a dependency: nothing that ships
+  with the library needs it. A machine without the .NET SDK runs the rest of the suite and
+  says what is missing, and the job that runs the gate in continuous integration installs
+  it, so the gate cannot skip itself there.
+
+### Changed
+
+- **The patch carries one more fix from upstream.** A chart's series is written in the
+  order the schema names it: the shape properties right after the title rather than after
+  the data points and the data labels, and the separator of the data labels of a doughnut
+  before the leader lines rather than after them. PowerPoint repairs a chart written the
+  other way round before it opens it
+  ([#695](https://github.com/PHPOffice/PHPPresentation/issues/695),
+  [#1044](https://github.com/PHPOffice/PHPPresentation/pull/1044)).
+
+  This library writes no chart, so nothing it draws changes: the patch is upstream's
+  branch whole, and the fix belongs to that branch rather than to this one.
+
 ## [0.3.0] - 2026-10-30
 
 ### Added
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index a1711a3..2fa63bf 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -146,6 +146,17 @@ it would import the file through a lossy converter and report nothing about whet
 is valid. PowerPoint is the only application on this machine that will tell the truth about
 whether these decks open.
 
+### The schema is checked by Microsoft's own validator
+
+A deck whose XML is outside the schema opens in PowerPoint as `[Repaired]`, and the
+checks written by hand here did not catch that. `tests/Conformance/ooxml.php` runs
+Microsoft's Open XML validator — the one the Open XML SDK Productivity Tool uses — over
+every deck the library writes, and the program that does it is in `tools/ooxml-validator/`.
+
+It is a .NET program, so a machine without the SDK skips that test and says what is
+missing; the job that runs it in continuous integration installs it, so the gate cannot
+skip itself there.
+
 ## What a change has to pass
 
 ```
diff --git a/composer.json b/composer.json
index 4064e28..4815a58 100644
--- a/composer.json
+++ b/composer.json
@@ -39,9 +39,9 @@
         "patches": {
             "phpoffice/phppresentation": [
                 {
-                    "description": "PHPPresentation 1.2.0 brought up to upstream's master, with the fixes that give a picture the path, the bytes and the name it was read from, and that find the folder of a part of a package with the slashes of the package",
-                    "url": "https://raw.githubusercontent.com/markdown-office/PHPPresentation/9aa3f4624f1cab54fc5d275397c2fc59cf6f276d/patches/phpoffice-phppresentation-1.2.0-to-master.patch",
-                    "sha256": "0b8f7c150f7ba5d12671fb9e211c9f1a4db549d7609239f49c0cea707a190551"
+                    "description": "PHPPresentation 1.2.0 brought up to upstream's master, with the fixes that give a picture the path, the bytes and the name it was read from, that find the folder of a part of a package with the slashes of the package, and that write a chart series in the order the schema names it",
+                    "url": "https://raw.githubusercontent.com/markdown-office/PHPPresentation/92c2c64ca20a6b3febf6512e892b21a3c0ae4b56/patches/phpoffice-phppresentation-1.2.0-to-master.patch",
+                    "sha256": "67ce1a44e76e4dc23639fefee365ec811ef7a763331343bde468ae781bf5427a"
                 }
             ]
         }
@@ -69,6 +69,7 @@
     "scripts": {
         "test": "pest",
         "test:unit": "pest --testsuite=unit",
+        "test:conformance": "pest --testsuite=conformance",
         "test:readme": "pest --testsuite=readme",
         "test:coverage": "php -d memory_limit=-1 vendor/bin/pest --coverage --min=100",
         "analyse": "tools/phpstan.sh",
diff --git a/examples/build.php b/examples/build.php
index a2653f6..8b92085 100644
--- a/examples/build.php
+++ b/examples/build.php
@@ -12,22 +12,11 @@
  */
 
 require_once __DIR__ . '/../vendor/autoload.php';
+require_once __DIR__ . '/decks.php';
 
 use MarkdownPresentation\Document\DeckParser;
 use MarkdownPresentation\Render\PresentationRenderer;
 
-/**
- * The sources this script does not convert, and why.
- *
- * Keyed by the file's stem. A deck is here because converting it is the failure it
- * exists to demonstrate, which is the same reason `markdown-word` does not build its
- * `14-rejected.md`: the build would stop, or — worse — would not stop and the gallery
- * would contain a deck that quietly came out wrong.
