From bf8d2b337b584fda57324fe653971d35233e268b Mon Sep 17 00:00:00 2001
From: srt8hellcat2-ui <225485253+srt8hellcat2-ui@users.noreply.github.com>
Date: Mon, 12 Oct 2026 13:09:31 +0000
Subject: [PATCH 001/270] feat(ui): add optional two-paged CLI flag (#1354)

---
 README.md                       |   2 +
 apps/pdfcraft/src/main.rs       |  40 +++------
 apps/pdfcraft/src/startup.rs    | 153 ++++++++++++++++++++++++++++++++
 crates/ui-egui/src/lib.rs       |  25 ++++++
 crates/ui-egui/tests/editing.rs |  53 +++++++++++
 5 files changed, 246 insertions(+), 27 deletions(-)
 create mode 100644 apps/pdfcraft/src/startup.rs

diff --git a/README.md b/README.md
index b20179fff4..e3813760d8 100644
--- a/README.md
+++ b/README.md
@@ -133,6 +133,8 @@ Search the whole document as you type, step through matches with <kbd>⌘G</kbd>
 
 ## Navigate long documents
 
+Launch with `pdfcraft --two-paged file.pdf` (or `pdfcraft file.pdf --two-paged`) to open each command-line PDF in noncontinuous two-page view. This optional launch override does not change saved default-layout preferences or PDFs restored from the previous session. An explicit `--layout` option takes precedence on the active document regardless of argument order; `--default-layout` retains its existing behavior for subsequently opened documents.
+
 Right-click a PDF tab to close it, reopen the last closed file-backed tab, or reveal its file. Closing still asks about unsaved changes. Reopening reads the saved file from disk; it does not restore discarded edits. Reveal selects the file in Explorer or Finder. On Linux and FreeBSD it requests `org.freedesktop.FileManager1.ShowItems`, falling back to opening the containing directory with `xdg-open` when that service is unavailable. Reopen and Reveal are unavailable on the web; Reveal is also unavailable for pathless documents.
 
 Bookmarks, page thumbnails and the document's own page labels (i, ii, 1, 2…) keep you oriented in long documents. Search bookmark titles in the Bookmarks panel to find nested entries even when their parents are collapsed. Matches keep their ancestors for context; Clear restores the unfiltered tree without changing its expansion state.
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index c66d2c68f5..348689a5c0 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -1,6 +1,8 @@
 //! PdfCraft desktop app.
 //!
 //! Usage: `pdfcraft [options] [files…]`
+//! `--two-paged` opens each command-line PDF in noncontinuous two-page view, without changing defaults.
+//! An explicit `--layout` takes precedence for the active document, regardless of argument order.
 //! `--create-images [images…]` stages the images in one PDF and asks for the page DPI.
 //!
 //! View options (applied after the files open; also the seed of the UI control channel):
@@ -37,6 +39,7 @@ mod logging;
 mod motion;
 mod reopen;
 mod single_instance;
+mod startup;
 mod text_scale;
 mod updates;
 #[cfg(test)]
@@ -146,28 +149,13 @@ fn main() -> eframe::Result {
             let _ = std::io::Write::write_fmt(&mut std::io::stderr(), format_args!("pdfcraft: {report}\n"));
         }
     }));
-    let mut files = Vec::new();
-    let mut options: Vec<(String, String)> = Vec::new();
-    let mut control_file: Option<String> = None;
-    let mut create_images = false;
-    let mut new_window = false;
-    let mut args = std::env::args().skip(1);
-    while let Some(a) = args.next() {
-        match a.as_str() {
-            "--version" => {
-                println!("pdfcraft {}", env!("CARGO_PKG_VERSION"));
-                return Ok(());
-            }
-            "--control" => control_file = args.next(),
-            "--create-images" => create_images = true,
-            "--new-window" => new_window = true,
-            flag if flag.starts_with("--") => {
-                let value = args.next().unwrap_or_default();
-                options.push((flag.trim_start_matches("--").to_string(), value));
-            }
-            _ => files.push(path_from_arg(a)),
-        }
+    let startup = startup::Arguments::parse(std::env::args().skip(1));
+    if startup.version {
+        println!("pdfcraft {}", env!("CARGO_PKG_VERSION"));
+        return Ok(());
     }
+    let may_hand_off = startup.may_hand_off();
+    let startup::Arguments { files, options, control_file, create_images, two_paged, .. } = startup;
     let integrated = cfg!(target_os = "macos");
     migrate_legacy_folders();
     // The log file lives in the settings folder; opened after the arguments (so `--version` leaves
@@ -183,14 +171,13 @@ fn main() -> eframe::Result {
     // Windows: a launch that only names files (an Outlook attachment, an Explorer double-click)
     // hands them to the PdfCraft already running and exits (#282, #317). Any option means the
     // caller wants this launch's own window.
-    let may_hand_off = !new_window && !files.is_empty() && options.is_empty() && control_file.is_none() && !create_images;
     let instance = match single_instance::claim(&single_instance::absolute(&files), may_hand_off) {
         single_instance::Claim::HandedOff => return Ok(()),
         single_instance::Claim::Primary(server) => Some(server),
         single_instance::Claim::Alone => None,
     };
     let choice = renderer_choice(std::env::var("PDFCRAFT_RENDERER").ok().as_deref());
-    let launch = Launch { files, options, control_file, create_images, integrated };
+    let launch = Launch { files, options, control_file, create_images, integrated, two_paged };
     // Finder, Open With and the Dock deliver files as Apple events, not arguments; catch the one
     // that launched us as well as later ones. Lives until the event loop returns.
     #[cfg(target_os = "macos")]
@@ -291,6 +278,7 @@ struct Launch {
     control_file: Option<String>,
     create_images: bool,
     integrated: bool,
+    two_paged: bool,
 }
 
 fn app_creator<'a>(
@@ -299,7 +287,7 @@ fn app_creator<'a>(
     instance: Option<&'a single_instance::Server>,
     #[cfg(target_os = "macos")] apple_events: &'a apple_events::AppleEvents,
 ) -> eframe::AppCreator<'a> {
-    let Launch { files, options, control_file, create_images, integrated } = launch;
+    let Launch { files, options, control_file, create_images, integrated, two_paged } = launch;
     Box::new(move |cc| {
         started.set(true);
         let mut app = PdfCraftApp::new();
@@ -366,9 +354,7 @@ fn app_creator<'a>(
             // With the preference on, last session's files come back first; files named on
             // the command line open after them, in front (#442).
             app.reopen_last_files(&files);
-            for f in files {
-                app.open_path(&f);
-            }
+            startup::open_files(&mut app, &files, two_paged);
         }
         for (k, v) in options {
             if let Err(e) = app.set_option(&k, &v) {
diff --git a/apps/pdfcraft/src/startup.rs b/apps/pdfcraft/src/startup.rs
new file mode 100644
index 0000000000..50ae1198d7
--- /dev/null
+++ b/apps/pdfcraft/src/startup.rs
@@ -0,0 +1,153 @@
+//! Native launch arguments and per-file view overrides (#1354).
+use pdfcraft_ui_egui::PdfCraftApp;
+
+#[derive(Default)]
+pub(super) struct Arguments {
+    pub files: Vec<String>,
+    pub options: Vec<(String, String)>,
+    pub control_file: Option<String>,
+    pub create_images: bool,
+    pub new_window: bool,
+    pub two_paged: bool,
+    pub version: bool,
+}
+
+impl Arguments {
+    pub fn may_hand_off(&self) -> bool {
+        !self.new_window && !self.files.is_empty() && self.options.is_empty() && self.control_file.is_none() && !self.create_images && !self.two_paged
+    }
+
+    pub fn parse(args: impl IntoIterator<Item = String>) -> Self {
+        let mut parsed = Self::default();
+        let mut args = args.into_iter();
+        while let Some(a) = args.next() {
+            match a.as_str() {
+                "--version" => {
+                    parsed.version = true;
+                    break;
+                }
+                "--control" => parsed.control_file = args.next(),
+                "--create-images" => parsed.create_images = true,
+                "--new-window" => parsed.new_window = true,
+                "--two-paged" => parsed.two_paged = true,
+                flag if flag.starts_with("--two-paged=") => {
+                    // It has no value: do not consume the following filename on malformed use.
+                    log::warn!("{flag}: use --two-paged without a value");
+                }
+                flag if flag.starts_with("--") => {
+                    let value = args.next().unwrap_or_default();
+                    parsed.options.push((flag.trim_start_matches("--").to_string(), value));
+                }
+                _ => parsed.files.push(super::path_from_arg(a)),
+            }
+        }
+        parsed
+    }
+}
+
+pub(super) fn open_files(app: &mut PdfCraftApp, files: &[String], two_paged: bool) {
+    for path in files {
+        if two_paged {
+            // The per-file override wins over initial view without changing saved defaults.
+            app.open_path_with_display(path, pdfcraft_ui_egui::canvas::PageLayout::TwoUp, false);
+        } else {
+            app.open_path(path);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn parse(args: &[&str]) -> Arguments {
+        Arguments::parse(args.iter().map(|s| s.to_string()))
+    }
+
+    #[test]
+    fn standalone_flag_keeps_files_in_either_position() {
+        for args in
+            [["--two-paged", "first.pdf", "second.pdf"], ["first.pdf", "--two-paged", "second.pdf"], ["first.pdf", "second.pdf", "--two-paged"]]
+        {
+            let parsed = parse(&args);
+            assert!(parsed.two_paged);
+            assert_eq!(parsed.files, ["first.pdf", "second.pdf"]);
+            assert!(parsed.options.is_empty());
+            assert!(!parsed.may_hand_off());
+        }
+        let empty = parse(&["--two-paged"]);
+        assert!(empty.two_paged && empty.files.is_empty());
+        let normal = parse(&["first.pdf", "second.pdf"]);
+        assert!(!normal.two_paged);
+        assert!(normal.may_hand_off());
+        for args in [
+            &["--new-window", "first.pdf"][..],
+            &["--layout", "two-page", "first.pdf"],
+            &["--control", "control.json", "first.pdf"],
+            &["--create-images", "first.png"],
+        ] {
+            assert!(!parse(args).may_hand_off());
+        }
+    }
+
+    #[test]
+    fn existing_layout_options_are_preserved_in_either_order() {
+        for args in [["--two-paged", "--layout", "single", "file.pdf"], ["--layout", "single", "--two-paged", "file.pdf"]] {
+            let parsed = parse(&args);
+            assert!(parsed.two_paged);
+            assert_eq!(parsed.files, ["file.pdf"]);
+            assert_eq!(parsed.options, [("layout".into(), "single".into())]);
+        }
+        let parsed = parse(&["--two-paged", "--default-layout", "two-up", "file.pdf"]);
+        assert_eq!(parsed.options, [("default-layout".into(), "two-up".into())]);
+    }
+
+    #[test]
+    fn malformed_boolean_does_not_eat_a_file_or_option() {
+        let args = parse(&["--two-paged=false", "first.pdf", "--layout", "single", "second.pdf"]);
+        assert!(!args.two_paged);
+        assert_eq!(args.files, ["first.pdf", "second.pdf"]);
+        assert_eq!(args.options, [("layout".into(), "single".into())]);
+    }
+
+    #[test]
+    fn startup_override_is_per_file_and_does_not_persist() {
+        use std::io::Write as _;
+        let nonce = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+        let path = std::env::temp_dir().join(format!("pdfcraft-two-paged-{}-{nonce}.pdf", std::process::id()));
+        let mut file = std::fs::OpenOptions::new().create_new(true).write(true).open(&path).unwrap();
+        file.write_all(include_bytes!("../../../crates/ui-egui/tests/data/form.pdf")).unwrap();
+        drop(file);
+        let text = path.to_str().unwrap();
+        for enabled in [false, true] {
+            let mut app = PdfCraftApp::new();
+            app.set_option("default-layout", "single").unwrap();
+            app.open_bytes("restored.pdf", None, include_bytes!("../../../crates/ui-egui/tests/data/form.pdf").to_vec()).unwrap();
+            let restored = app.views[0].id;
+            open_files(&mut app, &[text.into(), text.into()], enabled);
+            assert_eq!(app.views.len(), 3);
+            assert_eq!(app.views[0].id, restored);
+            assert_eq!(app.views[0].layout, pdfcraft_ui_egui::canvas::PageLayout::Single);
+            for view in app.views.iter().skip(1) {
+                assert_eq!(
+                    view.layout,
+                    if enabled { pdfcraft_ui_egui::canvas::PageLayout::TwoUp } else { pdfcraft_ui_egui::canvas::PageLayout::Single }
+                );
+                assert!(!view.continuous());
+            }
+            let persisted: serde_json::Value = serde_json::from_str(&app.persist()).unwrap();
+            assert_eq!(persisted["default_layout"], "single");
+            assert!(persisted.get("two_paged").is_none());
+            // Existing --layout applies after the flag to the active document only.
+            app.set_option("layout", "continuous").unwrap();
+            assert_eq!(app.views[2].layout, pdfcraft_ui_egui::canvas::PageLayout::Single);
+            assert!(app.views[2].continuous());
+            app.set_option("default-layout", "two-up").unwrap();
+            assert_eq!(app.view_defaults.layout, pdfcraft_ui_egui::canvas::PageLayout::TwoUp);
+            assert!(app.view_defaults.continuous);
+            open_files(&mut app, &[], enabled);
+            assert_eq!(app.views.len(), 3);
+        }
+        std::fs::remove_file(path).unwrap();
+    }
+}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 2d4f5b0993..f165f2754f 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -404,6 +404,8 @@ pub struct PasswordPrompt {
     then: Option<&'static str>,
     /// A link destination to apply after the linked PDF is unlocked.
     after_open: Option<pdfcraft_render::RemoteDestination>,
+    /// A launch-time display override, applied only after this PDF is unlocked.
+    display_override: Option<(canvas::PageLayout, bool)>,
 }
 
 /// Asks for the permissions password of an open document whose security restricts it, which
@@ -1056,6 +1058,7 @@ impl PdfCraftApp {
                     recovered: None,
                     then: None,
                     after_open: None,
+                    display_override: None,
                 });
                 return Ok(());
             }
@@ -1268,6 +1271,11 @@ impl PdfCraftApp {
                 if let Some(destination) = after_open {
                     self.apply_remote_destination(destination);
                 }
+                if let Some((layout, continuous)) = p.display_override
+                    && let Some(view) = self.views.last_mut()
+                {
+                    view.set_display(layout, continuous);
+                }
                 if let Some(meta) = &p.recovered {
                     self.finish_recovery(meta);
                 }
@@ -1282,6 +1290,7 @@ impl PdfCraftApp {
                     prompt.recovered = p.recovered;
                     prompt.then = p.then;
                     prompt.after_open = after_open;
+                    prompt.display_override = p.display_override;
                 }
             }
         }
@@ -1401,6 +1410,22 @@ impl PdfCraftApp {
         }
     }
 
+    /// Open one native file with a transient display override, including after a password prompt.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn open_path_with_display(&mut self, path: &str, layout: canvas::PageLayout, continuous: bool) {
+        let tabs = self.views.len();
+        self.open_path(path);
+        if self.views.len() > tabs {
+            if let Some(view) = self.views.last_mut() {
+                view.set_display(layout, continuous);
+            }
+        } else if let Some(prompt) = self.password_prompt.as_mut()
+            && prompt.path.as_deref() == Some(path)
+        {
+            prompt.display_override = Some((layout, continuous));
+        }
+    }
+
     /// The File ▸ Open picker: PDFs, and images and text that become PDFs.
     #[cfg(not(target_arch = "wasm32"))]
     fn open_picker() -> rfd::AsyncFileDialog {
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index 56e7cce300..0e62d6f52e 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -1892,6 +1892,59 @@ fn protected_with(algorithm: pdfcraft_cos::Algorithm, user: &str, owner: &str, p
     pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
 }
 
+#[test]
+fn launch_display_override_survives_password_retry_without_changing_defaults() {
+    use pdfcraft_ui_egui::canvas::PageLayout;
+    use std::io::Write as _;
+    let nonce = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+    let path = temp_path(&format!("startup-layout-{nonce}.pdf"));
+    let mut file = std::fs::OpenOptions::new().write(true).create_new(true).open(&path).unwrap();
+    file.write_all(&protected("reader", "owner", -4)).unwrap();
+    drop(file);
+    let mut app = PdfCraftApp::new();
+    app.set_option("default-layout", "continuous").unwrap();
+    app.open_path_with_display(path.to_str().unwrap(), PageLayout::TwoUp, false);
+    assert!(app.views.is_empty() && app.password_prompt.is_some());
+    app.submit_password(Some("wrong".into()));
+    assert!(app.views.is_empty() && app.password_prompt.is_some());
+    app.submit_password(Some("reader".into()));
+    assert_eq!(app.views.len(), 1);
+    assert_eq!(app.views[0].layout, PageLayout::TwoUp);
+    assert!(!app.views[0].continuous());
+    let persisted: serde_json::Value = serde_json::from_str(&app.persist()).unwrap();
+    assert_eq!(persisted["default_layout"], "continuous");
+    std::fs::remove_file(path).unwrap();
+}
+
+#[test]
+fn canceling_launch_display_override_does_not_affect_later_documents() {
+    use pdfcraft_ui_egui::canvas::PageLayout;
+    use std::io::Write as _;
+    let nonce = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+    let path = temp_path(&format!("startup-cancel-layout-{nonce}.pdf"));
+    let mut file = std::fs::OpenOptions::new().write(true).create_new(true).open(&path).unwrap();
+    file.write_all(&protected("reader", "owner", -4)).unwrap();
+    drop(file);
+    let mut app = PdfCraftApp::new();
+    app.set_option("default-layout", "continuous").unwrap();
+    app.open_path_with_display(path.to_str().unwrap(), PageLayout::TwoUp, false);
+    assert!(app.views.is_empty() && app.password_prompt.is_some());
+    app.submit_password(None);
+    assert!(app.views.is_empty() && app.password_prompt.is_none());
+    app.open_bytes("next.pdf", None, fixture(2)).unwrap();
+    assert_eq!(app.views[0].layout, PageLayout::Single);
+    assert!(app.views[0].continuous());
+    // Reopening the same protected file normally must not resurrect the canceled override.
+    app.open_path(path.to_str().unwrap());
+    app.submit_password(Some("reader".into()));
+    assert_eq!(app.views.len(), 2);
+    assert_eq!(app.views[1].layout, PageLayout::Single);
+    assert!(app.views[1].continuous());
+    let persisted: serde_json::Value = serde_json::from_str(&app.persist()).unwrap();
+    assert_eq!(persisted["default_layout"], "continuous");
+    std::fs::remove_file(path).unwrap();
+}
+
 #[test]
 fn password_prompt_opens_and_security_tab_reports_the_details() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {

From 69f80819e1a17e8d0a58cd09fe8f1d6726c6fd95 Mon Sep 17 00:00:00 2001
From: Philip <philip@philiptam.uk>
Date: Mon, 12 Oct 2026 21:04:06 +0100
Subject: [PATCH 002/270] M2: draw non-embedded CJK CID fonts with an installed
 face

A CID font of an Adobe CJK collection (Japan1, GB1, CNS1, Korea1) that the PDF
doesn't embed drew nothing unless craft-fonts had a Japanese face: text boxes
from Acrobat (Kozuka Gothic) and Pages (SongtiTC) were blank. After craft-fonts,
the renderer now uses one face already installed on the machine, read at
runtime and never bundled. The face of a multi-region collection (PingFang SC
or TC) is chosen by region. Noto CJK and Source Han are not candidates, and
PDFCRAFT_SYSTEM_FONTS=0 turns it off.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 ROADMAP.md                       |   1 +
 crates/render/Cargo.toml         |   4 +-
 crates/render/src/lib.rs         |   1 +
 crates/render/src/raster.rs      |  61 +++++++-
 crates/render/src/system_font.rs | 248 +++++++++++++++++++++++++++++++
 5 files changed, 312 insertions(+), 3 deletions(-)
 create mode 100644 crates/render/src/system_font.rs

diff --git a/ROADMAP.md b/ROADMAP.md
index 44a26604d8..b8fc5d6956 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -141,6 +141,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 ## Progress log
 
+- **2026-10-12 (M2, installed CJK fonts):** A CID font of an Adobe CJK collection (Japan1, GB1, CNS1, Korea1) that a PDF doesn't embed, such as the Kozuka Gothic of an Acrobat text box or the SongtiTC of a Pages export, drew nothing unless craft-fonts had a Japanese face. After craft-fonts, it now draws with a face already installed on the machine (PingFang, Heiti, Microsoft JhengHei / YaHei, Malgun and the like; read at runtime, never bundled; Noto CJK and Source Han excluded; `PDFCRAFT_SYSTEM_FONTS=0` turns it off). The face of a collection with several regions (PingFang SC, TC) is chosen by region. Checked on macOS with a synthetic Traditional Chinese, Simplified Chinese and Korean page; the Windows and Linux font lists are untested, and a machine with none of the listed faces still draws nothing.
 - **2026-10-12 (M1, #1339):** An incremental save of an unchanged classic-table file used to append `xref` and then `trailer` with no subsection, which qpdf reports as a damaged file. The section now has a zero-length subsection, so no object entry changes and a trailer-only edit is still written. Estimates unchanged.
 - **2026-10-12 (M12, auto-tag preview):** The engine and `accessibility_autotag_preview` propose paragraph and large-heading roles for bounded text blocks on one page, with locations and reasons. Every proposal needs review; images remain unclassified. No PDF tags are written yet. Synthetic tool tests cover normal text, a larger heading, bounds and unchanged source bytes. Estimates unchanged.
 - **2026-10-12 (M10, editing OCR text on scans):** Editing a recognised word on a scanned page now changes what the page shows. Before, the rewrite stayed invisible OCR text, so the scan still showed the old word; on a form, the whole OCR layer also grouped into one paragraph that rewrapped when one word changed. OCR words now group into phrases (a table cell or a tab stop splits them, and lines stay apart); an edit draws the phrase visibly in the scan's sampled ink colour over a cover in the sampled paper colour, keeping each word's width and growing rightwards. The editor covers the scanned word while typing. OCR words are now sized from their letters (a capitals-only word's box spans the cap height, not the full ascender-descender span), so recognised and rewritten text is as tall as the scanned word and sits on its baseline. Five engine tests on synthetic scans and a kittest UI test; `ocr.editable-text-output` is partial.
diff --git a/crates/render/Cargo.toml b/crates/render/Cargo.toml
index 28202a38b4..71467dfeb2 100644
--- a/crates/render/Cargo.toml
+++ b/crates/render/Cargo.toml
@@ -13,6 +13,8 @@ pdfcraft-cos = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 hayro = { workspace = true }
 hayro-syntax = { workspace = true }
+# Picks the face of an installed font collection (the version pdfcraft-fonts already uses).
+skrifa = "0.44"
 lopdf = { workspace = true }
 kurbo = { workspace = true }
 thiserror = { workspace = true }
@@ -27,7 +29,5 @@ bytemuck = { version = "1" }
 getrandom = { version = "0.4", features = ["wasm_js"] }
 
 [dev-dependencies]
-# Checks the Japanese substitute's character coverage; the version pdfcraft-fonts already uses.
-skrifa = "0.44"
 # Builds the decompression-bomb streams in the raster tests.
 flate2 = { workspace = true }
diff --git a/crates/render/src/lib.rs b/crates/render/src/lib.rs
index d2ee5712c4..90bc64b086 100644
--- a/crates/render/src/lib.rs
+++ b/crates/render/src/lib.rs
@@ -13,6 +13,7 @@ mod pixels;
 mod raster;
 mod reading;
 mod structure;
+mod system_font;
 pub mod text;
 
 pub use inspect::{
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 0e64ac241e..fe469958ae 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -73,7 +73,7 @@ impl RenderConfig {
         InterpreterSettings {
             ocg_overrides: self.layers.clone(),
             hide_comments: self.hide_comments,
-            font_resolver: Arc::new(move |query| japanese_fallback(query).or_else(|| standard(query))),
+            font_resolver: Arc::new(move |query| japanese_fallback(query).or_else(|| system_fallback(query)).or_else(|| standard(query))),
             ..InterpreterSettings::default()
         }
     }
@@ -106,6 +106,14 @@ fn japanese_fallback(query: &FontQuery) -> Option<(FontData, u32)> {
     Some((Arc::new(face.bytes), 0))
 }
 
+/// An installed face for a CID font of an Adobe CJK collection that the PDF doesn't embed and
+/// craft-fonts has no face for (Traditional and Simplified Chinese, Korean, and Japanese in a
+/// build without craft-fonts). `None` for every other font.
+fn system_fallback(query: &FontQuery) -> Option<(FontData, u32)> {
+    let FontQuery::Fallback(f) = query else { return None };
+    crate::system_font::fallback(f)
+}
+
 #[derive(Debug, PartialEq)]
 enum JapaneseFace {
     Mincho,
@@ -5515,6 +5523,57 @@ trailer << /Root 1 0 R >>
         }
     }
 
+    /// Chinese and Korean CID fonts that aren't embedded (Adobe-CNS1 `MSung-Light`, Adobe-GB1
+    /// `STSong-Light`, Adobe-Korea1 `HYGoThic-Medium`; Acrobat also writes Japanese `KozGoPr6N`
+    /// text boxes without the font) drew nothing, because craft-fonts has only Japanese faces.
+    /// They now draw in a face already installed on the machine, read at runtime. A machine
+    /// without such a face draws nothing, as before, so each check is skipped there.
+    #[test]
+    fn non_embedded_chinese_and_korean_cid_fonts_draw_with_an_installed_face() {
+        use hayro::hayro_interpret::font::FallbackFontQuery;
+        use hayro::hayro_interpret::hayro_cmap::CharacterCollection;
+        // (base font, collection, ordering, encoding, UCS-2 code units of the text)
+        let cases = [
+            ("MSung-Light", CidFamily::AdobeCNS1, "CNS1", "UniCNS-UCS2-H", "7E419AD45B57"), // 繁體字
+            ("STSong-Light", CidFamily::AdobeGB1, "GB1", "UniGB-UCS2-H", "72698D448DF7"),   // 物资跷 (common Simplified)
+            ("HYGoThic-Medium", CidFamily::AdobeKorea1, "Korea1", "UniKS-UCS2-H", "D55CAE00"), // 한글
+        ];
+        for (base_font, family, ordering, encoding, code) in cases {
+            let query = FontQuery::Fallback(FallbackFontQuery {
+                post_script_name: Some(base_font.into()),
+                character_collection: Some(CharacterCollection { family, supplement: 2 }),
+                ..FallbackFontQuery::default()
+            });
+            if super::system_fallback(&query).is_none() {
+                eprintln!("no installed face for {base_font} (or PDFCRAFT_SYSTEM_FONTS=0): skipped");
+                continue;
+            }
+            let content = format!("BT /F1 40 Tf 5 15 Td <{code}> Tj ET");
+            let pdf = format!(
+                "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 60] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /{base_font} /Encoding /{encoding} /DescendantFonts [6 0 R] >> endobj
+6 0 obj << /Type /Font /Subtype /CIDFontType0 /BaseFont /{base_font} /CIDSystemInfo << /Registry (Adobe) /Ordering ({ordering}) /Supplement 2 >>
+  /FontDescriptor 7 0 R /DW 1000 >> endobj
+7 0 obj << /Type /FontDescriptor /FontName /{base_font} /Flags 6 /FontBBox [0 -141 1000 859] /ItalicAngle 0 /Ascent 859 /Descent -141 /CapHeight 700 /StemV 80 >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+                content.len()
+            );
+            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+            assert!(p.error.is_none(), "{base_font}: {:?}", p.error);
+            let inked = p.rgba.as_chunks::<4>().0.iter().filter(|c| c[0] < 128).count();
+            // Two to four glyphs at 40 pt cover several hundred dark pixels; a blank run has none.
+            assert!(inked > 300, "{base_font}: the text is drawn ({inked} dark pixels)");
+        }
+    }
+
     /// Half-width katakana are common in Japanese documents set in a non-embedded Mincho font
     /// such as HeiseiMin-W3. The Mincho substitute must have those glyphs: one that lacks them
     /// (Shippori Mincho) draws them as .notdef.
diff --git a/crates/render/src/system_font.rs b/crates/render/src/system_font.rs
new file mode 100644
index 0000000000..d2c98bb7cd
--- /dev/null
+++ b/crates/render/src/system_font.rs
@@ -0,0 +1,248 @@
+//! Installed CJK faces for CID fonts a PDF doesn't embed.
+//!
+//! Acrobat and other tools often write Chinese, Japanese or Korean text with one of the Adobe
+//! collections (Adobe-Japan1, GB1, CNS1, Korea1) and a font name such as `KozGoPr6N-Medium` or
+//! `MSung-Light` without embedding the font. hayro maps those CIDs to Unicode itself, but it needs
+//! a face to draw them with; without one the text is blank. The craft-fonts Japanese faces come
+//! first (see `japanese_fallback` in `raster.rs`); this module is the last resort: one face
+//! already installed on this machine. It is read at runtime and never embedded or shipped
+//! (AGENTS.md §1.4), Noto CJK and Source Han are left out on purpose (§1.1), and
+//! `PDFCRAFT_SYSTEM_FONTS=0` turns it off, as for the interface font.
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex, PoisonError};
+
+use hayro::hayro_interpret::font::{FallbackFontQuery, FontData};
+use hayro::hayro_interpret::hayro_cmap::CidFamily;
+use skrifa::MetadataProvider as _;
+use skrifa::string::StringId;
+
+/// Larger files are not read: a font path is still untrusted input. CJK system faces are big
+/// collections (PingFang is tens of megabytes).
+const MAX_BYTES: u64 = 96 << 20;
+/// Faces tried in a collection (`.ttc`).
+const MAX_FACES: u32 = 32;
+
+/// The writing system a character collection is for.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+enum Script {
+    Japanese,
+    SimplifiedChinese,
+    TraditionalChinese,
+    Korean,
+}
+
+impl Script {
+    fn of(family: &CidFamily) -> Option<Self> {
+        match family {
+            CidFamily::AdobeJapan1 => Some(Self::Japanese),
+            CidFamily::AdobeGB1 => Some(Self::SimplifiedChinese),
+            CidFamily::AdobeCNS1 => Some(Self::TraditionalChinese),
+            CidFamily::AdobeKorea1 => Some(Self::Korean),
+            CidFamily::AdobeIdentity | CidFamily::Custom { .. } => None,
+        }
+    }
+
+    /// A character the face must have to be worth using. Each is common and not shared by the
+    /// other scripts' faces: 物 (Japanese; also Chinese, so it only rules out Latin-only faces),
+    /// 欢 (Simplified only), 說 (Traditional only), 한 (Hangul).
+    fn probe(self) -> char {
+        match self {
+            Self::Japanese => '\u{7269}',
+            Self::SimplifiedChinese => '\u{6B22}',
+            Self::TraditionalChinese => '\u{8AAA}',
+            Self::Korean => '\u{D55C}',
+        }
+    }
+}
+
+/// One installed file and the words (in a face's family name) that pick the face for the right
+/// region out of a collection that holds several (PingFang SC, TC and HK share one file).
+struct Candidate {
+    path: PathBuf,
+    region: &'static [&'static str],
+}
+
+/// The installed face to draw a CID font of `query`'s collection with, as `(data, face index)`.
+/// `None` when it is turned off, the collection isn't one of the four, or nothing fits.
+pub(crate) fn fallback(query: &FallbackFontQuery) -> Option<(FontData, u32)> {
+    if cfg!(target_arch = "wasm32") || std::env::var_os("PDFCRAFT_SYSTEM_FONTS").is_some_and(|v| v == "0") {
+        return None;
+    }
+    let script = Script::of(&query.character_collection.as_ref()?.family)?;
+    let bold = query.is_bold || query.font_weight >= 600;
+    /// A face file and the index of the chosen face in it, or `None` when nothing fits.
+    type Face = Option<(Arc<Vec<u8>>, u32)>;
+    static CACHE: Mutex<Option<HashMap<(Script, bool), Face>>> = Mutex::new(None);
+    let mut cache = CACHE.lock().unwrap_or_else(PoisonError::into_inner);
+    let found = cache.get_or_insert_with(HashMap::new).entry((script, bold)).or_insert_with(|| {
+        candidates(script)
+            .iter()
+            .find_map(|c| read(c, script.probe(), bold))
+            .inspect(|(_, index)| log::info!("CJK font fallback for {script:?}: face {index}"))
+    });
+    found.as_ref().map(|(bytes, index)| (Arc::clone(bytes) as FontData, *index))
+}
+
+fn read(candidate: &Candidate, probe: char, bold: bool) -> Option<(Arc<Vec<u8>>, u32)> {
+    let meta = std::fs::metadata(&candidate.path).ok()?;
+    if !meta.is_file() || meta.len() > MAX_BYTES {
+        return None;
+    }
+    let bytes = std::fs::read(&candidate.path).ok()?;
+    let index = pick_face(&bytes, probe, candidate.region, bold)?;
+    Some((Arc::new(bytes), index))
+}
+
+/// The best face of the file that parses and maps `probe`: the region's face when the file has
+/// one, then the regular (or, for bold text, the semibold or bold) weight, then the first.
+fn pick_face(bytes: &[u8], probe: char, region: &[&str], bold: bool) -> Option<u32> {
+    let mut best: Option<(u32, u32)> = None;
+    for index in 0..MAX_FACES {
+        let Ok(font) = skrifa::FontRef::from_index(bytes, index) else { continue };
+        if font.charmap().map(probe).is_none() {
+            continue;
+        }
+        let names = |id: StringId| font.localized_strings(id).map(|s| s.chars().collect::<String>()).collect::<Vec<_>>();
+        let family = names(StringId::FAMILY_NAME).join(" ");
+        let style = names(StringId::SUBFAMILY_NAME).join(" ").to_ascii_lowercase();
+        let mut score = 1;
+        if region.iter().any(|r| family.split_whitespace().any(|w| w == *r)) {
+            score += 4;
+        }
+        let weighty = style.contains("bold") || style.contains("semibold") || style.contains("heavy");
+        let plain = style.is_empty() || style.contains("regular") || style.contains("normal") || style.contains("medium") && !bold;
+        if (bold && weighty) || (!bold && plain && !weighty) {
+            score += 2;
+        }
+        if best.is_none_or(|(_, s)| score > s) {
+            best = Some((index, score));
+        }
+    }
+    best.map(|(index, _)| index)
+}
+
+fn candidates(script: Script) -> Vec<Candidate> {
+    let region: &'static [&'static str] = match script {
+        Script::Japanese => &["JP", "Japanese"],
+        Script::SimplifiedChinese => &["SC", "GB"],
+        Script::TraditionalChinese => &["TC", "HK", "CNS"],
+        Script::Korean => &["KR", "Korean"],
+    };
+    let files: Vec<PathBuf> = if cfg!(windows) {
+        let dir = windows_fonts();
+        let names: &[&str] = match script {
+            Script::Japanese => &["YuGothR.ttc", "meiryo.ttc", "msgothic.ttc"],
+            Script::SimplifiedChinese => &["msyh.ttc", "simsun.ttc", "msjh.ttc"],
+            Script::TraditionalChinese => &["msjh.ttc", "mingliu.ttc", "msyh.ttc"],
+            Script::Korean => &["malgun.ttf", "gulim.ttc"],
+        };
+        names.iter().map(|f| dir.join(f)).collect()
+    } else if cfg!(target_os = "macos") {
+        let names: &[&str] = match script {
+            Script::Japanese => &["ヒラギノ角ゴシック W3.ttc", "Hiragino Sans GB.ttc", "PingFang.ttc"],
+            Script::SimplifiedChinese => &["PingFang.ttc", "Hiragino Sans GB.ttc", "STHeiti Light.ttc"],
+            Script::TraditionalChinese => &["PingFang.ttc", "STHeiti Light.ttc", "Hiragino Sans GB.ttc"],
+            Script::Korean => &["AppleSDGothicNeo.ttc", "AppleGothic.ttf", "PingFang.ttc"],
+        };
+        names.iter().map(|f| Path::new("/System/Library/Fonts").join(f)).collect()
+    } else {
+        let names: &[&str] = match script {
+            Script::Korean => {
+                &["truetype/nanum/NanumGothic.ttf", "nanum/NanumGothic.ttf", "truetype/baekmuk/gulim.ttf", "truetype/unfonts-core/UnDotum.ttf"]
+            }
+            Script::Japanese => &[
+                "truetype/fonts-japanese-gothic.ttf",
+                "ipa-gothic/ipag.ttf",
+                "truetype/takao-gothic/TakaoGothic.ttf",
+                "truetype/vlgothic/VL-Gothic-Regular.ttf",
+            ],
+            Script::SimplifiedChinese | Script::TraditionalChinese => &[
+                "truetype/wqy/wqy-microhei.ttc",
+                "wenquanyi/wqy-microhei/wqy-microhei.ttc",
+                "wqy-microhei/wqy-microhei.ttc",
+                "truetype/wqy/wqy-zenhei.ttc",
+                "wenquanyi/wqy-zenhei/wqy-zenhei.ttc",
+                "wqy-zenhei/wqy-zenhei.ttc",
+                "truetype/droid/DroidSansFallbackFull.ttf",
+                "google-droid-sans-fonts/DroidSansFallbackFull.ttf",
+                "truetype/arphic/uming.ttc",
+                "arphic-uming/uming.ttc",
+            ],
+        };
+        ["/usr/share/fonts", "/usr/local/share/fonts"].iter().flat_map(|dir| names.iter().map(move |f| Path::new(dir).join(f))).collect()
+    };
+    files.into_iter().map(|path| Candidate { path, region }).collect()
+}
+
+fn windows_fonts() -> PathBuf {
+    let dir = std::env::var_os("WINDIR").or_else(|| std::env::var_os("SystemRoot")).map_or_else(|| PathBuf::from(r"C:\Windows"), PathBuf::from);
+    dir.join("Fonts")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const SCRIPTS: [Script; 4] = [Script::Japanese, Script::SimplifiedChinese, Script::TraditionalChinese, Script::Korean];
+
+    #[test]
+    fn broken_and_missing_files_are_skipped() {
+        assert_eq!(pick_face(b"", '\u{7269}', &[], false), None);
+        assert_eq!(pick_face(b"not a font at all", '\u{7269}', &[], false), None);
+        assert_eq!(pick_face(&[0u8; 4096], '\u{7269}', &[], false), None);
+        let missing = Candidate { path: PathBuf::from("definitely/not/here.ttc"), region: &[] };
+        assert!(read(&missing, '\u{7269}', false).is_none());
+        // A directory is not a font.
+        let dir = Candidate { path: std::env::temp_dir(), region: &[] };
+        assert!(read(&dir, '\u{7269}', false).is_none());
+    }
+
+    #[test]
+    fn a_latin_face_is_rejected_for_every_script() {
+        let inter = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");
+        for script in SCRIPTS {
+            assert_eq!(pick_face(inter, script.probe(), &[], false), None, "{script:?}");
+        }
+        assert_eq!(pick_face(inter, 'A', &[], false), Some(0));
+    }
+
+    #[test]
+    fn candidates_are_absolute_font_files_without_adobe_designs() {
+        for script in SCRIPTS {
+            let list = candidates(script);
+            assert!(!list.is_empty(), "{script:?}");
+            for c in list {
+                assert!(c.path.is_absolute(), "{}", c.path.display());
+                assert!(c.path.extension().is_some_and(|e| e == "ttf" || e == "ttc"), "{}", c.path.display());
+                let name = c.path.to_string_lossy().to_lowercase();
+                assert!(!["notosanscjk", "notoserifcjk", "sourcehan", "source-han"].iter().any(|b| name.contains(b)), "{name}");
+            }
+        }
+    }
+
+    #[test]
+    fn only_the_four_adobe_collections_have_a_script() {
+        assert_eq!(Script::of(&CidFamily::AdobeCNS1), Some(Script::TraditionalChinese));
+        assert_eq!(Script::of(&CidFamily::AdobeGB1), Some(Script::SimplifiedChinese));
+        assert_eq!(Script::of(&CidFamily::AdobeKorea1), Some(Script::Korean));
+        assert_eq!(Script::of(&CidFamily::AdobeJapan1), Some(Script::Japanese));
+        assert_eq!(Script::of(&CidFamily::AdobeIdentity), None);
+    }
+
+    /// On a Mac the face for Traditional Chinese is the TC one of PingFang, not the first of the
+    /// collection (which is another region's), and it maps a character only Traditional has.
+    #[cfg(target_os = "macos")]
+    #[test]
+    fn macos_picks_the_regional_pingfang_face() {
+        let path = Path::new("/System/Library/Fonts/PingFang.ttc");
+        let Ok(bytes) = std::fs::read(path) else { return };
+        for (script, region) in [(Script::TraditionalChinese, "TC"), (Script::SimplifiedChinese, "SC")] {
+            let index = pick_face(&bytes, script.probe(), &[region], false).expect("PingFang covers it");
+            let font = skrifa::FontRef::from_index(&bytes, index).unwrap();
+            let family: String = font.localized_strings(StringId::FAMILY_NAME).next().unwrap().chars().collect();
+            assert!(family.contains(region), "{script:?} got {family:?}");
+        }
+    }
+}