- */
-const NOT_BUILT = [
-    '10-rejected' => 'converting it is the failure it exists to demonstrate; see examples/README.md',
-];
-
 /** Where the decks, their PDFs and their previews are written. */
 const OUT = __DIR__ . '/out';
 
@@ -37,19 +26,6 @@
 /** The directory a relative image path in a deck resolves against. */
 const SOURCES = __DIR__ . '/markdown';
 
-/**
- * The sources written more than once, and the one line each copy differs in.
- *
- * A theme is a frontmatter key, so the only way to see the three palettes side by side is
- * to write the same deck three times. Varying it here rather than in three files keeps
- * the three decks identical apart from the one line, which is the point of the
- * comparison.
- */
-const VARIANTS = [
-    '03-themes' => ['theme' => ['default', 'corporate-dark', 'minimal']],
-    '11-type-scale' => ['theme' => ['default', 'dense']],
-];
-
 /**
  * What each built deck is for, for the report at the end and for nothing else.
  */
diff --git a/examples/decks.php b/examples/decks.php
new file mode 100644
index 0000000..863e6e7
--- /dev/null
+++ b/examples/decks.php
@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * The decks the examples are written as.
+ *
+ * It is a file of its own because two things need it: the script that writes the decks,
+ * and the test that checks what it wrote against the schema. A list of its own in
+ * either of them would be a second answer to a question this file answers, and the two
+ * would drift — a deck the gallery no longer builds and the gate still checks, or the
+ * other way round, which is the worse of the two: a gate that says less than it says.
+ *
+ * Required rather than included, so that a second caller in the same run does not
+ * declare the constants again.
+ */
+
+/**
+ * The sources this script does not convert, and why.
+ *
+ * Keyed by the file's stem. A deck is here because converting it is the failure it
+ * exists to demonstrate, which is the same reason `markdown-word` does not build its
+ * `14-rejected.md`: the build would stop, or — worse — would not stop and the gallery
+ * would contain a deck that quietly came out wrong.
+ */
+const NOT_BUILT = [
+    '10-rejected' => 'converting it is the failure it exists to demonstrate; see examples/README.md',
+];
+
+/**
+ * The sources written more than once, and the one line each copy differs in.
+ *
+ * A theme is a frontmatter key, so the only way to see the three palettes side by side is
+ * to write the same deck three times. Varying it here rather than in three files keeps
+ * the three decks identical apart from the one line, which is the point of the
+ * comparison.
+ */
+const VARIANTS = [
+    '03-themes' => ['theme' => ['default', 'corporate-dark', 'minimal']],
+    '11-type-scale' => ['theme' => ['default', 'dense']],
+];
diff --git a/phpunit.xml.dist b/phpunit.xml.dist
index 383a647..c3c920a 100644
--- a/phpunit.xml.dist
+++ b/phpunit.xml.dist
@@ -15,6 +15,14 @@
         <testsuite name="unit">
             <directory suffix=".php">tests/Unit</directory>
         </testsuite>
+        <!--
+            The decks the library writes, checked against the schema Microsoft's own
+            validator reads. It needs the .NET SDK, which a machine without it does not
+            have, so the test skips itself there.
+        -->
+        <testsuite name="conformance">
+            <directory suffix=".php">tests/Conformance</directory>
+        </testsuite>
         <!--
             Every fenced example in README.md, run. The mechanism is described where
             it is written down — in tests/Support/Doctest.php.
diff --git a/tests/Conformance/ooxml.php b/tests/Conformance/ooxml.php
new file mode 100644
index 0000000..ab65da5
--- /dev/null
+++ b/tests/Conformance/ooxml.php
@@ -0,0 +1,149 @@
+<?php
+
+declare(strict_types=1);
+
+use MarkdownPresentation\Document\DeckParser;
+use MarkdownPresentation\Render\PresentationRenderer;
+use MarkdownPresentation\Render\SvgRasteriser;
+use MarkdownPresentation\Tests\Support\Doctest;
+use MarkdownPresentation\Tests\Support\Scratch;
+
+require_once dirname(__DIR__, 2) . '/examples/decks.php';
+
+/*
+ * Every deck this library writes, checked against the schema Microsoft's own validator
+ * reads — the one the Open XML SDK Productivity Tool uses.