From b680ded337354487b26ff56c27b0986e21e0dfcb Mon Sep 17 00:00:00 2001
From: JM <srt8hellcat2@gmail.com>
Date: Tue, 13 Oct 2026 15:38:04 +0000
Subject: [PATCH 003/270] feat: add optional page edge shadows setting

---
 ATTRIBUTION.toml                     |  42 ++--
 ROADMAP.md                           |   4 +-
 crates/ui-egui/src/canvas.rs         |  35 ++-
 crates/ui-egui/src/control.rs        |   3 +
 crates/ui-egui/src/i18n/ar.tsv       |   1 +
 crates/ui-egui/src/i18n/bg.tsv       |   1 +
 crates/ui-egui/src/i18n/cs.tsv       |   1 +
 crates/ui-egui/src/i18n/de.tsv       |   1 +
 crates/ui-egui/src/i18n/el.tsv       |   1 +
 crates/ui-egui/src/i18n/es.tsv       |   1 +
 crates/ui-egui/src/i18n/fr.tsv       |   1 +
 crates/ui-egui/src/i18n/hu.tsv       |   1 +
 crates/ui-egui/src/i18n/it.tsv       |   1 +
 crates/ui-egui/src/i18n/ja.tsv       |   1 +
 crates/ui-egui/src/i18n/kk.tsv       |   1 +
 crates/ui-egui/src/i18n/lt.tsv       |   1 +
 crates/ui-egui/src/i18n/pl.tsv       |   1 +
 crates/ui-egui/src/i18n/pt-br.tsv    |   1 +
 crates/ui-egui/src/i18n/ru.tsv       |   1 +
 crates/ui-egui/src/i18n/sl.tsv       |   1 +
 crates/ui-egui/src/i18n/te.tsv       |   1 +
 crates/ui-egui/src/i18n/tr.tsv       |   1 +
 crates/ui-egui/src/i18n/uk.tsv       |   1 +
 crates/ui-egui/src/i18n/zh-hans.tsv  |   1 +
 crates/ui-egui/src/i18n/zh-hant.tsv  |   1 +
 crates/ui-egui/src/js_ui.rs          |   4 +
 crates/ui-egui/src/lib.rs            |  19 +-
 crates/ui-egui/tests/control.rs      |  19 ++
 crates/ui-egui/tests/page_shadows.rs | 350 +++++++++++++++++++++++++++
 docs/roadmap.md                      |   5 +-
 parity/acrobat-features.toml         |   4 +-
 31 files changed, 473 insertions(+), 33 deletions(-)
 create mode 100644 crates/ui-egui/tests/page_shadows.rs

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 28785f7675..36900e0a9b 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -7,7 +7,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Greek UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d0a69a35403e70b94c3adfef88b41ec719f4f6ab700d351c8f82a78c53b63ef6"
+sha256 = "882c0de87fd784acd0d98738d5db18dff619666fcf5d65ad49af53ae02071a52"
 
 # ATTRIBUTION.toml: one entry per asset (AGENTS.md §1). The source of truth for provenance and licences.
 # ATTRIBUTION.md is generated from this file: `cargo xtask assets --write`. Checked by `cargo xtask assets` (part of `xtask ci`).
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "caa23201b7f25dba9f8dc579771e13435e5e8c72a7efb9770e917a2a33003a39"
+sha256 = "b58781b77c3c285b63f3dc455c0d59c90bc330b2680ef40484c438ebda192d8e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "5ead9fccdca17810a3a98de3fa499d8a2469a1ff015c3d0e11880ca629295ea1"
+sha256 = "a649395b81c3209dd15e647154d77fa234d57a90107dbc0c5d6b268c64194719"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d48f9d68711850cae48af53f7691facee4209f7846e3eb2c064d97dad2ae2426"
+sha256 = "d0cbf5ae09d732d3446be4f8f68ae78a1b1c0b370c199d0045d3c8522c3ad84c"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "6bc2edec99534d0df9b5e4a1c2e18dc32ad84c32e404c74dd437d86119b1d6ea"
+sha256 = "232e203183548507747a128f7870a1d2b85f57198ef3cb08177021b2689f13d1"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "cb6c04bd36ba6ce0ebc808da2e47b65797e14d59466e93802adec4d4f5056e3b"
+sha256 = "ea80209d0192489065fd97e4e21ea537a83e371021dff0831256ffa265ba0f4d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "0368944155991c2ea304788418fb326f30e45649539a0cf49539194b026ca104"
+sha256 = "3904d5f143a6e8861c22c5adbd2d3af3b7e2ff82d0cb40b3443180255ab55ab0"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f4969c353f1424c6b9b5b110820c69dc59907590d013221511eae3f86c29024e"
+sha256 = "ebd76484896b8931e84066acd8a4ba1c60e023cb90baffca1f0a54bd3ebc3e8f"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "4bb6fa4f3b6e236a4a353df79acd0c5528ea8354058eeaeb66c28bc0f7e02939"
+sha256 = "0ad017eade954c43cd61e41342c733de46937177f07aa91f16aa8491d114904e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/it.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Italian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "adcbdfc683589b067e062a6200084bf9192935b297f5b616f8ed39db9c71db9b"
+sha256 = "bc96cc2e0ee2bb2bebc48eff1faf934d5873d443639b3b7d248b17d0d16b9977"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pl.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Polish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "aebe63cd91df2d2f9d2bdc1da43b017823dbc8a32135e999b9ac7041277be0c8"
+sha256 = "5c75987e23f74c0273fd38c7af8682a5fc48aee3ceda6582b28e49ff42b4b1e1"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "3c8e3a28a5b751c6d6384809d4fd81c14c2ff5f561aaee5b58d24fbfa2ca4dc1"
+sha256 = "e483d99fae3fe4fb579f3f1844903537c28d1d4acd2fcfc822f64ab77f7a4098"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "637fcfdd0bf1898b413af7ccbc2eb4228bf656273de9f3ef9241bd128940aeab"
+sha256 = "e54073fd593756b00812c5bd5b951ae6e50d06d4812f988c88034f513065caef"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -162,7 +162,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "5285f8987bd8c265f73ff443906c1832a0886037592d334974cf539b9f972a3f"
+sha256 = "da8dff590b62692c2fd67a60e2c2c32f3093ae425946772bbc705f35f9764de2"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/kk.tsv"
@@ -173,7 +173,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Kazakh UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "23779abc08be40ddfb305fd638fe280c854ac33473b2822006ba8bad399c0cad"
+sha256 = "4105b4fb3a088b34c2844edcff9e9a66f7c8dcaa6f6a45936c868dc3b24767c1"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -184,7 +184,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "c5129c40b202d8467d8d4cf0a189da8c2ba2af711998edb73f67e1b291289a04"
+sha256 = "97a9416f8cef0248fb3bedc2fdb38b21f6e882455255a3ff1e879652188f155b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -195,7 +195,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "11ed2aa56dc5f8f6656eba717500c74bb8c8f931c08f9f9b210b5b33dd9c2d5a"
+sha256 = "17c818311e6422d4e4b49a71dcc1d784f78920b7b21b493d4e11170f7791c6e3"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ar.tsv"
@@ -206,7 +206,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Arabic UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "a3863e2fed5ef584a87f65083a6b9fedf26d18ecebd574efce22bd7a01e3281c"
+sha256 = "7f9bc12fe0514cf61675d8537623aff84829c711d5efdb68ba4b158cd2aeb13c"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/tr.tsv"
@@ -217,7 +217,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Turkish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "cade94846289c2822b408a2ea23e6c8f8f321708f4f27fd563695a3c4fade6a1"
+sha256 = "b666eaf326370ded831ae26a0a4e214d1e42cdf374de64f1d4244391736c47b1"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/lt.tsv"
@@ -228,7 +228,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Lithuanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "35b6b03dae01b9a2e98f6d1f682d0699d77772e6efec7e28e1f26039c57b151f"
+sha256 = "2b3a1b676f258c3903bf2447b93adcec7aadb53d3820902869301c0e5bf7f1ec"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
@@ -3351,4 +3351,4 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Slovene UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2685fbb694cbdeb7632ecb5e7396e1209047c83319e28ceea032b3ec9fb2fc0e"
+sha256 = "f9a381fdfea0731a6913b552ea6fb209404ab27a75abe4c817e42d379091a78e"
diff --git a/ROADMAP.md b/ROADMAP.md
index a035c9bf35..630550c144 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~26% (ready for real work 49% → 75%) and ~400–700 h away
 
-> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M13: CLI check visits each directory once through aliases and cycles; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-13 · **Change:** minor (M3 #1577: optional page-edge shadows and viewport-edge fades; earlier: M13: CLI check visits each directory once through aliases and cycles; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M4: Extract and Split preserve shared Type 3 glyph resources; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M2: packed TIFF-predictor RGB rows retain their byte boundaries; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M3 #1364 candidate: consent before absolute local GoToR access; estimates unchanged); earlier: minor (M1 #1339: an unchanged incremental save of a classic cross-reference table writes a zero-length subsection; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -148,6 +148,8 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 ## Progress log
 
+- 2026-10-13 — M3, #1577: optional app-wide page-edge shadows and viewport-edge fades in the viewer and Organize grid; enabled by default, persisted and controllable through the UI channel. PDF rendering and edits are unchanged.
+
 - **2026-10-12 (M13, CLI robustness scans):** `pdfcraft-cli check` visits a directory once even when input roots overlap or directory symlinks lead back into the tree. PDFs reached through file symlinks remain accepted. Three real CLI regressions cover overlapping roots, a directory cycle and directory/file aliases. Estimates unchanged.
 - **2026-10-12 (M4, Type 3 extraction fidelity):** Extract and Split preserve shared image/resource dictionaries reached through Type 3 glyphs, including nested forms, patterns and soft masks. A bounded object-graph walk protects unknown glyph content; unreadable pages/forms retain their glyph resources, and shared explicit fonts are visited once. Separate page dictionaries still prune unused images. Synthetic save/reopen regressions and an opt-in Poppler pixel oracle cover resource ownership, nested forms, cycles, limits and repeated fonts. Estimates unchanged.
 - **2026-10-12 (M2, TIFF predictor rows):** Packed RGB images using TIFF horizontal differencing keep every row when samples do not fill the last byte. The renderer aligns each decoded row before moving to the next. Synthetic decoding tests cover 1/2/4-bit samples, horizontal differencing and an 8-bit control; a red/green page-render regression verifies visible output. Estimates unchanged.
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 9dc2c98dfa..8405051989 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -2097,7 +2097,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let unobstructed = !app.modal_open() && !app.palette_open;
     let view = &mut app.views[index];
     if view.organize {
-        organize_grid(view, info, doc.allows_assembly(), doc.dirty, unobstructed, ui, &t);
+        organize_grid(view, doc, unobstructed, app.show_page_edge_shadows, ui, &t);
         return;
     }
 
@@ -2382,6 +2382,12 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             scroll = scroll.vertical_scroll_offset((r.top() - y_shift + fy * r.height() - rel.y).clamp(0.0, max_y));
         }
     }
+    // egui paints viewport-edge gradients over the PDF after the scroll contents.
+    // Scope their suppression to this scroll area; other panels keep their fades.
+    let fade_strength = ui.spacing().scroll.fade.strength;
+    if !app.show_page_edge_shadows {
+        ui.spacing_mut().scroll.fade.strength = 0.0;
+    }
     let out = scroll.show_viewport(ui, |ui, viewport| {
         // egui's drag responses accept every pointer button. Keep a wheel gesture from also
         // selecting text, drawing a mark, or panning with the Hand tool.
@@ -2454,7 +2460,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             }
             let xf = PageXform { rect: r, rot: view.rotation, pw: info.pages[i].width.max(1.0), ph: info.pages[i].height.max(1.0) };
             // Soft shadow + paper.
-            painter.add(egui::epaint::Shadow { offset: [0, 3], blur: 14, spread: 0, color: t.page_shadow }.as_shape(r, CornerRadius::ZERO));
+            if app.show_page_edge_shadows {
+                painter.add(egui::epaint::Shadow { offset: [0, 3], blur: 14, spread: 0, color: t.page_shadow }.as_shape(r, CornerRadius::ZERO));
+            }
             painter.rect_filled(r, CornerRadius::ZERO, Color32::WHITE);
             if let Some(err) = view.errors.get(&i) {
                 painter.rect_filled(r, CornerRadius::ZERO, Color32::from_rgb(0xFB, 0xF4, 0xF4));
@@ -3142,6 +3150,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         });
         (wanted, visible_now)
     });
+    ui.spacing_mut().scroll.fade.strength = fade_strength;
     view.single_edges = visible_pages.first().copied().filter(|_| !view.continuous).map(|page| {
         // At the top once the page's top edge shows where going to a page puts it (a gap
         // below the window's top). Within a point, as for wheel paging, so layout rounding
@@ -4240,7 +4249,17 @@ fn gap_button(ui: &mut egui::Ui, gap: usize, at: Pos2, height: f32, label: Strin
     resp.on_hover_text(label).clicked()
 }
 
-fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, unobstructed: bool, ui: &mut egui::Ui, t: &Tokens) {
+fn organize_grid(
+    view: &mut DocView,
+    doc: &pdfcraft_engine::Document,
+    unobstructed: bool,
+    show_page_edge_shadows: bool,
+    ui: &mut egui::Ui,
+    t: &Tokens,
+) {
+    let info = &doc.info;
+    let editable = doc.allows_assembly();
+    let dirty = doc.dirty;
     let ppp = ui.ctx().pixels_per_point();
     // The page image scales with the zoom; the padding and the page number don't.
     let cell = vec2(146.0 * view.grid_zoom + 44.0, 194.0 * view.grid_zoom + 88.0);
@@ -4262,6 +4281,11 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool
     let (mut in_view, mut sharper): (Vec<(usize, f32)>, Vec<RenderRequest>) = (Vec::new(), Vec::new());
     // The source cell can scroll out of the virtualized rows during a drag.
     let mut drop = view.org_drag.is_some() && ui.input(|i| i.pointer.primary_released());
+    // As in the document viewer, hide only this area's decorative edge fades.
+    let fade_strength = ui.spacing().scroll.fade.strength;
+    if !show_page_edge_shadows {
+        ui.spacing_mut().scroll.fade.strength = 0.0;
+    }
     egui::ScrollArea::vertical().auto_shrink([false, false]).show_viewport(ui, |ui, clip| {
         if middle_gesture {
             let opacity = ui.opacity();
@@ -4313,7 +4337,9 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool
                 if view.selected.contains(&i) {
                     ui.painter().rect_stroke(c.shrink(6.0), CornerRadius::same(8), Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
                 }
-                ui.painter().rect_filled(pr.translate(vec2(0.0, 1.5)), CornerRadius::same(1), t.page_shadow);
+                if show_page_edge_shadows {
+                    ui.painter().rect_filled(pr.translate(vec2(0.0, 1.5)), CornerRadius::same(1), t.page_shadow);
+                }
                 ui.painter().rect_filled(pr, CornerRadius::ZERO, Color32::WHITE);
                 // A page drawn larger than its thumbnail gets a render at the size drawn, while
                 // it is in view; until that arrives the thumbnail stands in.
@@ -4478,6 +4504,7 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool
             view.org_drag = None;
         }
     });
+    ui.spacing_mut().scroll.fade.strength = fade_strength;
     // Files dragged in from outside go to the gap under the pointer. Some platforms don't say
     // where the pointer is until the files are dropped; then the whole grid is the target.
     let pointer = ui.input(|i| i.pointer.hover_pos()).filter(|p| viewport.contains(*p));
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index eaa102b56e..83a66ee48b 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -28,6 +28,8 @@
 //!   comments, selecting text, moving comments). `ui.state` reports `pages_on_screen` to aim at.
 //! - `ui.type {text}`, `ui.key {key, modifiers?}`: keyboard input to the focused widget / app.
 //! - `ui.command {id}`: run a registry command (as the menu would). `ui.commands` lists them.
+//! - `ui.set {key: "show_page_edge_shadows", value: "true"|"false"}` controls page
+//!   decoration app-wide; `ui.state.show_page_edge_shadows` reports the saved preference.
 //! - `ui.set {key, value}`: view options (`--page`, `--zoom`, …), plus persistent preferences.
 //!   `select` accepts physical page numbers and ranges such as `1,12,16-18`; blank clears the
 //!   explicit selection. This is the same bounded parser as the Organize Pages field; invalid
@@ -722,6 +724,7 @@ impl Host for crate::PdfCraftApp {
             "palette_open": self.palette_open,
             "theme": format!("{:?}", self.theme),
             "theme_preference": self.theme_preference,
+            "show_page_edge_shadows": self.show_page_edge_shadows,
             "language": self.language,
             "notice": self.toast.as_ref().map(|t| t.0.clone()),
             "progress": self.progress_notice.as_ref().map(|p| json!({ "label": p.label, "fraction": p.fraction })),
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 222865d72b..c98472944a 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -2373,3 +2373,4 @@ animation effects	Off	معطّلة
 	This document is trying to open a local file:	يحاول هذا المستند فتح ملف محلي:
 	Move tag earlier	نقل العلامة للأعلى
 	Move tag later	نقل العلامة للأسفل
+	Show Page Edge Shadows	إظهار ظلال حواف الصفحات
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 17a0890fa5..8c4767391e 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -2315,3 +2315,4 @@ animation effects	Off	Изключени
 	This document is trying to open a local file:	Този документ се опитва да отвори локален файл:
 	Move tag earlier	Преместване на етикета по-рано
 	Move tag later	Преместване на етикета по-късно
+	Show Page Edge Shadows	Показване на сенки по краищата на страниците
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index e6e29c8bba..43cabd385e 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -2426,3 +2426,4 @@ animation effects	Off	Vypnuto
 	This document is trying to open a local file:	Tento dokument se pokouší otevřít místní soubor:
 	Move tag earlier	Přesunout značku dříve
 	Move tag later	Přesunout značku později
+	Show Page Edge Shadows	Zobrazovat stíny okrajů stránek
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 38ef665d13..85cb412263 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -2353,3 +2353,4 @@ animation effects	Off	Aus
 	This document is trying to open a local file:	Dieses Dokument versucht, eine lokale Datei zu öffnen:
 	Move tag earlier	Tag früher verschieben
 	Move tag later	Tag später verschieben
+	Show Page Edge Shadows	Schatten an Seitenrändern anzeigen
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 106278f012..1f36c2722d 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -2362,3 +2362,4 @@ animation effects	Off	Ανενεργά
 	This document is trying to open a local file:	Αυτό το έγγραφο προσπαθεί να ανοίξει ένα τοπικό αρχείο:
 	Move tag earlier	Μετακίνηση ετικέτας νωρίτερα
 	Move tag later	Μετακίνηση ετικέτας αργότερα
+	Show Page Edge Shadows	Εμφάνιση σκιών στα άκρα των σελίδων
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 5afbe4f2ef..50b132e926 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -2482,3 +2482,4 @@ animation effects	Off	Desactivados
 	This document is trying to open a local file:	Este documento intenta abrir un archivo local:
 	Move tag earlier	Mover etiqueta antes
 	Move tag later	Mover etiqueta después
+	Show Page Edge Shadows	Mostrar sombras en los bordes de las páginas
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 79389837d3..1bbb1328b0 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2352,3 +2352,4 @@ animation effects	Off	Désactivés
 	This document is trying to open a local file:	Ce document tente d’ouvrir un fichier local :
 	Move tag earlier	Déplacer la balise plus tôt
 	Move tag later	Déplacer la balise plus tard
+	Show Page Edge Shadows	Afficher les ombres des bords des pages
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 3d6e1e3af5..ae0097a2c2 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -2351,3 +2351,4 @@ animation effects	Off	Ki
 	This document is trying to open a local file:	Ez a dokumentum egy helyi fájlt próbál megnyitni:
 	Move tag earlier	Címke korábbra helyezése
 	Move tag later	Címke későbbre helyezése
+	Show Page Edge Shadows	Oldalszéli árnyékok megjelenítése
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 3575ab374d..17e263f608 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -2361,3 +2361,4 @@ animation effects	Off	Disattivati
 	This document is trying to open a local file:	Questo documento sta tentando di aprire un file locale:
 	Move tag earlier	Sposta tag prima
 	Move tag later	Sposta tag dopo
+	Show Page Edge Shadows	Mostra le ombre ai bordi delle pagine
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 5e61802c35..7ff964ec3a 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -2352,3 +2352,4 @@ animation effects	Off	オフ
 	This document is trying to open a local file:	この文書はローカルファイルを開こうとしています：
 	Move tag earlier	タグを前へ移動
 	Move tag later	タグを後へ移動
+	Show Page Edge Shadows	ページ端の影を表示
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 8e4a090403..b472b97c06 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -2350,3 +2350,4 @@ animation effects	Off	Өшірулі
 	This document is trying to open a local file:	Бұл құжат жергілікті файлды ашуға әрекеттеніп жатыр:
 	Move tag earlier	Тегті ертерек жылжыту
 	Move tag later	Тегті кейінірек жылжыту
+	Show Page Edge Shadows	Бет жиектерінің көлеңкелерін көрсету
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index ae61e396ff..20ffdcf1d6 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -2596,3 +2596,4 @@ key	Space	Tarpas
 	This document is trying to open a local file:	Šis dokumentas bando atverti vietinį failą:
 	Move tag earlier	Perkelti žymą anksčiau
 	Move tag later	Perkelti žymą vėliau
+	Show Page Edge Shadows	Rodyti puslapių kraštų šešėlius
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 310a990f7d..c2011e70b4 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -2332,3 +2332,4 @@ animation effects	Off	Wyłączone
 	This document is trying to open a local file:	Ten dokument próbuje otworzyć plik lokalny:
 	Move tag earlier	Przenieś znacznik wcześniej
 	Move tag later	Przenieś znacznik później
+	Show Page Edge Shadows	Pokaż cienie krawędzi stron
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 623d69ce80..41c94d1ca1 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -2366,3 +2366,4 @@ animation effects	Off	Desativados
 	This document is trying to open a local file:	Este documento está tentando abrir um arquivo local:
 	Move tag earlier	Mover tag para antes
 	Move tag later	Mover tag para depois
+	Show Page Edge Shadows	Mostrar sombras nas bordas das páginas
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 7f628088d6..d67a507eab 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -2265,3 +2265,4 @@ animation effects	Off	Выкл
 	This document is trying to open a local file:	Этот документ пытается открыть локальный файл:
 	Move tag earlier	Переместить тег раньше
 	Move tag later	Переместить тег позже
+	Show Page Edge Shadows	Показывать тени по краям страниц
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 3feaad354d..d7279724c5 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -2357,3 +2357,4 @@ animation effects	Off	Izklopljeni
 	This document is trying to open a local file:	Ta dokument poskuša odpreti lokalno datoteko:
 	Move tag earlier	Premakni oznako prej
 	Move tag later	Premakni oznako pozneje
+	Show Page Edge Shadows	Prikaži sence robov strani
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index d15365f3d4..04368336bf 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -2265,3 +2265,4 @@ animation effects	Off	ఆఫ్
 	This document is trying to open a local file:	ఈ పత్రం ఒక స్థానిక ఫైల్‌ను తెరవడానికి ప్రయత్నిస్తోంది:
 	Move tag earlier	ట్యాగ్‌ను ముందుకు తరలించు
 	Move tag later	ట్యాగ్‌ను వెనుకకు తరలించు
+	Show Page Edge Shadows	పేజీ అంచుల నీడలను చూపించు
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index 44fd05f074..65e442547d 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -2348,3 +2348,4 @@ animation effects	Off	Kapalı
 	This document is trying to open a local file:	Bu belge yerel bir dosya açmaya çalışıyor:
 	Move tag earlier	Etiketi daha erken taşı
 	Move tag later	Etiketi daha geç taşı
+	Show Page Edge Shadows	Sayfa kenarı gölgelerini göster
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 648dc855fe..b2e7bd576a 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2374,3 +2374,4 @@ animation effects	Off	Вимкнено
 	This document is trying to open a local file:	Цей документ намагається відкрити локальний файл:
 	Move tag earlier	Перемістити тег раніше
 	Move tag later	Перемістити тег пізніше
+	Show Page Edge Shadows	Показувати тіні на краях сторінок
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 391c8eda7c..a67b93e1b4 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -2316,3 +2316,4 @@ animation effects	Off	关
 	This document is trying to open a local file:	此文档正尝试打开本地文件：
 	Move tag earlier	将标签前移
 	Move tag later	将标签后移
+	Show Page Edge Shadows	显示页面边缘阴影
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index da45921c21..af726d4b01 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -2226,3 +2226,4 @@ animation effects	Off	關
 	This document is trying to open a local file:	此文件正嘗試開啟本機檔案：
 	Move tag earlier	將標記前移
 	Move tag later	將標記後移
+	Show Page Edge Shadows	顯示頁面邊緣陰影
diff --git a/crates/ui-egui/src/js_ui.rs b/crates/ui-egui/src/js_ui.rs
index fe474622c7..48ded85723 100644
--- a/crates/ui-egui/src/js_ui.rs
+++ b/crates/ui-egui/src/js_ui.rs
@@ -263,6 +263,10 @@ fn reading_mode_label(mode: &str) -> &'static str {
 /// Preferences: interface language and size, appearance, identity and JavaScript. Returns `true` to close.
 pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
     ui.label(egui::RichText::new(tl!("Preferences")).font(theme::semibold(18.0)));
+    ui.label(egui::RichText::new(tl!("Appearance")).font(theme::semibold(13.0)));
+    if ui.add(widgets::checkbox(&mut app.show_page_edge_shadows, tl!("Show Page Edge Shadows"))).changed() {
+        ui.ctx().request_repaint();
+    }
     ui.horizontal(|ui| {
         ui.label(tl!("Interface language"));
         let selected = crate::i18n::Lang::from_code(&app.language).map_or(tl!("Auto"), crate::i18n::Lang::name);
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index ea3da00957..276aa56b70 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -511,6 +511,8 @@ pub struct PdfCraftApp {
     /// The reading-colours preference (Preferences ▸ Reading colours): applied to every open
     /// document, and documents open with it (Acrobat's Replace Document Colors).
     pub reading_colors: pdfcraft_render::ReadingColors,
+    /// App-wide page decoration only; never part of a PDF edit or render request.
+    pub show_page_edge_shadows: bool,
     /// The Linux portal is enabled only by the native host, and starts on the first System choice.
     #[cfg(target_os = "linux")]
     desktop_theme: Option<pdfcraft_platform::desktop_theme::DesktopTheme>,
@@ -882,6 +884,7 @@ impl PdfCraftApp {
             theme: ThemeKind::Light,
             theme_preference: ThemePreference::Light,
             reading_colors: Default::default(),
+            show_page_edge_shadows: true,
             #[cfg(target_os = "linux")]
             desktop_theme: None,
             #[cfg(target_os = "linux")]
@@ -2074,7 +2077,7 @@ impl PdfCraftApp {
     /// Serialize the user's persistent state (recent files, theme). Local only.
     pub fn persist(&self) -> String {
         let trusted: Vec<String> = self.session.trusted_certificates().iter().map(pdfcraft_engine::sign::x509::to_pem).collect();
-        serde_json::json!({
+        let mut settings = serde_json::json!({
             "docking": self.docking,
             "docking_left_open": self.left_open,
             "docking_right": self.right,
@@ -2133,8 +2136,12 @@ impl PdfCraftApp {
             "combine_zoom": self.combine_zoom,
             "comments_panel_closed": self.comments_panel_closed,
             "right_panel_closed": self.right_panel_closed,
-        })
-        .to_string()
+        });
+        // Add this separately to keep the existing settings macro below its expansion limit.
+        if let Some(settings) = settings.as_object_mut() {
+            settings.insert("show_page_edge_shadows".into(), self.show_page_edge_shadows.into());
+        }
+        settings.to_string()
     }
 
     /// Restore state written by `persist`. Unknown or malformed data is ignored.
@@ -2212,6 +2219,9 @@ impl PdfCraftApp {
         if let Some(size) = v["fill_text_size"].as_f64().and_then(fill_sign::valid_text_size) {
             self.fill_text_size = size;
         }
+        if let Some(show) = v["show_page_edge_shadows"].as_bool() {
+            self.show_page_edge_shadows = show;
+        }
         // Settings are untrusted: an unreadable value (a colour that isn't three bytes, say)
         // fails to deserialize and keeps Off.
         if let Ok(colors) = serde_json::from_value::<pdfcraft_render::ReadingColors>(v["reading_colors"].clone()) {
@@ -2316,6 +2326,9 @@ impl PdfCraftApp {
                 };
                 self.set_theme_preference(preference);
             }
+            ("show_page_edge_shadows", _) => {
+                self.show_page_edge_shadows = value.parse::<bool>().map_err(|_| "show_page_edge_shadows must be true or false")?;
+            }
             ("scroll_speed", _) => {
                 self.scroll_speed = scroll_speed::ScrollSpeed::parse(value).ok_or("scroll_speed must be slow, normal, or fast")?;
             }
diff --git a/crates/ui-egui/tests/control.rs b/crates/ui-egui/tests/control.rs
index a73b3073b2..723f3910a9 100644
--- a/crates/ui-egui/tests/control.rs
+++ b/crates/ui-egui/tests/control.rs
@@ -73,6 +73,25 @@ fn ok(h: &mut Harness<'static, PdfCraftApp>, c: &ControlClient, method: &str, pa
     call(h, c, method, params).unwrap_or_else(|e| panic!("{method}: {e}"))
 }
 