+ *
+ * Nothing in this suite could see that before: the decks were checked against the parts
+ * they carry, and a deck whose XML is outside the schema passes every one of those
+ * checks and opens in PowerPoint as `[Repaired]`. The validator is the oracle, and it is
+ * a program in `tools/ooxml-validator/` rather than a library this package depends on:
+ * nothing that ships with the library needs it, and the suite runs without it.
+ *
+ * A machine with no .NET SDK says what is missing and skips the test. A green tick for a
+ * check that never ran is a check nobody made.
+ */
+
+it('writes decks that are valid OOXML', function () {
+    if (!hasDotnetSdk()) {
+        test()->markTestSkipped(
+            'The .NET SDK is not installed, so the Open XML validator cannot be run. '
+            . 'The job that runs this test in continuous integration installs it.',
+        );
+    }
+
+    $decks = writeExampleDecks();
+
+    [$status, $output] = validateWithOpenXml($decks);
+
+    // Every deck named, because a gate that checked nothing is not a gate. The validator
+    // prints one line per file and how many errors it holds, so a deck missing from the
+    // output is a deck that was not read — which is a failure, not a pass.
+    expect($decks)->not->toBe([]);
+
+    foreach ($decks as $deck) {
+        expect($output)->toContain(basename($deck) . ': 0 error(s)');
+    }
+
+    // The exit code is the tool's own answer, and it is what a caller that reads nothing
+    // else gets: 0 when every deck is clean, 1 when one of them is not, and 2 when the
+    // tool could not run at all. What the tool said is the message, because a failure
+    // here is a failure of the deck and the deck is what has to be looked at.
+    expect($status)->toBe(0, $output);
+});
+
+/**
+ * Whether this machine has the .NET SDK the validator is built with.
+ *
+ * The version rather than the path, because a machine with the runtime and not the SDK
+ * can run a program but not build one, and a path lookup would find the runtime and
+ * answer yes.
+ */
+function hasDotnetSdk(): bool
+{
+    exec('dotnet --version 2>&1', $output, $status);
+
+    return $status === 0;
+}
+
+/**
+ * Every deck the examples are written as, written into the scratch directory.
+ *
+ * The plan of the decks is the one `examples/decks.php` holds, because that is the file
+ * the script that writes them holds it in: a list of its own here would be a second
+ * answer to a question that already has one, and the two would drift. A deck the
+ * gallery no longer builds and the gate still checks is the worse of the two — a gate
+ * that says less than it says.
+ *
+ * @return list<string> The decks written, as paths.
+ */
+function writeExampleDecks(): array
+{
+    $sources = Doctest::root() . '/examples/markdown';
+    $directory = Scratch::directoryPath('decks');
+    $parser = new DeckParser();
+    $written = [];
+
+    foreach (glob($sources . '/*.md') ?: [] as $path) {
+        $stem = basename($path, '.md');
+
+        if (isset(NOT_BUILT[$stem])) {
+            continue;
+        }
+
+        $source = (string) file_get_contents($path);
+
+        // A deck carrying an SVG cannot be written by a build that cannot draw one, and
+        // the reason names the capability rather than the deck: the library refuses that
+        // picture in such a build, so there is no deck to be asked about.
+        if (str_contains($source, '.svg)') && !(new SvgRasteriser())->available()) {
+            test()->markTestSkipped(sprintf(
+                'This build cannot rasterise an SVG, and %s carries one to be drawn.',
+                $stem,
+            ));
+        }
+
+        // A deck written more than once is written once per theme, which the renderer is
+        // told rather than the source: the theme in the source's own frontmatter is the
+        // one the deck asked for, and the copy in the gallery is the same deck in another
+        // theme.
+        $themes = VARIANTS[$stem]['theme'] ?? [null];
+
+        foreach ($themes as $theme) {
+            $renderer = new PresentationRenderer($sources);
+
+            if ($theme !== null) {
+                $renderer->withTheme($theme);
+            }
+
+            $name = $theme === null ? $stem : $stem . '-' . $theme;
+            $target = sprintf('%s/%s.pptx', $directory, $name);
+
+            $renderer->render($parser->parse($source), $target);
+
+            $written[] = $target;
+        }
+    }
+
+    return $written;
+}
+
+/**
+ * What Microsoft's validator makes of the given decks: the exit code and what it said.