+#[test]
+fn page_shadows_are_an_observable_app_wide_preference() {
+    let (mut h, c) = harness();
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], true);
+    for value in ["false", "true"] {
+        ok(&mut h, &c, "ui.set", json!({ "key": "show_page_edge_shadows", "value": value }));
+        assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], value == "true");
+    }
+    for value in ["off", "1", "False", ""] {
+        assert!(call(&mut h, &c, "ui.set", json!({ "key": "show_page_edge_shadows", "value": value })).is_err());
+        assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], true);
+    }
+    ok(&mut h, &c, "ui.set", json!({ "key": "show_page_edge_shadows", "value": false }));
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], false);
+    h.state_mut().active = None;
+    ok(&mut h, &c, "ui.set", json!({ "key": "show_page_edge_shadows", "value": "false" }));
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], false);
+}
+
 #[test]
 fn control_resize_reports_observed_dimensions_and_rejects_invalid_sizes() {
     let (mut h, c) = harness();
diff --git a/crates/ui-egui/tests/page_shadows.rs b/crates/ui-egui/tests/page_shadows.rs
new file mode 100644
index 0000000000..9cdee3f7a7
--- /dev/null
+++ b/crates/ui-egui/tests/page_shadows.rs
@@ -0,0 +1,350 @@
+//! Decorative page shadows are app preferences, never PDF edits.
+
+use egui_kittest::{Harness, kittest::Queryable};
+use pdfcraft_ui_egui::PdfCraftApp;
+
+#[test]
+fn viewer_shadows_follow_the_preference_without_moving_pages() {
+    for theme in ["light", "dark"] {
+        for layout in ["single", "two-page", "continuous", "two-up"] {
+            let mut h = harness(theme);
+            h.state_mut().set_option("layout", layout).unwrap();
+            h.run_steps(3);
+            let rectangles = h.state().views[0].visible_page_rects().to_vec();
+            let original = shadows(&h, false);
+            assert!(!original.is_empty(), "{theme} {layout}");
+            h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+            h.run_steps(2);
+            assert!(shadows(&h, false).is_empty(), "{theme} {layout}");
+            assert_eq!(h.state().views[0].visible_page_rects(), rectangles);
+            h.state_mut().set_option("zoom", "125").unwrap();
+            h.state_mut().set_option("page", "2").unwrap();
+            h.run_steps(3);
+            assert!(shadows(&h, false).is_empty());
+            h.state_mut().set_option("show_page_edge_shadows", "true").unwrap();
+            h.run_steps(2);
+            assert!(!shadows(&h, false).is_empty());
+        }
+    }
+}
+
+#[test]
+fn viewport_fades_follow_the_preference_and_keep_other_scroll_areas_styled() {
+    for theme in ["light", "dark"] {
+        for organize in [false, true] {
+            let mut h = harness(theme);
+            if organize {
+                h.state_mut().set_option("organize", "on").unwrap();
+                // Make the three-page grid overflow vertically.
+                h.state_mut().set_option("grid-zoom", "300").unwrap();
+            }
+            h.run_steps(4);
+            let original_style = h.ctx.global_style().spacing.scroll.fade;
+            assert!(original_style.strength > 0.0);
+            assert!(!viewport_fades(&h).is_empty(), "bottom fade at start: {theme}, organize={organize}");
+            scroll_down(&mut h, 100.0);
+            let original = viewport_fades(&h);
+            let viewport = h.state().views[0].viewport_rect();
+            assert!(original.iter().any(|r| (r.top() - viewport.top()).abs() < 2.0), "top fade: {original:?}");
+            assert!(original.iter().any(|r| (r.bottom() - viewport.bottom()).abs() < 2.0), "bottom fade: {original:?}");
+            let pages = h.state().views[0].visible_page_rects().to_vec();
+            h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+            h.run_steps(2);
+            assert!(viewport_fades(&h).is_empty(), "viewport fades remain: {theme}, organize={organize}");
+            assert_eq!(h.state().views[0].visible_page_rects(), pages);
+            assert_eq!(h.ctx.global_style().spacing.scroll.fade, original_style);
+            h.state_mut().set_option("show_page_edge_shadows", "true").unwrap();
+            h.run_steps(2);
+            assert_eq!(viewport_fades(&h), original);
+            scroll_down(&mut h, 100_000.0);
+            let at_end = viewport_fades(&h);
+            assert!(at_end.iter().any(|r| (r.top() - viewport.top()).abs() < 2.0));
+            assert!(!at_end.iter().any(|r| (r.bottom() - viewport.bottom()).abs() < 2.0), "no bottom fade at the end");
+        }
+    }
+}
+
+#[test]
+fn horizontal_viewport_fades_also_follow_the_preference() {
+    let mut h = harness("dark");
+    h.state_mut().set_option("zoom", "400").unwrap();
+    h.run_steps(4);
+    let viewport = h.state().views[0].viewport_rect();
+    let horizontal: Vec<_> = viewport_fades(&h).into_iter().filter(|r| r.width() <= 21.0).collect();
+    assert!(horizontal.iter().any(|r| (r.left() - viewport.left()).abs() < 2.0), "left fade: {horizontal:?}");
+    assert!(horizontal.iter().any(|r| (r.right() - viewport.right()).abs() < 2.0), "right fade: {horizontal:?}");
+    let pages = h.state().views[0].visible_page_rects().to_vec();
+    h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+    h.run_steps(2);
+    assert!(viewport_fades(&h).is_empty());
+    assert_eq!(h.state().views[0].visible_page_rects(), pages);
+}
+
+fn scroll_down(h: &mut Harness<'static, PdfCraftApp>, points: f32) {
+    h.hover_at(h.state().views[0].viewport_rect().center());
+    h.run_steps(1);
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: egui::vec2(0.0, -points),
+        phase: egui::TouchPhase::Move,
+        modifiers: egui::Modifiers::NONE,
+    });
+    h.run_steps(12);
+}
+
+/// Inspect the actual egui painter output: untextured four-vertex gradients
+/// with a transparent edge, spanning one dimension of the document viewport.
+fn viewport_fades(h: &Harness<'static, PdfCraftApp>) -> Vec<egui::Rect> {
+    let viewport = h.state().views[0].viewport_rect();
+    h.output()
+        .shapes
+        .iter()
+        .filter_map(|s| {
+            let egui::Shape::Mesh(mesh) = &s.shape else { return None };
+            if mesh.texture_id != egui::TextureId::default() || mesh.vertices.len() != 4 || mesh.indices.len() != 6 {
+                return None;
+            }
+            let rect = mesh.calc_bounds();
+            let transparent = mesh.vertices.iter().filter(|v| v.color == egui::Color32::TRANSPARENT).count();
+            (transparent == 2
+                && (((rect.width() - viewport.width()).abs() < 2.0 && rect.height() <= 21.0)
+                    || ((rect.height() - viewport.height()).abs() < 2.0 && rect.width() <= 21.0))
+                && rect.intersects(viewport))
+            .then_some(rect)
+        })
+        .collect()
+}
+
+#[test]
+fn organize_shadows_follow_the_preference() {
+    for theme in ["light", "dark"] {
+        let mut h = harness(theme);
+        h.state_mut().set_option("organize", "on").unwrap();
+        h.run_steps(3);
+        let original = shadows(&h, true);
+        assert_eq!(original.len(), 3);
+        h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+        h.run_steps(2);
+        assert!(shadows(&h, true).is_empty());
+        h.state_mut().set_option("show_page_edge_shadows", "true").unwrap();
+        h.run_steps(2);
+        assert_eq!(shadows(&h, true), original);
+    }
+}
+
+#[test]
+fn checkbox_and_multiple_documents_do_not_edit_pdf_state() {
+    let mut h = harness("light");
+    h.state_mut().open_bytes("second.pdf", None, pdf()).unwrap();
+    let ids: Vec<_> = h.state().views.iter().map(|v| v.id).collect();
+    h.state_mut().session.apply(ids[0], pdfcraft_engine::Edit::SetInfo { key: "Title".into(), value: "Keep existing edits".into() }).unwrap();
+    assert!(h.state().session.get(ids[0]).unwrap().dirty);
+    assert!(h.state().session.get(ids[0]).unwrap().can_undo().is_some());
+    let saved: Vec<_> = ids.iter().map(|id| h.state_mut().session.save_bytes(*id).unwrap()).collect();
+    let before: Vec<_> = h
+        .state()
+        .views
+        .iter()
+        .map(|v| {
+            let d = h.state().session.get(v.id).unwrap();
+            (
+                d.bytes.clone(),
+                d.dirty,
+                d.can_undo().map(str::to_owned),
+                d.can_redo().map(str::to_owned),
+                d.info.pages.iter().map(|p| (p.width, p.height, p.rotation)).collect::<Vec<_>>(),
+            )
+        })
+        .collect();
+    h.state_mut().set_option("dialog", "preferences").unwrap();
+    h.run_steps(3);
+    let checkbox = h.get_by_label("Show Page Edge Shadows");
+    checkbox.click();
+    h.run_steps(2);
+    assert_eq!(serde_json::from_str::<serde_json::Value>(&h.state().persist()).unwrap()["show_page_edge_shadows"], false);
+    h.get_by_label("Show Page Edge Shadows").focus();
+    h.key_press(egui::Key::Space);
+    h.run_steps(2);
+    assert_eq!(serde_json::from_str::<serde_json::Value>(&h.state().persist()).unwrap()["show_page_edge_shadows"], true);
+    let dialog_shadow = h.ctx.global_style().visuals.window_shadow;
+    assert_ne!(dialog_shadow, egui::Shadow::NONE);
+    h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+    h.run_steps(2);
+    assert_eq!(h.ctx.global_style().visuals.window_shadow, dialog_shadow);
+    h.state_mut().set_option("dialog", "none").unwrap();
+    for tab in [0, 1] {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(shadows(&h, false).is_empty());
+        let d = h.state().session.get(h.state().views[tab].id).unwrap();
+        assert_eq!(
+            (&d.bytes, d.dirty, d.can_undo(), d.can_redo()),
+            (&before[tab].0, before[tab].1, before[tab].2.as_deref(), before[tab].3.as_deref())
+        );
+        assert_eq!(d.info.pages.iter().map(|p| (p.width, p.height, p.rotation)).collect::<Vec<_>>(), before[tab].4);
+    }
+    for (id, bytes) in ids.iter().zip(&saved) {
+        assert_eq!(h.state_mut().session.save_bytes(*id).unwrap(), *bytes);
+    }
+    h.state_mut().open_bytes("new.pdf", None, pdf()).unwrap();
+    h.run_steps(2);
+    assert!(shadows(&h, false).is_empty());
+}
+
+#[test]
+fn rendered_page_content_is_identical_with_and_without_decoration() {
+    let mut h = harness("dark");
+    h.state_mut().set_option("panel", "pages").unwrap();
+    h.state_mut().set_option("zoom", "175").unwrap();
+    h.run_steps(3);
+    scroll_down(&mut h, 20.0);
+    for _ in 0..400 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(!h.state().render_pending(), "the actual PDF raster must be ready");
+    let rect = h.state().views[0].page_screen_rect(0).unwrap();
+    let fades = viewport_fades(&h);
+    assert_eq!(fades.iter().filter(|r| r.height() <= 21.0).count(), 2, "the screenshot comparison must contain both vertical fades");
+    let enabled = h.render().unwrap();
+    h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+    h.run_steps(2);
+    let disabled = h.render().unwrap();
+    assert_eq!(h.state().views[0].page_screen_rect(0), Some(rect));
+    let viewport = h.state().views[0].viewport_rect();
+    assert!(viewport_fades(&h).is_empty());
+    // Only the painter's actual decorative fade strips may change over the page.
+    // All remaining artwork, annotation and form pixels must be identical.
+    for (_, page) in h.state().views[0].visible_page_rects() {
+        let visible = page.intersect(viewport).shrink(2.0);
+        if !visible.is_positive() {
+            continue;
+        }
+        for y in visible.top().ceil() as u32..visible.bottom().floor() as u32 {
+            for x in visible.left().ceil() as u32..visible.right().floor() as u32 {
+                if !fades.iter().any(|fade| fade.expand(1.0).contains(egui::pos2(x as f32, y as f32))) {
+                    assert_eq!(enabled.get_pixel(x, y), disabled.get_pixel(x, y), "page content at {x},{y}");
+                }
+            }
+        }
+    }
+    // The top overlaps the first page's blue artwork; the bottom overlaps the
+    // blank second page. Sample clear of the unchanged scrollbar at the edge.
+    let x = rect.intersect(viewport).center().x as u32;
+    for (y, expected) in [(viewport.top() + 8.0, [204, 230, 255, 255]), (viewport.bottom() - 10.0, [255, 255, 255, 255])] {
+        assert_eq!(disabled.get_pixel(x, y as u32).0, expected, "unobscured PDF at y={y}");
+        assert_ne!(enabled.get_pixel(x, y as u32).0, expected, "fade overlays the PDF at y={y}");
+    }
+    // The Pages sidebar, including its thumbnails and selection borders, is unaffected.
+    for y in 0..enabled.height() {
+        for x in (0..viewport.left().floor() as u32).chain(viewport.right().ceil() as u32..enabled.width()) {
+            assert_eq!(enabled.get_pixel(x, y), disabled.get_pixel(x, y), "sidebar at {x},{y}");
+        }
+    }
+    assert_ne!(enabled.as_raw(), disabled.as_raw(), "the decoration really changes the image");
+    if let Ok(directory) = std::env::var("PDFCRAFT_SHADOW_SCREENSHOTS") {
+        enabled.save(format!("{directory}/page-shadows-enabled.png")).unwrap();
+        disabled.save(format!("{directory}/page-shadows-disabled.png")).unwrap();
+    }
+}
+
+fn harness(theme: &str) -> Harness<'static, PdfCraftApp> {
+    let theme = theme.to_string();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.set_option("theme", &theme).unwrap();
+        app.open_bytes("pages.pdf", None, pdf()).unwrap();
+        app.set_option("zoom", "100").unwrap();
+        app
+    });
+    h.run_steps(3);
+    h
+}
+
+fn shadows(h: &Harness<'static, PdfCraftApp>, grid: bool) -> Vec<egui::Rect> {
+    let color = pdfcraft_ui_egui::theme::Tokens::for_kind(h.state().theme).page_shadow;
+    fn collect(shape: &egui::Shape, color: egui::Color32, grid: bool, out: &mut Vec<egui::Rect>) {
+        match shape {
+            egui::Shape::Vec(shapes) => {
+                for s in shapes {
+                    collect(s, color, grid, out);
+                }
+            }
+            egui::Shape::Rect(r)
+                if r.fill == color
+                    && r.rect.width() > 20.0
+                    && r.rect.height() > 20.0
+                    && if grid {
+                        r.blur_width == 0.0 && r.corner_radius == egui::CornerRadius::same(1)
+                    } else {
+                        r.blur_width == 14.0 && r.corner_radius == egui::CornerRadius::ZERO
+                    } =>
+            {
+                out.push(r.rect)
+            }
+            _ => {}
+        }
+    }
+    let mut out = Vec::new();
+    for s in &h.output().shapes {
+        collect(&s.shape, color, grid, &mut out);
+    }
+    out
+}
+
+/// Synthetic pages include colored artwork, an annotation and a form field.
+fn pdf() -> Vec<u8> {
+    let objects = [
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [7 0 R] >> >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R 5 0 R] /Count 3 /MediaBox [0 0 300 400] >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /Contents 8 0 R /Annots [6 0 R 7 0 R] >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R >>".to_string(),
+        "<< /Type /Annot /Subtype /Text /Rect [20 20 40 40] /Contents (Note) >>".to_string(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (field) /V (value) /Rect [50 50 100 70] /P 3 0 R >>".to_string(),
+        {
+            let body = "0.8 0.9 1 rg 0 0 300 400 re f 0.3 g 10 10 280 8 re f";
+            format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len())
+        },
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    bytes
+}
+
+#[test]
+fn page_shadow_preference_round_trips_and_ignores_invalid_settings() {
+    let mut app = PdfCraftApp::new();
+    let enabled = |app: &PdfCraftApp| serde_json::from_str::<serde_json::Value>(&app.persist()).unwrap()["show_page_edge_shadows"].clone();
+    assert_eq!(enabled(&app), true);
+    app.restore("{}");
+    assert_eq!(enabled(&app), true);
+    for value in [false, true] {
+        app.set_option("show_page_edge_shadows", if value { "true" } else { "false" }).unwrap();
+        let mut restored = PdfCraftApp::new();
+        restored.restore(&app.persist());
+        assert_eq!(enabled(&restored), value);
+    }
+    for invalid in ["null", "0", "\"false\"", "[]", "{}"] {
+        app.restore(&format!("{{\"show_page_edge_shadows\":{invalid}}}"));
+        assert_eq!(enabled(&app), true);
+    }
+    app.restore("not json");
+    assert_eq!(enabled(&app), true);
+    assert!(app.set_option("show_page_edge_shadows", "maybe").is_err());
+    assert_eq!(enabled(&app), true);
+}
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 04103fb632..354689402b 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,6 +1,6 @@
 # PdfCraft roadmap: milestones and what's next
 
-> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M13: CLI check visits each directory once through aliases and cycles; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-13 · **Change:** minor (M3 #1577: optional page-edge shadows and viewport-edge fades; earlier: M13: CLI check visits each directory once through aliases and cycles; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M4: Extract and Split preserve shared Type 3 glyph resources; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M2: packed TIFF-predictor RGB rows retain their byte boundaries; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M3 #1364 candidate: consent before absolute local GoToR access; estimates unchanged); earlier: minor (M1 #1339: unchanged incremental saves of a classic cross-reference table write a zero-length subsection; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -90,7 +90,7 @@ total matches the parity estimate.
 | M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 80% | 20–40 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. An unchanged incremental save of a classic table writes a zero-length cross-reference subsection instead of a section with no subsections (#1339). Fuzzing runs nightly (`xtask fuzz`). Missing: ≥ 250 tests, own image codecs |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
-| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. |
+| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Preferences ▸ Appearance can hide decorative page-edge shadows and viewport-edge fades in the viewer and Organize grid (#1577); enabled by default, persisted app-wide and exposed through UI control. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. A custom text match that ends on a reconstructed separator stops before the next glyph (#1315). Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); Lab Bradford adaptation uses LMS white-point ratios, covered by independent neutral/chromatic and direct/Indexed render oracles; inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). |
@@ -161,6 +161,7 @@ M2 (renderer), M7 (content editing), M10 (OCR and Office), M11 (Preflight and st
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-13 | minor | M3 #1577: optional decorative page-edge shadows and viewport-edge fades; no PDF-content or readiness-percentage change. |
 | 2026-10-12 | minor | M13: CLI check directory identity, with overlap and symlink regressions; estimates unchanged |
 | 2026-10-12 | minor | M4: shared Type 3 glyph resources survive extraction, with save/reopen and independent raster regressions; estimates unchanged |
 | 2026-10-12 | minor | M2: packed TIFF-predictor RGB row boundaries, with decoding and page-render regressions; estimates unchanged |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 8f4194b932..d527dadf7f 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -9792,8 +9792,8 @@ milestone = "M14"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/view.rs::default_page_display_is_used_for_new_documents", "crates/ui-egui/tests/view.rs::default_zoom_is_used_for_new_documents", "crates/ui-egui/tests/view.rs::preferences_set_the_default_zoom"]
-notes = "Preferences ▸ Documents and view: Default page display and Default zoom (Fit to width, Zoom to page level or a percentage) for every new tab; a PDF that asks for a layout or zoom gets it. Missing: Acrobat's resolution, rendering and page-content options"
+evidence = ["crates/ui-egui/tests/page_shadows.rs::viewport_fades_follow_the_preference_and_keep_other_scroll_areas_styled", "crates/ui-egui/tests/page_shadows.rs::rendered_page_content_is_identical_with_and_without_decoration", "crates/ui-egui/tests/page_shadows.rs::page_shadow_preference_round_trips_and_ignores_invalid_settings", "crates/ui-egui/tests/page_shadows.rs::viewer_shadows_follow_the_preference_without_moving_pages", "crates/ui-egui/tests/page_shadows.rs::organize_shadows_follow_the_preference", "crates/ui-egui/tests/control.rs::page_shadows_are_an_observable_app_wide_preference", "crates/ui-egui/tests/view.rs::default_page_display_is_used_for_new_documents", "crates/ui-egui/tests/view.rs::default_zoom_is_used_for_new_documents", "crates/ui-egui/tests/view.rs::preferences_set_the_default_zoom"]
+notes = "Preferences ▸ Documents and view: Default page display and Default zoom (Fit to width, Zoom to page level or a percentage) for every new tab; a PDF that asks for a layout or zoom gets it. Preferences ▸ Appearance also has an app-wide, persistent Show Page Edge Shadows checkbox (on by default), exposed through ui.set and ui.state; it affects viewer and Organize decorations, including the viewport-edge gradients painted over pages, only. Missing: Acrobat's resolution, rendering and page-content options"
 
 [[feature]]
 id = "misc.prefs-documents"

From fc14719dff434e692123cb19b8c94e07a2d314cc Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Tue, 13 Oct 2026 19:18:41 +0200
Subject: [PATCH 004/270] feat(forms): edit checkbox and radio export values
 (#231)

---
 ROADMAP.md                           |  2 ++
 crates/automation/README.md          | 12 ++++++++
 crates/automation/src/forms.rs       | 17 +++++++++-
 crates/automation/src/tools.rs       |  4 ++-
 crates/automation/tests/form_bulk.rs | 23 ++++++++++++++
 crates/forms/README.md               | 13 ++++++++
 crates/forms/src/author.rs           | 46 ++++++++++++++++++++++++++++
 crates/forms/src/lib.rs              |  9 ++++++
 crates/forms/src/tests.rs            | 39 +++++++++++++++++++++++
 crates/ui-egui/src/prepare.rs        |  8 ++++-
 crates/ui-egui/tests/prepare.rs      | 33 ++++++++++++++++++++
 crates/xfdf/src/lib.rs               | 13 +++++---
 crates/xfdf/src/tests.rs             | 33 ++++++++++++++++++++
 parity/acrobat-features.toml         |  4 +--
 14 files changed, 246 insertions(+), 10 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index a035c9bf35..3013de8b1a 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,5 +1,7 @@
 # PdfCraft roadmap
 
+> **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-13 · **Change:** minor (M6 #231: edit checkbox/radio export values through individual field properties and automation, preserving selection and appearance; headless regression coverage, desktop visual verification pending; estimates unchanged)
+
 **Stage: alpha** · next: beta, ~26% (ready for real work 49% → 75%) and ~400–700 h away
 
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M13: CLI check visits each directory once through aliases and cycles; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
diff --git a/crates/automation/README.md b/crates/automation/README.md
index f2e4ec9282..f20ad35ea1 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -184,3 +184,15 @@ unapplied with a warning.
 `doc_batch` runs conversion, OCR and compression over files and optionally recursive
 folders. The CLI also exposes it as `pdfcraft-cli batch`. See the
 [batch guide](../../docs/cli-batch.md) for examples, output protection, errors and limits.
+
+## Editing button export values
+
+Use `form_set_props` with `field`, `export_value` and optional `widget`
+(1-based, default 1) to change a checkbox or radio button export value.
+`form_fields` returns `export_values` in widget order. The selected/default
+appearance states are preserved; the operation is undoable and survives saving.
+Widgets sharing an appearance state keep one export value. Bulk edits are not
+supported for this widget-specific property. Empty values, `Off`, conflicting
+choices and values over 4096 UTF-8 bytes return an error.
+
+Example: `form_set_props doc=1 field=agree export_value=Accepted widget=1`.
diff --git a/crates/automation/src/forms.rs b/crates/automation/src/forms.rs
index 7c60425a8c..6089d5a36a 100644
--- a/crates/automation/src/forms.rs
+++ b/crates/automation/src/forms.rs
@@ -232,6 +232,9 @@ impl Automation {
                 if !f.actions.unsupported.is_empty() {
                     o.insert("unsupported_scripts".into(), json!(f.actions.unsupported));
                 }
+                if matches!(f.kind, FormFieldKind::CheckBox | FormFieldKind::Radio) {
+                    o.insert("export_values".into(), json!((0..f.widgets.len()).map(|i| f.export_of(i)).collect::<Vec<_>>()));
+                }
                 match f.kind {
                     FormFieldKind::Radio => {
                         o.insert("options".into(), json!((0..f.widgets.len()).filter_map(|i| f.export_of(i)).collect::<Vec<_>>()));
@@ -327,6 +330,9 @@ impl Automation {
     }
 
     pub(crate) fn form_set_props(&mut self, a: &Args) -> Result<Value> {
+        if a.get("widget").is_some() && a.get("export_value").is_none() {
+            return Err(bad("widget requires export_value"));
+        }
         let single = a.opt_str("field")?;
         let bulk = a.get("fields").is_some();
         if single.is_some() == bulk {
@@ -344,7 +350,7 @@ impl Automation {
                     return Err(bad(format!("field {name:?} is listed more than once")));
                 }
             }
-            for key in ["name", "rect", "rotation"] {
+            for key in ["name", "rect", "rotation", "export_value", "widget"] {
                 if a.get(key).is_some() {
                     return Err(bad(format!("{key} applies to one field; use field instead of fields")));
                 }
@@ -396,6 +402,15 @@ impl Automation {
         };
         Ok(FieldProps {
             rect,
+            export_value: a
+                .opt_str("export_value")?
+                .map(|value| -> Result<_> {
+                    let index = a.opt_int("widget")?.unwrap_or(1);
+                    let index =
+                        usize::try_from(index).ok().and_then(|n| n.checked_sub(1)).ok_or_else(|| bad("widget must be a positive 1-based index"))?;
+                    Ok((index, value.to_owned()))
+                })
+                .transpose()?,
             name: a.opt_str("name")?.map(str::to_owned),
             tooltip: a.opt_str("tooltip")?.map(str::to_owned),
             read_only: a.opt_bool("read_only")?,
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index cfdeb1c16f..be85f00077 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -364,7 +364,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "form_set_props",
             "Field properties",
-            "Change field properties: give field for one field, or fields for a list of unique field names (1–1000). A bulk change is atomic and one Undo step; an invalid or locked field leaves every field unchanged. Only the given properties change, and partial appearance changes preserve each field's other colours and font. name (rename), rect (position) and rotation require a single field. General and Options: tooltip, read_only, required, multiline, max_length (0 = no limit), options (combo/list items), font_size (0 = auto), format, validate, calculate (Acrobat's native AF rules). Options: align (left, center, right), default (Reset form's value; check boxes/radio buttons use their on state, \"\" for off), flags { scroll, rich_text, password, file_select, spell_check, comb (needs max_length), sort, editable, multi_select, commit_immediately }, check_style (check boxes/radio buttons: check, circle, cross, diamond, square, star). rotation is 0, 90, 180 or 270 degrees counterclockwise and swaps width/height when the axis changes. Undoable.",
+            "Change field properties: give field for one field, or fields for a list of unique field names (1–1000). A bulk change is atomic and one Undo step; an invalid or locked field leaves every field unchanged. Only the given properties change, and partial appearance changes preserve each field's other colours and font. name (rename), rect (position), rotation and export_value require a single field. export_value edits a checkbox or radio widget (widget: 1-based, default 1), preserving its selected/default state; widgets sharing that state keep the same export value. General and Options: tooltip, read_only, required, multiline, max_length (0 = no limit), options (combo/list items), font_size (0 = auto), format, validate, calculate (Acrobat's native AF rules). Options: align (left, center, right), default (Reset form's value; check boxes/radio buttons use their on state, \"\" for off), flags { scroll, rich_text, password, file_select, spell_check, comb (needs max_length), sort, editable, multi_select, commit_immediately }, check_style (check boxes/radio buttons: check, circle, cross, diamond, square, star). rotation is 0, 90, 180 or 270 degrees counterclockwise and swaps width/height when the axis changes. Undoable.",
         )
         .with({
             let mut input = schema(
@@ -373,6 +373,8 @@ pub fn tools() -> Vec<ToolDef> {
                 "field": { "type": "string", "description": "The field's current name." },
                 "fields": { "type": "array", "items": { "type": "string" }, "minItems": 1, "maxItems": 1000, "uniqueItems": true, "description": "Apply the same changes to these fields in one atomic edit. Use either field or fields." },
                 "name": { "type": "string" },
+                "export_value": { "type": "string", "minLength": 1, "description": "Checkbox/radio export value; not Off; at most 4096 UTF-8 bytes." },
+                "widget": { "type": "integer", "minimum": 1, "description": "1-based widget for export_value (default 1)." },
                 "tooltip": { "type": "string" },
                 "read_only": { "type": "boolean" },
                 "required": { "type": "boolean" },
diff --git a/crates/automation/tests/form_bulk.rs b/crates/automation/tests/form_bulk.rs
index 8b8904c974..4296cbc891 100644
--- a/crates/automation/tests/form_bulk.rs
+++ b/crates/automation/tests/form_bulk.rs
@@ -151,3 +151,26 @@ fn bulk_options_apply_per_field_and_refuse_an_invalid_comb_atomically() {
     assert_eq!(bytes(&a, id), before);
     std::fs::remove_dir_all(dir).unwrap();
 }
+
+#[test]
+fn button_export_edit_is_one_undo_step_and_survives_save() {
+    let (mut a, id, dir) = setup("button-export");
+    tool(&mut a, "form_add_field", json!({"doc": id, "page": 1, "type": "checkbox", "name": "agree", "rect": [20, 20, 40, 40]}));
+    tool(&mut a, "form_fill", json!({"doc": id, "values": {"agree": true}}));
+    let before = bytes(&a, id);
+    call(&mut a, json!({"doc": id, "field": "agree", "export_value": "Accepted", "widget": 1}));
+    let f = tool(&mut a, "form_fields", json!({"doc": id}));
+    let check = f["fields"].as_array().unwrap().iter().find(|f| f["name"] == "agree").unwrap();
+    assert_eq!(check["export_values"], json!(["Accepted"]));
+    assert_eq!(check["value"], true);
+    tool(&mut a, "edit_undo", json!({"doc": id}));
+    assert_eq!(bytes(&a, id), before);
+    tool(&mut a, "edit_redo", json!({"doc": id}));
+    tool(&mut a, "doc_save", json!({"doc": id, "path": "saved.pdf"}));
+    let reopened = tool(&mut a, "doc_open", json!({"path": "saved.pdf"}))["doc"].as_u64().unwrap();
+    let f = tool(&mut a, "form_fields", json!({"doc": reopened}));
+    let check = f["fields"].as_array().unwrap().iter().find(|f| f["name"] == "agree").unwrap();
+    assert_eq!(check["export_values"], json!(["Accepted"]));
+    assert_eq!(check["value"], true);
+    std::fs::remove_dir_all(dir).unwrap();
+}
diff --git a/crates/forms/README.md b/crates/forms/README.md
index 3280cc2431..bc8e19fc95 100644
--- a/crates/forms/README.md
+++ b/crates/forms/README.md
@@ -57,6 +57,19 @@ delete_field(&mut doc, "email")?;
   buttons joining a group become kid widgets with their own export state. Renaming changes only
   the last part of a dotted name.
 
+## Button export values
+
+`FieldProps::export_value = Some((widget_index, value))` edits a checkbox or radio
+button's export value. The API index is zero-based. It writes a complete `/Opt`
+mapping, preserving appearance names, selected states and reset defaults; an
+export-only change leaves custom appearance streams intact. Widgets sharing an
+appearance state keep the same export value. Conflicting shared-state mappings,
+ambiguous choices, invalid widget indices, empty values, `Off`, and values over
+4096 UTF-8 bytes are refused.
+
+`Field::export_values` resolves button values for data exchange. An unchecked
+button still exports as `Off` in the data formats.
+
 ## Not yet
 
 Rich-text values and exact appearance metrics/layout remain incomplete. JavaScript
diff --git a/crates/forms/src/author.rs b/crates/forms/src/author.rs
index 6d49be1001..a8c99cb483 100644
--- a/crates/forms/src/author.rs
+++ b/crates/forms/src/author.rs
@@ -68,6 +68,9 @@ pub struct FieldProps {
     pub max_len: Option<Option<usize>>,
     /// Choice options (display texts; export values equal them).
     pub options: Option<Vec<String>>,
+    /// Change one button widget's export value without changing its appearance state.
+    /// Widgets sharing that state are kept in sync. The index is zero-based.
+    pub export_value: Option<(usize, String)>,
     /// Font size (0 = auto).
     pub font_size: Option<f64>,
     /// Position: move or resize one widget (its index in [`Field::widgets`]) to a new rect in
@@ -845,6 +848,36 @@ fn swapped_around_center(r: [f64; 4]) -> Option<[f64; 4]> {
     (out.iter().all(|v| v.is_finite()) && out[2] - out[0] >= 4.0 && out[3] - out[1] >= 4.0).then_some(out)
 }
 
+/// Build a complete /Opt mapping before modifying the document. Appearance names,
+/// /V and /DV stay untouched, so an export-value edit does not change selection.
+fn button_export_options(f: &Field, index: usize, value: &str) -> Result<Vec<Object>, FormError> {
+    if !matches!(f.kind, FieldKind::CheckBox | FieldKind::Radio) {
+        return invalid("only check boxes and radio buttons have an export value");
+    }
+    if value.is_empty() || value == "Off" || value.len() > 4096 {
+        return invalid("export value must be non-empty, at most 4096 bytes, and not Off");
+    }
+    let widget = f.widgets.get(index).ok_or_else(|| FormError::Invalid("button widget index is out of range".into()))?;
+    let state = widget.on_state.as_deref().ok_or_else(|| FormError::Invalid("button has no on appearance state".into()))?;
+    if !f.options.is_empty() && f.options.len() != f.widgets.len() {
+        return invalid("button export options do not match its widgets");
+    }
+    let previous = f.export_of(index);
+    let mut out = Vec::with_capacity(f.widgets.len());
+    for (i, w) in f.widgets.iter().enumerate() {
+        let export = f.export_of(i).ok_or_else(|| FormError::Invalid("button has no on appearance state".into()))?;
+        let same_state = w.on_state.as_deref() == Some(state);
+        if !same_state && (export == value || w.on_state.as_deref() == Some(value)) {
+            return invalid("export value conflicts with another button choice");
+        }
+        if same_state && Some(export) != previous {
+            return invalid("widgets with the same appearance state have conflicting export values");
+        }
+        out.push(Object::String(PdfString::text(if same_state { value } else { export })));
+    }
+    Ok(out)
+}
+
 /// Change a field's properties (General and Options tabs) and redraw it.
 pub fn set_props(doc: &mut Document, name: &str, props: &FieldProps) -> Result<String, FormError> {
     if props.font_size.is_some_and(|size| !size.is_finite() || size < 0.0) {
@@ -858,6 +891,10 @@ pub fn set_props(doc: &mut Document, name: &str, props: &FieldProps) -> Result<S
     }
     let all = fields(doc);
     let f = all.iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?.clone();
+    let export_options = props.export_value.as_ref().map(|(index, value)| button_export_options(&f, *index, value)).transpose()?;
+    if props.export_value.is_some() && props.options.is_some() {
+        return invalid("give export_value or options, not both");
+    }
     // Validated before anything is written, so a refused rotation leaves the document unchanged.
     // `Some(Some(rect))`: the widget's axis changes and it gets the swapped rectangle.
     let mut rotated_rect: Option<Option<[f64; 4]>> = None;
@@ -879,6 +916,12 @@ pub fn set_props(doc: &mut Document, name: &str, props: &FieldProps) -> Result<S
     if f.locked() && props.locked != Some(false) && *props != (FieldProps { locked: props.locked, ..FieldProps::default() }) {
         return invalid(format!("{name} is locked: unlock it first"));
     }
+    if let Some(options) = export_options.as_ref()
+        && *props == (FieldProps { export_value: props.export_value.clone(), ..FieldProps::default() })
+    {
+        doc.update_dict(f.obj, |d| d.set(b"Opt".to_vec(), Object::Array(options.clone())))?;
+        return Ok(name.to_string());
+    }
     if let Some(lock) = props.locked {
         for w in &f.widgets {
             let flags = doc.get(w.obj).as_dict().and_then(|d| d.get(b"F").and_then(|v| doc.resolve(v).as_int())).unwrap_or(0);
@@ -972,6 +1015,9 @@ pub fn set_props(doc: &mut Document, name: &str, props: &FieldProps) -> Result<S
                 }
             }
         }
+        if let Some(options) = &export_options {
+            d.set(b"Opt".to_vec(), Object::Array(options.clone()));
+        }
         if let Some(opts) = &props.options {
             d.set(b"Opt".to_vec(), Object::Array(opts.iter().map(|o| Object::String(PdfString::text(o))).collect()));
         }
diff --git a/crates/forms/src/lib.rs b/crates/forms/src/lib.rs
index 337ae7652a..e637a6d87a 100644
--- a/crates/forms/src/lib.rs
+++ b/crates/forms/src/lib.rs
@@ -175,6 +175,15 @@ impl Field {
         self.widgets.iter().position(|w| w.on_state.as_deref() == Some(state)).and_then(|i| self.export_of(i)).unwrap_or(state)
     }
 
+    /// Values for data export, resolving button appearance names through /Opt.
+    pub fn export_values(&self) -> Vec<String> {
+        if matches!(self.kind, FieldKind::CheckBox | FieldKind::Radio) {
+            self.value.iter().map(|v| self.export_for_state(v).to_string()).collect()
+        } else {
+            self.value.clone()
+        }
+    }
+
     /// The value as one string: text, the state name, or the selected display texts.
     pub fn display_value(&self) -> String {
         match self.kind {
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 0256bfafb9..e3fa748651 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -1943,3 +1943,42 @@ fn page_shapes_closes_only_last_stroked_subpath_but_all_filled_subpaths() {
     assert_eq!(filled.boxes, [[50.0, 100.0, 170.0, 140.0], [200.0, 100.0, 320.0, 140.0]]);
     assert!(filled.rules.is_empty());
 }
+
+#[test]
+fn editing_button_export_values_preserves_selection_and_appearance() {
+    let mut doc = fixture();
+    set_value(&mut doc, "size", &FieldValue::Radio(Some("S".into()))).unwrap();
+    let before = field(&fields(&doc), "size").clone();
+    let appearances: Vec<_> = before.widgets.iter().map(|w| doc.get(w.obj).as_dict().unwrap().get(b"AP").cloned()).collect();
+    set_props(&mut doc, "size", &FieldProps { export_value: Some((0, "Small å".into())), ..Default::default() }).unwrap();
+    let after = field(&fields(&doc), "size").clone();
+    assert_eq!(after.value, before.value);
+    assert_eq!(after.default, before.default);
+    assert_eq!(after.widgets, before.widgets);
+    assert_eq!(after.export_of(0), Some("Small å"));
+    assert_eq!(after.export_of(1), before.export_of(1));
+    assert_eq!(after.export_values(), vec!["Small å"]);
+    assert_eq!(appearances, after.widgets.iter().map(|w| doc.get(w.obj).as_dict().unwrap().get(b"AP").cloned()).collect::<Vec<_>>());
+    let mut saved = reopen(&doc);
+    assert_eq!(field(&fields(&saved), "size").export_of(0), Some("Small å"));
+    set_value(&mut saved, "size", &FieldValue::Radio(Some("Small å".into()))).unwrap();
+    reset(&mut saved, None).unwrap();
+    assert_eq!(field(&fields(&saved), "size").value, before.default);
+
+    set_value(&mut doc, "agree", &FieldValue::Check(true)).unwrap();
+    set_props(&mut doc, "agree", &FieldProps { export_value: Some((0, "Accepted".into())), ..Default::default() }).unwrap();
+    let check = field(&fields(&doc), "agree").clone();
+    assert_eq!(check.value, vec!["Yes"]);
+    assert_eq!(check.export_values(), vec!["Accepted"]);
+    assert_eq!(field(&fields(&reopen(&doc)), "agree").export_of(0), Some("Accepted"));
+}
+
+#[test]
+fn invalid_button_export_edits_leave_document_unchanged() {
+    let mut doc = fixture();
+    let before = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    for (field_name, index, value) in [("size", 99, "new"), ("size", 0, ""), ("size", 0, "Off"), ("size", 0, "L"), ("name", 0, "new")] {
+        assert!(set_props(&mut doc, field_name, &FieldProps { export_value: Some((index, value.into())), ..Default::default() }).is_err());
+        assert_eq!(write_incremental(&doc, &SaveOptions::default()).unwrap(), before);
+    }
+}
diff --git a/crates/ui-egui/src/prepare.rs b/crates/ui-egui/src/prepare.rs
index 37747f14c7..762d090254 100644
--- a/crates/ui-egui/src/prepare.rs
+++ b/crates/ui-egui/src/prepare.rs
@@ -758,6 +758,7 @@ pub struct FieldDraft {
     pub default: String,
     /// Check boxes and radio buttons: this widget's "on" state (export value).
     pub on_state: String,
+    pub export_value: String,
     /// 0 = auto.
     pub font_size: f64,
     /// Left, bottom, width, height in points.
@@ -824,6 +825,7 @@ impl FieldDraft {
             quadding: f.quadding,
             default: f.default.first().cloned().unwrap_or_default(),
             on_state: f.widgets.get(widget).and_then(|w| w.on_state.clone()).unwrap_or_default(),
+            export_value: f.export_of(widget).unwrap_or_default().to_string(),
             font_size: da_size(&f.da),
             position: [r[0], r[1], r[2] - r[0], r[3] - r[1]],
             rotation: f.widgets.get(widget).map(|w| w.rotation).unwrap_or(0),
@@ -877,6 +879,7 @@ impl FieldDraft {
             multiline: ch(self.multiline, o.multiline),
             max_len: ((self.limit, self.max_len) != (o.limit, o.max_len)).then_some((self.limit && self.max_len > 0).then_some(self.max_len)),
             options: (self.options != o.options).then(|| self.options.clone()),
+            export_value: (self.export_value != o.export_value).then(|| (self.widget, self.export_value.clone())),
             font_size: ((self.font_size - o.font_size).abs() > 1e-6).then_some(self.font_size),
             rect: (self.position != o.position).then(|| {
                 let [x, y, w, h] = self.position;
@@ -1123,7 +1126,10 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Toke
                 FormFieldKind::CheckBox | FormFieldKind::Radio => {
                     use pdfcraft_engine::field_flags as ff;
                     let on = d.on_state.clone();
-                    ui.label(crate::i18n::fmt(tl!("Export Value: {on}"), &[("on", &on)]));
+                    ui.horizontal(|ui| {
+                        let label = ui.label(crate::i18n::fmt(tl!("Export Value: {on}"), &[("on", "")]));
+                        ui.text_edit_singleline(&mut d.export_value).labelled_by(label.id);
+                    });
                     let mut checked = !d.default.is_empty() && d.default == on;
                     let label =
                         if d.kind == FormFieldKind::CheckBox { tl!("Check box is checked by default") } else { tl!("Button is checked by default") };
diff --git a/crates/ui-egui/tests/prepare.rs b/crates/ui-egui/tests/prepare.rs
index b23f1a9f8f..81359d8bc2 100644
--- a/crates/ui-egui/tests/prepare.rs
+++ b/crates/ui-egui/tests/prepare.rs
@@ -497,3 +497,36 @@ fn actions_tab_adds_and_removes_actions() {
         ]
     );
 }
+
+#[test]
+fn button_export_properties_apply_cancel_and_undo() {
+    let mut h = harness();
+    h.state_mut().execute("form.prepare");
+    h.run_steps(2);
+    h.state_mut().open_field_props("agree", 0);
+    h.run_steps(2);
+    h.get_by_label("Options").click();
+    h.run_steps(2);
+    let original = h.state().field_props.as_ref().unwrap().export_value.clone();
+    h.state_mut().field_props.as_mut().unwrap().export_value = "Accepted".into();
+    h.get_by_label("Cancel").click();
+    h.run_steps(2);
+    h.state_mut().open_field_props("agree", 0);
+    h.run_steps(2);
+    assert_eq!(h.state().field_props.as_ref().unwrap().export_value, original);
+    h.state_mut().field_props.as_mut().unwrap().export_value = "Accepted".into();
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    {
+        let s = h.state();
+        let f = s.session.get(s.views[0].id).unwrap().form.iter().find(|f| f.name == "agree").unwrap();
+        assert_eq!(f.export_of(0), Some("Accepted"));
+    }
+    h.state_mut().execute("edit.undo");
+    h.run_steps(3);
+    {
+        let s = h.state();
+        let f = s.session.get(s.views[0].id).unwrap().form.iter().find(|f| f.name == "agree").unwrap();
+        assert_eq!(f.export_of(0), Some(original.as_str()));
+    }
+}
diff --git a/crates/xfdf/src/lib.rs b/crates/xfdf/src/lib.rs
index d9287101ba..9b1b439caf 100644
--- a/crates/xfdf/src/lib.rs
+++ b/crates/xfdf/src/lib.rs
@@ -420,7 +420,7 @@ fn xfdf_fields(doc: &Document, out: &mut String) {
         }
         node.values = match f.kind {
             FieldKind::CheckBox | FieldKind::Radio if f.value.is_empty() => vec!["Off".into()],
-            _ => f.value.clone(),
+            _ => f.export_values(),
         };
     }
     fn write_node(name: &str, node: &Node, out: &mut String) {
@@ -480,7 +480,7 @@ pub fn export_fdf(doc: &Document, comments: bool, fields: bool, file: &str) -> V
             body.extend_from_slice(b" /V ");
             match f.kind {
                 FieldKind::CheckBox | FieldKind::Radio => {
-                    let v = f.value.first().cloned().unwrap_or_else(|| "Off".into());
+                    let v = f.export_values().first().cloned().unwrap_or_else(|| "Off".into());
                     pdfcraft_cos::serialize(&Object::Name(pdfcraft_forms::name_bytes(&v)), &mut body);
                 }
                 FieldKind::List if f.value.len() > 1 => {
@@ -575,7 +575,7 @@ pub fn export_data(doc: &Document, format: Format) -> String {
         .map(|f| {
             let v = match f.kind {
                 FieldKind::CheckBox | FieldKind::Radio if f.value.is_empty() => "Off".to_string(),
-                _ => f.value.join(", "),
+                _ => f.export_values().join(", "),
             };
             (f.name, v)
         })
@@ -984,8 +984,11 @@ pub fn data_values(bytes: &[u8]) -> Result<Vec<(String, Vec<String>)>, DataError
             .into_iter()
             .filter(|f| !matches!(f.kind, FieldKind::PushButton | FieldKind::Signature))
             .map(|f| {
-                let v =
-                    if matches!(f.kind, FieldKind::CheckBox | FieldKind::Radio) && f.value.is_empty() { vec!["Off".to_string()] } else { f.value };
+                let v = if matches!(f.kind, FieldKind::CheckBox | FieldKind::Radio) && f.value.is_empty() {
+                    vec!["Off".to_string()]
+                } else {
+                    f.export_values()
+                };
                 (f.name, v)
             })
             .collect());
diff --git a/crates/xfdf/src/tests.rs b/crates/xfdf/src/tests.rs
index be747d77e1..d61273f1b5 100644
--- a/crates/xfdf/src/tests.rs
+++ b/crates/xfdf/src/tests.rs
@@ -887,3 +887,36 @@ fn duplicate_xfdf_annotation_flags_do_not_turn_on_unrelated_bits() {
         assert_eq!(square.get(b"F").and_then(Object::as_int), Some(expected), "flags={flags}");
     }
 }
+
+#[test]
+fn edited_button_export_values_round_trip_in_all_data_formats() {
+    use pdfcraft_forms::{FieldProps, set_props};
+    let mut doc = blank();
+    add_field(&mut doc, 0, [80.0, 650.0, 94.0, 664.0], &NewField::Radio { group: Some("Size".into()), export: "S".into() }, None).unwrap();
+    add_field(&mut doc, 0, [100.0, 650.0, 114.0, 664.0], &NewField::Radio { group: Some("Size".into()), export: "L".into() }, None).unwrap();
+    set_props(&mut doc, "Agree", &FieldProps { export_value: Some((0, "Accepted".into())), ..Default::default() }).unwrap();
+    set_props(&mut doc, "Size", &FieldProps { export_value: Some((0, "Small".into())), ..Default::default() }).unwrap();
+    set_value(&mut doc, "Agree", &FieldValue::Check(true)).unwrap();
+    set_value(&mut doc, "Size", &FieldValue::Radio(Some("Small".into()))).unwrap();
+    let doc = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+    let mut exports = vec![export_xfdf(&doc, false, true, "").into_bytes(), export_fdf(&doc, false, true, "")];
+    exports.extend([Format::Xml, Format::Csv, Format::Txt].map(|f| export_data(&doc, f).into_bytes()));
+    for (index, bytes) in exports.into_iter().enumerate() {
+        if index < 2 {
+            let values = data_values(&bytes).unwrap();
+            assert_eq!(values.iter().find(|(n, _)| n == "Agree").unwrap().1, vec!["Accepted"]);
+            assert_eq!(values.iter().find(|(n, _)| n == "Size").unwrap().1, vec!["Small"]);
+        } else {
+            // data_values reads XFDF/FDF/PDF; import also handles XML/CSV/TXT.
+            let text = std::str::from_utf8(&bytes).unwrap();
+            assert!(text.contains("Accepted") && text.contains("Small"), "{text}");
+        }
+        let mut target = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+        set_value(&mut target, "Agree", &FieldValue::Check(false)).unwrap();
+        set_value(&mut target, "Size", &FieldValue::Radio(Some("L".into()))).unwrap();
+        import(&mut target, &bytes).unwrap();
+        let fs = fields(&target);
+        assert_eq!(fs.iter().find(|f| f.name == "Agree").unwrap().export_values(), vec!["Accepted"]);
+        assert_eq!(fs.iter().find(|f| f.name == "Size").unwrap().export_values(), vec!["Small"]);
+    }
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 8f4194b932..f5189bc33e 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4896,8 +4896,8 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties"]
 tools = ["form_set_props"]
-evidence = ["crates/forms/src/tests.rs::properties_rename_and_delete", "crates/automation/tests/automation.rs::preparing_a_form_through_tools", "crates/forms/src/tests.rs::options_tab_flags_alignment_and_defaults", "crates/ui-egui/tests/prepare.rs::options_tab_sets_flags_alignment_and_defaults", "crates/automation/tests/form_bulk.rs::bulk_options_apply_per_field_and_refuse_an_invalid_comb_atomically"]
-notes = "text: alignment, default, multi-line, scroll, rich text flag, limit, password, file selection, spell check, comb; choices: items, default, sort, custom text, multiple selection, commit immediately; check boxes and radios: checked by default, radios in unison. Shared GUI offers applicable text/choice flags, alignment, text limits and check styles; choices/defaults remain individual GUI edits"
+evidence = ["crates/forms/src/tests.rs::properties_rename_and_delete", "crates/automation/tests/automation.rs::preparing_a_form_through_tools", "crates/forms/src/tests.rs::options_tab_flags_alignment_and_defaults", "crates/ui-egui/tests/prepare.rs::options_tab_sets_flags_alignment_and_defaults", "crates/automation/tests/form_bulk.rs::bulk_options_apply_per_field_and_refuse_an_invalid_comb_atomically", "crates/forms/src/tests.rs::editing_button_export_values_preserves_selection_and_appearance", "crates/forms/src/tests.rs::invalid_button_export_edits_leave_document_unchanged", "crates/xfdf/src/tests.rs::edited_button_export_values_round_trip_in_all_data_formats", "crates/automation/tests/form_bulk.rs::button_export_edit_is_one_undo_step_and_survives_save", "crates/ui-egui/tests/prepare.rs::button_export_properties_apply_cancel_and_undo"]
+notes = "text: alignment, default, multi-line, scroll, rich text flag, limit, password, file selection, spell check, comb; choices: items, default, sort, custom text, multiple selection, commit immediately; check boxes and radios: checked by default, radios in unison, individual widget export value via /Opt without changing selection or appearance; XFDF/FDF/XML/CSV/TXT exports use the mapped values. Export editing has headless Apply/Cancel/Undo and save/reopen coverage; desktop typing/appearance has not been visually verified. Shared GUI offers applicable text/choice flags, alignment, text limits and check styles; choices/defaults remain individual GUI edits"
 