+ *
+ * @param list<string> $decks
+ *
+ * @return array{0: int, 1: string}
+ */
+function validateWithOpenXml(array $decks): array
+{
+    $command = sprintf(
+        'dotnet run --project %s -- %s 2>&1',
+        escapeshellarg(Doctest::root() . '/tools/ooxml-validator'),
+        implode(' ', array_map('escapeshellarg', $decks)),
+    );
+
+    exec($command, $output, $status);
+
+    return [$status, implode("\n", $output)];
+}
diff --git a/tests/Readme/examples-decks.php b/tests/Readme/examples-decks.php
index 6aa9a7c..3c8eecc 100644
--- a/tests/Readme/examples-decks.php
+++ b/tests/Readme/examples-decks.php
@@ -155,16 +155,16 @@ function runsOfShape(Pptx $pptx, string $name, int $slide = 1, int $index = 0):
 });
 
 it('builds every deck the page says it builds', function () use ($readme, $root) {
-    $build = (string) file_get_contents($root . '/examples/build.php');
+    $decks = (string) file_get_contents($root . '/examples/decks.php');
     preg_match_all('/`(\d{2}-[a-z-]+)\.md`\s*\|\s*\*\*nothing\*\*/', $readme, $declined);
 
     // A page that says a deck is not built has to be right about it: the reason has to be
-    // in `build.php`, keyed by the stem, or the deck stops being built for a reason nobody
-    // wrote down.
+    // in the plan of the decks, keyed by the stem, or the deck stops being built for a
+    // reason nobody wrote down.
     expect($declined[1])->not->toBe([]);
 
     foreach ($declined[1] as $name) {
-        expect($build)->toContain("'" . $name . "' => '");
+        expect($decks)->toContain("'" . $name . "' => '");
     }
 });
 
diff --git a/tools/ooxml-validator/Program.cs b/tools/ooxml-validator/Program.cs
new file mode 100644
index 0000000..e7d8185
--- /dev/null
+++ b/tools/ooxml-validator/Program.cs
@@ -0,0 +1,110 @@
+// Validates Office Open XML files against the schema, with Microsoft's own
+// validator — the one the Open XML SDK Productivity Tool uses.
+//
+// The exit code is the answer: 0 when every file is clean, 1 when one of them is
+// not, 2 when the tool was asked to do nothing it could do. A gate built on
+// anything else would be a gate on this suite's own opinion of the format rather
+// than on the format.
+
+using DocumentFormat.OpenXml;
+using DocumentFormat.OpenXml.Packaging;
+using DocumentFormat.OpenXml.Validation;
+
+if (args.Length == 0)
+{
+    Console.Error.WriteLine("usage: ooxml-validator [--version <FileFormatVersions>] <file>...");
+    return 2;
+}
+
+// Office2019 rather than the oldest version the SDK knows: the SDK validates
+// against the schema of the version it is given, and a document written for a
+// modern Word should be read as a modern Word would read it. Every file this
+// suite writes has been checked against every version the SDK knows, and the
+// errors are the same at all of them.
+var version = FileFormatVersions.Office2019;
+
+for (var i = 0; i < args.Length; i++)
+{
+    if (args[i] == "--version" && i + 1 < args.Length)
+    {
+        if (!Enum.TryParse<FileFormatVersions>(args[++i], ignoreCase: true, out version))
+        {
+            Console.Error.WriteLine($"not a version the SDK knows: {args[i]}");
+            return 2;
+        }
+
+        continue;
+    }
+
+    if (args[i].StartsWith("--"))
+    {
+        Console.Error.WriteLine($"unknown option: {args[i]}");
+        return 2;
+    }
+}
+
+var files = args.Where(argument => !argument.StartsWith("--")).ToList();
+
+if (files.Count == 0)
+{
+    Console.Error.WriteLine("no files to validate");
+    return 2;
+}
+
+var errors = 0;
+
+foreach (var file in files)
+{
+    if (!File.Exists(file))
+    {
+        Console.Error.WriteLine($"{file}: no such file");
+        errors++;
+        continue;
+    }
+
+    var extension = Path.GetExtension(file).ToLowerInvariant();
+
+    try
+    {
+        errors += extension switch
+        {
+            ".docx" or ".docm" or ".dotx" or ".dotm" => Validate(file, WordprocessingDocument.Open(file, false), version),
+            ".pptx" or ".pptm" or ".potx" or ".potm" => Validate(file, PresentationDocument.Open(file, false), version),
+            _ => Unknown(file),
+        };
+    }
+    catch (Exception exception)
+    {
+        // A file the SDK cannot open is a file the gate cannot pass, so it counts
+        // as an error rather than as a reason to give up.