 [[feature]]
 id = "form.props-actions"

From 0e8d4d70fabbdc4f030af86f801604d1db5766a6 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Tue, 13 Oct 2026 19:31:14 +0200
Subject: [PATCH 005/270] test(forms): type export values through the
 properties widget

---
 crates/ui-egui/tests/prepare.rs | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/tests/prepare.rs b/crates/ui-egui/tests/prepare.rs
index 81359d8bc2..896eeff196 100644
--- a/crates/ui-egui/tests/prepare.rs
+++ b/crates/ui-egui/tests/prepare.rs
@@ -500,6 +500,14 @@ fn actions_tab_adds_and_removes_actions() {
 
 #[test]
 fn button_export_properties_apply_cancel_and_undo() {
+    fn retype(h: &mut Harness<'static, PdfCraftApp>, value: &str) {
+        use egui::accesskit::Role;
+        h.get_by_role_and_label(Role::TextInput, "Export Value: ").click();
+        h.run_steps(1);
+        h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+        h.get_by_role_and_label(Role::TextInput, "Export Value: ").type_text(value);
+        h.run_steps(2);
+    }
     let mut h = harness();
     h.state_mut().execute("form.prepare");
     h.run_steps(2);
@@ -508,13 +516,15 @@ fn button_export_properties_apply_cancel_and_undo() {
     h.get_by_label("Options").click();
     h.run_steps(2);
     let original = h.state().field_props.as_ref().unwrap().export_value.clone();
-    h.state_mut().field_props.as_mut().unwrap().export_value = "Accepted".into();
+    retype(&mut h, "Accepted");
     h.get_by_label("Cancel").click();
     h.run_steps(2);
     h.state_mut().open_field_props("agree", 0);
     h.run_steps(2);
     assert_eq!(h.state().field_props.as_ref().unwrap().export_value, original);
-    h.state_mut().field_props.as_mut().unwrap().export_value = "Accepted".into();
+    h.get_by_label("Options").click();
+    h.run_steps(2);
+    retype(&mut h, "Accepted");
     h.get_by_label("OK").click();
     h.run_steps(3);
     {

From 0807cb05c3ce280a41decd78f0829b368f7341f7 Mon Sep 17 00:00:00 2001
From: JM <srt8hellcat2@gmail.com>
Date: Tue, 13 Oct 2026 17:35:45 +0000
Subject: [PATCH 006/270] fix(ui): preserve tool commands across document
 opening

---
 crates/ui-egui/src/lib.rs               |  61 ++++++--
 crates/ui-egui/src/open_worker_tests.rs | 185 ++++++++++++++++++++++++
 crates/ui-egui/tests/commands.rs        |  17 ++-
 3 files changed, 245 insertions(+), 18 deletions(-)

diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index ab87094886..b3ac430ab4 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -1193,11 +1193,15 @@ impl PdfCraftApp {
             open_worker::ResultKind::Failed(reason) => {
                 self.notify_fmt("Couldn't open {name}: {reason}", &[("name", &pending.name), ("reason", &reason)]);
             }
-            open_worker::ResultKind::Conversion(bytes) => {
-                if let Some(Err(error)) = self.open_converted(&pending.name, &bytes) {
-                    self.notify_fmt("Couldn't open {name}: {e}", &[("name", &pending.name), ("e", &error)]);
+            open_worker::ResultKind::Conversion(bytes) => match self.open_converted(&pending.name, &bytes) {
+                Some(Ok(())) => {
+                    if let Some(command) = pending.then {
+                        self.execute(command);
+                    }
                 }
-            }
+                Some(Err(error)) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &pending.name), ("e", &error)]),
+                None => {}
+            },
             open_worker::ResultKind::Prepared { bytes, result } => match *result {
                 Ok(prepared) => match self.finish_open(&pending.name, pending.path.clone(), bytes.len(), prepared, pending.activate) {
                     Ok(id) => {
@@ -1727,6 +1731,13 @@ impl PdfCraftApp {
 
     #[cfg(not(target_arch = "wasm32"))]
     pub fn open_path(&mut self, path: &str) {
+        self.open_path_attempt(path);
+    }
+
+    /// Whether this attempt opened a document, created a password prompt, or queued an open.
+    /// Failure can leave an older password prompt intact; it does not belong to this attempt.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn open_path_attempt(&mut self, path: &str) -> bool {
         let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string());
         // Taken before reading: a build that rewrites the file meanwhile still counts as a change.
         let stamp = file_watch::Stamp::at(path);
@@ -1734,20 +1745,26 @@ impl PdfCraftApp {
         // deterministic inline startup and test flows. Once live, reading and preparation use
         // the bounded worker and commit on the UI thread.
         if self.ctx.is_none() || self.run_inline {
-            match std::fs::read(path) {
+            return match std::fs::read(path) {
                 Ok(bytes) => {
                     let before = self.views.len();
                     if let Err(error) = self.open_bytes(&name, Some(path.to_string()), bytes) {
                         self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
-                    } else if self.views.len() > before
-                        && let Some(doc) = self.views.last().map(|view| view.id)
-                    {
-                        self.watch.known_as(doc, stamp);
+                        false
+                    } else {
+                        if self.views.len() > before
+                            && let Some(doc) = self.views.last().map(|view| view.id)
+                        {
+                            self.watch.known_as(doc, stamp);
+                        }
+                        true
                     }
                 }
-                Err(error) => self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &error.to_string())]),
-            }
-            return;
+                Err(error) => {
+                    self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &error.to_string())]);
+                    false
+                }
+            };
         }
         self.startup_superseded = true;
         if let Err(error) = self.schedule_open(OpenRequest {
@@ -1762,6 +1779,9 @@ impl PdfCraftApp {
             then: None,
         }) {
             self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
+            false
+        } else {
+            true
         }
     }
 
@@ -2064,12 +2084,21 @@ impl PdfCraftApp {
         self.ask_one(pickers::Ask::File(dialog), None, move |app, path| {
             let path = path.to_string_lossy().into_owned();
             let before = app.views.len();
-            app.open_path(&path);
-            if let Some(prompt) = app.password_prompt.as_mut().filter(|p| p.path.as_deref() == Some(path.as_str())) {
-                // Encrypted: the tool runs once the password is in.
-                prompt.then = Some(command);
+            let pending_before = app.pending_opens.len();
+            if !app.open_path_attempt(&path) {
+                return;
+            }
+            if app.ctx.is_some() && !app.run_inline {
+                // UI-thread completion cannot run inside open_path: only its newly queued
+                // request owns this continuation, including through password retries.
+                if let Some(pending) = app.pending_opens.get_mut(pending_before) {
+                    pending.then = Some(command);
+                }
             } else if app.views.len() > before && app.active.is_some() {
                 app.execute(command);
+            } else if let Some(prompt) = app.password_prompt.as_mut().filter(|p| p.path.as_deref() == Some(path.as_str())) {
+                // Encrypted: the tool runs once the password is in.
+                prompt.then = Some(command);
             }
         });
     }
diff --git a/crates/ui-egui/src/open_worker_tests.rs b/crates/ui-egui/src/open_worker_tests.rs
index 0e5775feb1..f71c9fbebe 100644
--- a/crates/ui-egui/src/open_worker_tests.rs
+++ b/crates/ui-egui/src/open_worker_tests.rs
@@ -89,6 +89,191 @@ fn open_prepare_keeps_control_and_existing_tabs_live_until_atomic_commit() {
     let _ = std::fs::remove_file(path);
 }
 
+#[test]
+fn inline_failed_tool_open_does_not_steal_an_existing_password_prompt() {
+    let mut doc = pdfcraft_cos::Document::open(Arc::new(fixture(2))).unwrap();
+    doc.set_encryption(&pdfcraft_cos::NewEncryption {
+        algorithm: pdfcraft_cos::Algorithm::Aes256,
+        user_password: "reader",
+        owner_password: "owner",
+        permissions: -4,
+        encrypt_metadata: true,
+        seed: [4; 32],
+    })
+    .unwrap();
+    let bytes = pdfcraft_cos::write_full(&doc, &Default::default()).unwrap();
+    let nonce = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+    let path = std::env::temp_dir().join(format!("pdfcraft-inline-owner-{}-{nonce}.pdf", std::process::id()));
+    assert!(!path.exists(), "the new opening attempt must fail reading");
+    let mut h = Harness::builder().with_size(egui::vec2(1000.0, 700.0)).build_eframe(|_| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.run_inline = true;
+        app.open_bytes("locked.pdf", Some(path.to_string_lossy().into_owned()), bytes).unwrap();
+        app.pick_override = Some(vec![path.to_string_lossy().into_owned()]);
+        app
+    });
+    h.step();
+    let cached = h.state().password_prompt.as_ref().unwrap().bytes.clone();
+    assert!(h.state().password_prompt.as_ref().unwrap().then.is_none());
+    h.state_mut().run_command("export.text");
+    h.step();
+    assert!(h.state().toast.as_ref().is_some_and(|toast| toast.0.starts_with("Couldn't read")));
+    let prompt = h.state().password_prompt.as_ref().unwrap();
+    assert!(Arc::ptr_eq(&prompt.bytes, &cached), "the older encrypted bytes remain available");
+    assert!(prompt.then.is_none(), "a failed attempt must not attach its tool to the older prompt");
+    h.state_mut().submit_password(Some("wrong".into()));
+    assert!(h.state().password_prompt.as_ref().unwrap().then.is_none());
+    h.state_mut().submit_password(Some("reader".into()));
+    assert_eq!(h.state().views.len(), 1, "the older document can still be unlocked");
+    assert!(h.state().password_prompt.is_none());
+    h.run_steps(2);
+    assert!(h.state().dialog.is_none(), "the failed attempt's tool never runs");
+
+    // Accepting the current attempt must still run ordinary/conversion tools and retain
+    // newly created password continuations through retries or discard them on cancellation.
+    for case in ["plain", "converted", "password", "password-cancel"] {
+        let path = path.with_extension(if case == "converted" { "txt" } else { "pdf" });
+        let bytes = match case {
+            "plain" => fixture(2),
+            "converted" => b"Inline text converted to PDF".to_vec(),
+            _ => cached.as_ref().clone(),
+        };
+        std::fs::write(&path, bytes).unwrap();
+        let mut h = Harness::builder().with_size(egui::vec2(1000.0, 700.0)).build_eframe(|_| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.run_inline = true;
+            app.pick_override = Some(vec![path.to_string_lossy().into_owned()]);
+            app
+        });
+        h.step();
+        let defaults = h.state().persist();
+        h.state_mut().run_command("export.text");
+        h.step();
+        if case.starts_with("password") {
+            assert_eq!(h.state().password_prompt.as_ref().unwrap().then, Some("export.text"));
+            h.state_mut().submit_password(Some("wrong".into()));
+            assert_eq!(h.state().password_prompt.as_ref().unwrap().then, Some("export.text"));
+            h.state_mut().submit_password((case == "password").then(|| "reader".into()));
+        }
+        assert_eq!(h.state().views.len(), usize::from(case != "password-cancel"));
+        assert_eq!(matches!(h.state().dialog, Some(crate::Dialog::Export(_))), case != "password-cancel");
+        assert!(h.state().password_prompt.is_none());
+        assert_eq!(h.state().view_defaults.layout, PdfCraftApp::new().view_defaults.layout);
+        assert_eq!(h.state().view_defaults.continuous, PdfCraftApp::new().view_defaults.continuous);
+        // Persistence includes recent files; compare only the saved display defaults.
+        let before: Value = serde_json::from_str(&defaults).unwrap();
+        let after: Value = serde_json::from_str(&h.state().persist()).unwrap();
+        assert_eq!(before["default_layout"], after["default_layout"]);
+        let _ = std::fs::remove_file(path);
+    }
+}
+
+#[test]
+fn tool_open_continuation_follows_its_worker_and_password_retries() {
+    for case in ["plain", "converted", "invalid-image", "password", "password-cancel", "wrong-password-cancel", "read-failure", "invalid-pdf"] {
+        let extension = match case {
+            "converted" => "txt",
+            "invalid-image" => "png",
+            _ => "pdf",
+        };
+        let path = std::env::temp_dir().join(format!("pdfcraft-tool-worker-{}-{case}.{extension}", std::process::id()));
+        let encrypted = case.contains("password");
+        if case != "read-failure" {
+            let bytes = if encrypted {
+                let mut doc = pdfcraft_cos::Document::open(Arc::new(fixture(2))).unwrap();
+                doc.set_encryption(&pdfcraft_cos::NewEncryption {
+                    algorithm: pdfcraft_cos::Algorithm::Aes256,
+                    user_password: "reader",
+                    owner_password: "owner",
+                    permissions: -4,
+                    encrypt_metadata: true,
+                    seed: [4; 32],
+                })
+                .unwrap();
+                pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
+            } else if case == "converted" {
+                b"A text file opened as a PDF".to_vec()
+            } else if case == "invalid-image" {
+                b"\x89PNG\r\n\x1a\n".to_vec()
+            } else if case == "invalid-pdf" {
+                b"not a PDF".to_vec()
+            } else {
+                fixture(2)
+            };
+            std::fs::write(&path, bytes).unwrap();
+        }
+        let mut h = Harness::builder().with_size(egui::vec2(1000.0, 700.0)).build_eframe(|_| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.pick_override = Some(vec![path.to_string_lossy().into_owned()]);
+            app
+        });
+        h.step();
+        let (gate, started, release, finished) = open_worker::prepare_gate();
+        h.state_mut().open_prepare_gate = Some(gate);
+        h.state_mut().run_command("export.text");
+        h.step();
+        started.recv_timeout(Duration::from_secs(5)).unwrap();
+        assert_eq!(h.state().pending_opens.len(), 1);
+        assert_eq!(h.state().pending_opens[0].then, Some("export.text"), "{case}: command belongs to the pending request");
+
+        // A different document becoming active must neither run nor inherit the tool.
+        h.state_mut().open_bytes("unrelated.pdf", None, fixture(1)).unwrap();
+        let unrelated = h.state().views[0].id;
+        h.step();
+        assert!(h.state().dialog.is_none());
+        release.send(()).unwrap();
+        finished.recv_timeout(Duration::from_secs(5)).unwrap();
+        h.step();
+
+        if encrypted {
+            assert_eq!(h.state().password_prompt.as_ref().unwrap().then, Some("export.text"));
+            assert!(h.state().dialog.is_none());
+            if case != "password-cancel" {
+                h.state_mut().submit_password(Some("wrong".into()));
+                started.recv_timeout(Duration::from_secs(5)).unwrap();
+                release.send(()).unwrap();
+                finished.recv_timeout(Duration::from_secs(5)).unwrap();
+                h.step();
+                let prompt = h.state().password_prompt.as_ref().unwrap();
+                assert!(prompt.error.is_some());
+                assert_eq!(prompt.then, Some("export.text"));
+                assert!(h.state().dialog.is_none());
+            }
+            if case == "password" {
+                h.state_mut().submit_password(Some("reader".into()));
+                started.recv_timeout(Duration::from_secs(5)).unwrap();
+                release.send(()).unwrap();
+                finished.recv_timeout(Duration::from_secs(5)).unwrap();
+                h.step();
+            } else {
+                h.state_mut().submit_password(None);
+            }
+        }
+        if matches!(case, "plain" | "converted" | "password") {
+            assert_eq!(h.state().views.len(), 2);
+            let app = h.state();
+            let opened = &app.views[app.active.unwrap()];
+            assert_ne!(opened.id, unrelated);
+            assert_eq!(app.session.get(opened.id).unwrap().path.as_deref(), if case == "converted" { None } else { path.to_str() });
+            assert!(matches!(app.dialog, Some(crate::Dialog::Export(_))));
+            // Closing the dialog and processing more frames must not execute it again.
+            h.state_mut().dialog = None;
+        } else {
+            assert_eq!(h.state().views.len(), 1);
+            assert!(h.state().dialog.is_none());
+        }
+        assert!(h.state().pending_opens.is_empty());
+        assert!(h.state().password_prompt.is_none());
+        h.state_mut().open_bytes("later.pdf", None, fixture(1)).unwrap();
+        h.run_steps(2);
+        assert!(h.state().dialog.is_none(), "{case}: continuation cannot run on another open");
+        let _ = std::fs::remove_file(path);
+    }
+}
+
 #[test]
 fn launch_layout_waits_for_cli_opens_and_preserves_restored_tabs() {
     use crate::canvas::PageLayout;
diff --git a/crates/ui-egui/tests/commands.rs b/crates/ui-egui/tests/commands.rs
index 47bbc21a8f..734f35099b 100644
--- a/crates/ui-egui/tests/commands.rs
+++ b/crates/ui-egui/tests/commands.rs
@@ -44,6 +44,15 @@ fn harness() -> Harness<'static, PdfCraftApp> {
     h
 }
 