+        Console.Error.WriteLine($"{file}: could not be opened: {exception.Message}");
+        errors++;
+    }
+}
+
+Console.WriteLine(errors == 0
+    ? $"{files.Count} file(s) checked against {version}: no errors"
+    : $"{files.Count} file(s) checked against {version}: {errors} error(s)");
+
+return errors == 0 ? 0 : 1;
+
+static int Validate(string file, OpenXmlPackage package, FileFormatVersions version)
+{
+    var found = new OpenXmlValidator(version).Validate(package).ToList();
+
+    Console.WriteLine($"{file}: {found.Count} error(s)");
+
+    foreach (var error in found)
+    {
+        Console.WriteLine($"  [{error.ErrorType}] {error.Description}");
+        Console.WriteLine($"    part={error.Part?.Uri} path={error.Path?.XPath}");
+    }
+
+    return found.Count;
+}
+
+static int Unknown(string file)
+{
+    Console.Error.WriteLine($"{file}: not a Word or PowerPoint file");
+    return 1;
+}
diff --git a/tools/ooxml-validator/README.md b/tools/ooxml-validator/README.md
new file mode 100644
index 0000000..e78c508
--- /dev/null
+++ b/tools/ooxml-validator/README.md
@@ -0,0 +1,38 @@
+# The OOXML validator
+
+A console program that opens a `.docx` or a `.pptx` and reports what Microsoft's
+Open XML SDK makes of it. It is the oracle the gate in this repository is measured
+against, so it is not a dependency of the library — nothing the library ships
+depends on it, and the library's own suite does not need it to run.
+
+## Running it
+
+```bash
+dotnet run --project tools/ooxml-validator -- path/to/document.docx
+dotnet run --project tools/ooxml-validator -- --version Office2007 path/to/document.docx
+```
+
+The exit code is the answer: `0` when every file is clean, `1` when one of them is
+not, `2` when there was nothing to check. The errors are printed one per line with
+the part they are in and the path to them, which is what a fix needs to be pointed
+at.
+
+## Why this and not the schema
+
+The schema in ECMA-376 is the definition of the format, and a document that breaks
+it is a document that is not what it claims to be. The SDK reads the same schema,
+and it is the reader the Open XML SDK Productivity Tool — the tool Microsoft's own
+documentation points at — uses. A gate built on it is a gate on the format rather
+than on this suite's opinion of it.
+
+The SDK is also stricter than the schema in a few places, and those places are
+named in the pull requests rather than papered over: `w:tblHeader` and
+`w:bidiVisual` carry an on/off value the SDK reads as `on` or `off` alone, where
+the schema's `ST_OnOff` also allows `1` and `0`.
+
+## Where it runs
+
+The gate that uses it is a job in `.github/workflows/tests.yml`, which installs the
+.NET SDK with `actions/setup-dotnet` before the suite runs. A machine without the
+.NET SDK can still run the rest of the suite; the test that uses this tool skips
+itself there and says why.
diff --git a/tools/ooxml-validator/ooxml-validator.csproj b/tools/ooxml-validator/ooxml-validator.csproj
new file mode 100644
index 0000000..cdcd657
--- /dev/null
+++ b/tools/ooxml-validator/ooxml-validator.csproj
@@ -0,0 +1,25 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <!-- The lowest runtime the tool asks for. A newer runtime runs it unchanged,
+         so the runner's SDK does not have to match the target framework. -->
+    <TargetFramework>net8.0</TargetFramework>
+    <!-- A machine with only a newer runtime can still run this. Without it the
+         runtime refuses the application, and the gate would be a gate on the
+         version of .NET the runner happens to have. -->
+    <RollForward>Major</RollForward>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <RootNamespace>OoxmlValidator</RootNamespace>
+    <AssemblyName>ooxml-validator</AssemblyName>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <!-- The version is pinned rather than ranged, because the validator is the
+         oracle the gate is measured against: a different version of it may find
+         different errors, and a gate whose oracle moves is not a gate. -->
+    <PackageReference Include="DocumentFormat.OpenXml" Version="3.3.0" />
+  </ItemGroup>
+
+</Project>