+fn wait_for(h: &mut Harness<'static, PdfCraftApp>, description: &str, ready: impl Fn(&PdfCraftApp) -> bool) {
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+    while !ready(h.state()) {
+        assert!(std::time::Instant::now() < deadline, "timed out waiting for {description}");
+        h.step();
+        std::thread::yield_now();
+    }
+}
+
 /// Commands that open a native file picker can't run headless.
 /// (Create ▸ Clipboard reads the system clipboard: tests use `create_from_clip`.)
 const PICKERS: &[&str] = &[
@@ -184,7 +193,7 @@ fn a_tool_chosen_with_no_document_asks_for_one_and_runs_on_it() {
     h.run_steps(2);
     h.state_mut().run_command("export.text");
     assert!(h.state().toast.as_ref().is_none_or(|t| t.0 != "Open a document first"));
-    h.run_steps(3);
+    wait_for(&mut h, "picked document and export dialog", |app| app.active.is_some() && matches!(app.dialog, Some(Dialog::Export(_))));
     assert!(h.state().active.is_some(), "the picked file is open");
     assert!(matches!(h.state().dialog, Some(Dialog::Export(_))), "and the tool runs on it: {:?}", h.state().dialog);
     // Cancelled: nothing opens and nothing runs.
@@ -287,7 +296,11 @@ fn the_open_recent_menu_lists_files_and_opens_one() {
     h.get_by_label("Open Recent ⏵").hover();
     h.run_steps(3);
     h.get_by_label_contains("recent.pdf").click();
-    h.run_steps(4);
+    wait_for(&mut h, "recent document", |app| {
+        app.views.len() == 2
+            && app.active.and_then(|index| app.views.get(index)).and_then(|view| app.session.get(view.id)).and_then(|doc| doc.path.as_deref())
+                == Some(path.as_str())
+    });
     let app = h.state();
     assert_eq!(app.views.len(), 2, "the recent file opened in a new tab");
     let active = app.active.unwrap();

From e2be8db7fbde73c0d10ba896b5dc19561f659bb8 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Wed, 14 Oct 2026 13:33:19 +0200
Subject: [PATCH 007/270] test(ui): stabilize Reduce metadata and isolate
 output directories

---
 crates/ui-egui/tests/create.rs | 35 ++++++++++++++++++++++++++++------
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/crates/ui-egui/tests/create.rs b/crates/ui-egui/tests/create.rs
index bfbba2e131..4537ab1fa6 100644
--- a/crates/ui-egui/tests/create.rs
+++ b/crates/ui-egui/tests/create.rs
@@ -69,12 +69,37 @@ fn opening_images_and_text_converts_them_to_new_pdfs() {
     assert!(app.open_bytes("junk.png", None, b"\x89PNG\r\n\x1a\nnot really".to_vec()).is_err());
 }
 
+// Use a directory claimed exclusively by this run, including after process-ID reuse.
+struct ReduceDir(std::path::PathBuf);
+impl ReduceDir {
+    fn new() -> Self {
+        static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+        for _ in 0..128 {
+            let n = NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+            let path = std::env::temp_dir().join(format!("pdfcraft-reduce-{}-{n}", std::process::id()));
+            match std::fs::create_dir(&path) {
+                Ok(()) => return Self(path),
+                Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => continue,
+                Err(error) => panic!("creating Reduce test directory: {error}"),
+            }
+        }
+        panic!("no unused Reduce test directory after 128 attempts");
+    }
+}
+impl Drop for ReduceDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
 /// Open `name` and run Reduce File Size on it, saving to `out` without a dialog.
 fn reduce(name: &'static str, bytes: Vec<u8>, out: &std::path::Path) -> egui_kittest::Harness<'static, PdfCraftApp> {
     let out2 = out.to_path_buf();
     let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
         app.set_option("language", "en").unwrap();
+        // Keep creation and optimization metadata identical across wall-clock seconds.
+        app.session = std::mem::take(&mut app.session).with_clock(|| 1_700_000_000);
         app.open_bytes(name, None, bytes).unwrap();
         app.save_override = Some(out2.to_string_lossy().into_owned());
         app
@@ -105,9 +130,8 @@ fn reduce_file_size_writes_a_compact_copy() {
         enc.set_depth(png::BitDepth::Eight);
         enc.write_header().unwrap().write_image_data(&px).unwrap();
     }
-    let dir = std::env::temp_dir().join(format!("pdfcraft-reduce-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let out = dir.join("reduced.pdf");
+    let dir = ReduceDir::new();
+    let out = dir.0.join("reduced.pdf");
     let h = reduce("photo.png", photo, &out);
     let bytes = std::fs::read(&out).unwrap();
     assert!(bytes.starts_with(b"%PDF-"));
@@ -119,9 +143,8 @@ fn reduce_file_size_writes_a_compact_copy() {
 #[test]
 fn reduce_file_size_saves_nothing_when_the_file_is_already_small() {
     use egui_kittest::kittest::Queryable;
-    let dir = std::env::temp_dir().join(format!("pdfcraft-reduce-small-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let out = dir.join("reduced.pdf");
+    let dir = ReduceDir::new();
+    let out = dir.0.join("reduced.pdf");
     // A new text PDF is already compact: a copy would be no smaller (#490).
     let h = reduce("notes.txt", "lorem ipsum ".repeat(500).into_bytes(), &out);
     assert!(!out.exists(), "no copy was written");

From 4e952e62e23e0381c68c2b0f616f4698d5f0f646 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Wed, 14 Oct 2026 14:40:22 +0200
Subject: [PATCH 008/270] chore: reserve Pages sidebar select-all fix (#2052)


From 971f6ea2b458a4627aab8b4dcf45ba42f00ef18a Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Wed, 14 Oct 2026 15:14:35 +0200
Subject: [PATCH 009/270] Fix keyboard-owned Pages sidebar select all (#2052)

---
 ROADMAP.md                   |  5 +++-
 crates/ui-egui/src/canvas.rs | 15 ++++++++---
 crates/ui-egui/src/lib.rs    |  8 ++++--
 crates/ui-egui/src/panels.rs | 15 ++++++++---
 crates/ui-egui/tests/view.rs | 52 ++++++++++++++++++++++++++++++++++++
 docs/roadmap.md              |  5 ++--
 parity/acrobat-features.toml |  4 +--
 7 files changed, 89 insertions(+), 15 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index b4ab4ea8a6..593387f85a 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~26% (ready for real work 49% → 75%) and ~400–700 h away
 
-> **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-13 · **Change:** minor (M3 candidate: native opens retain chosen tools through password retries and defer startup intake while preparation is pending; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M4/#2052 candidate: keyboard-owned Pages sidebar select-all; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M13: CLI check visits each directory once through aliases and cycles; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M4: Extract and Split preserve shared Type 3 glyph resources; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M2: packed TIFF-predictor RGB rows retain their byte boundaries; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -149,6 +149,8 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 ## Progress log
 
+- **2026-10-14 (M4/#2052 candidate):** Ctrl/Cmd+A selects all thumbnails while the Pages sidebar owns the keyboard, preserves the current page, and keeps viewer/text-field shortcuts and document selection separate. Escape and existing permission checks are retained. Focus regression and scoped UI validation pass; estimates unchanged.
+
 - **2026-10-13 (M3, native-opening candidate):** Chosen tools survive preparation, conversion and password retries; startup intake waits for pending preparation. Regression tests cover completion, cancellation and document identity. Estimates unchanged.
 - **2026-10-12 (M10, Windows printing without PowerShell, #1107):** craft-print now prints on Windows in-process: printers from EnumPrinters/GetDefaultPrinter, jobs drawn as vectors by Windows.Data.Pdf into the XPS print API with a driver-validated PrintTicket (exact paper, orientation, no scaling), so printing works where App Control for Business or AppLocker run PowerShell in Constrained Language Mode. Portrait and landscape sheets still print as one job (turned with /Rotate); a sheet size the driver lacks is refused rather than shrunk. Pins craft-libs f03ec27 (craft-libs#28); deny.toml allows the storytold/winprint.rs fork and adds a webpki-root-certs licence exception and a RUSTSEC-2024-0370 ignore for winprint's build-dependencies. An earlier craft-print revision was checked in Windows Sandbox under enforced WDAC: printers listed, CLI and desktop jobs spooled, and no powershell.exe in the 4688 audit. The final pinned revision passed craft-libs Windows CI, including a real paused-queue job; that Sandbox run has not been repeated. Estimates unchanged.
 - **2026-10-12 (M13, CLI robustness scans):** `pdfcraft-cli check` visits a directory once even when input roots overlap or directory symlinks lead back into the tree. PDFs reached through file symlinks remain accepted. Three real CLI regressions cover overlapping roots, a directory cycle and directory/file aliases. Estimates unchanged.
@@ -427,6 +429,7 @@ Newest first: the date, what moved, and the new overall estimate.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-14 | minor | M4/#2052 candidate: Pages sidebar select-all, focus ownership, Escape and document isolation validated; estimates unchanged. |
 | 2026-10-12 | minor | M3/#1364 candidate: absolute local GoToR links require desktop consent or headless allow_absolute; existing relative navigation and validation retained. Estimates unchanged. |
 | 2026-10-12 | minor | M8: redaction retires inherited `/Resources` so a parent `/Pages` can't keep a removed XObject reachable; only redacted pages that inherit are pinned (one shared reference), unredacted pages are untouched; estimates unchanged |
 | 2026-10-12 | minor | M7/#1200 candidate: bounded local GoToR opening, root-confined automation, and action-preserving appearance edits; named destinations and window behavior remain partial; estimates unchanged. |
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 9dc2c98dfa..1a7bc20a27 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -433,6 +433,8 @@ pub struct DocView {
     pub org_drag: Option<Vec<usize>>,
     /// Pages panel: the pages being dragged to a new place.
     pub panel_drag: Option<Vec<usize>>,
+    /// Transient keyboard owner for this document's Pages sidebar.
+    pub(crate) pages_focus_id: Option<egui::Id>,
     /// Marquee Zoom / Snapshot: the rectangle being dragged (page, start), and a finished one.
     pub marquee: Option<(usize, Pos2)>,
     pub marquee_done: Option<crate::zoom_snap::Marquee>,
@@ -672,6 +674,7 @@ impl DocView {
             sign: Default::default(),
             org_drag: None,
             panel_drag: None,
+            pages_focus_id: None,
             marquee: None,
             marquee_done: None,
             fill_text: None,
@@ -1137,10 +1140,7 @@ impl DocView {
     /// Select all: every page in Organize, or every word on the current page.
     pub fn select_all(&mut self) -> bool {
         if self.organize {
-            self.selected = (0..self.page_count).collect();
-            // Keep the current page as the anchor for the next Shift-click.
-            self.select_anchor = (self.page_count > 0).then_some(self.current);
-            return !self.selected.is_empty();
+            return self.select_all_pages();
         }
         let page = self.current;
         let Some(t) = self.texts.get(&page) else { return false };
@@ -1151,6 +1151,13 @@ impl DocView {
         true
     }
 
+    /// Select every page without navigating; shared by Organize and the Pages sidebar.
+    pub fn select_all_pages(&mut self) -> bool {
+        self.selected = (0..self.page_count).collect();
+        self.select_anchor = (self.page_count > 0).then_some(self.current);
+        !self.selected.is_empty()
+    }
+
     /// Rotate the view 90° clockwise or counter-clockwise (View ▸ Rotate View, ⇧⌘+ / ⇧⌘−).
     pub fn rotate_view(&mut self, clockwise: bool) {
         self.rotation = (self.rotation + if clockwise { 90 } else { 270 }) % 360;
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index f800ad6a00..cad36ad3e1 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -2650,12 +2650,16 @@ impl PdfCraftApp {
         if let Some(i) = self.active {
             // Select all belongs to the document or page grid, unless a text field or
             // overlay owns the keyboard. Other canvas shortcuts keep their own handling.
+            let pages_owns_keyboard =
+                self.right == Some(RightPanel::Pages) && self.views[i].pages_focus_id.is_some_and(|id| ctx.memory(|m| m.has_focus(id)));
             if self.dialog.is_none()
                 && !self.palette_open
-                && !ctx.egui_wants_keyboard_input()
+                && (pages_owns_keyboard || !ctx.egui_wants_keyboard_input())
                 && ctx.input_mut(|input| input.consume_shortcut(&egui::KeyboardShortcut::new(egui::Modifiers::COMMAND, Key::A)))
             {
-                if self.is_preparing() {
+                if pages_owns_keyboard {
+                    self.views[i].select_all_pages();
+                } else if self.is_preparing() {
                     if let Some(doc) = self.session.get(self.views[i].id) {
                         prepare::select_all(&mut self.views[i], &doc.form);
                     }
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index bdd625804d..01f5b74fac 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -1003,11 +1003,17 @@ fn outline_item(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, item: &OutlineIte
 /// offers Extract, Cut, Copy and Paste on the selection, or on the page clicked; dragging
 /// moves the selection, or the page grabbed, to the gap it is dropped on.
 fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocView, modal: bool, editable: bool, nav: &mut Option<Nav>) {
+    let focus_id = ui.make_persistent_id(("pages-keyboard", view.id));
+    view.pages_focus_id = Some(focus_id);
+    let keyboard = ui.interact(ui.clip_rect(), focus_id, Sense::focusable_noninteractive());
+    let owns_keyboard = keyboard.has_focus();
+    // Escape belongs to this panel while it owns the keyboard, even after pointer movement.
+    ui.memory_mut(|m| m.set_focus_lock_filter(focus_id, egui::EventFilter { escape: true, ..Default::default() }));
     // Escape drops the selection while the pointer is over the panel and nothing else wants the key.
     if !modal
         && !view.selected.is_empty()
-        && !ui.ctx().egui_wants_keyboard_input()
-        && ui.rect_contains_pointer(ui.clip_rect())
+        && (owns_keyboard || !ui.ctx().egui_wants_keyboard_input())
+        && (owns_keyboard || ui.rect_contains_pointer(ui.clip_rect()))
         && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape))
     {
         view.clear_page_selection(Some(view.current));
@@ -1015,8 +1021,8 @@ fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocVie
     // Delete (or Backspace) deletes the selection, or the current page, likewise.
     if !modal
         && editable
-        && !ui.ctx().egui_wants_keyboard_input()
-        && ui.rect_contains_pointer(ui.clip_rect())
+        && (owns_keyboard || !ui.ctx().egui_wants_keyboard_input())
+        && (owns_keyboard || ui.rect_contains_pointer(ui.clip_rect()))
         && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Delete) || i.consume_key(egui::Modifiers::NONE, egui::Key::Backspace))
     {
         delete_pages(view, info.pages.len());
@@ -1068,6 +1074,7 @@ fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocVie
             ui.label(egui::RichText::new(&p.label).font(theme::medium(12.0)).color(if selected || picked { t.accent_text } else { t.text_muted }));
             let resp = theme::hand(resp);
             if resp.clicked() {
+                ui.memory_mut(|m| m.request_focus(focus_id));
                 let m = ui.input(|i| i.modifiers);
                 if m.shift || m.command {
                     view.click_page(i, m, true);
diff --git a/crates/ui-egui/tests/view.rs b/crates/ui-egui/tests/view.rs
index d3744dd2ef..8405e05c80 100644
--- a/crates/ui-egui/tests/view.rs
+++ b/crates/ui-egui/tests/view.rs
@@ -52,6 +52,58 @@ fn rect(h: &Harness<'static, PdfCraftApp>, page: usize) -> Option<egui::Rect> {
     h.state().views[0].page_screen_rect(page)
 }
 
+fn sidebar_key(h: &mut Harness<'static, PdfCraftApp>, key: Key, modifiers: Modifiers) {
+    h.event(egui::Event::ModifiersChanged(modifiers));
+    for pressed in [true, false] {
+        h.event(egui::Event::Key { key, physical_key: None, pressed, repeat: false, modifiers });
+    }
+    h.run_steps(2);
+    h.event(egui::Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(1);
+}
+
+#[test]
+fn pages_sidebar_select_all_keeps_current_page_and_keyboard_scope() {
+    use egui_kittest::kittest::Queryable;
+    let mut h = harness(&[("panel", "pages")]);
+    h.get_by_label("Page 2").click();
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].current, 1);
+    // Moving the pointer is not a keyboard-focus change.
+    h.hover_at(rect(&h, 1).unwrap().center());
+    h.run_steps(1);
+    for _ in 0..2 {
+        sidebar_key(&mut h, Key::A, Modifiers::COMMAND);
+        assert_eq!(h.state().views[0].target_pages(), vec![0, 1, 2]);
+        assert_eq!(h.state().views[0].current, 1, "selecting does not navigate");
+    }
+    sidebar_key(&mut h, Key::Escape, Modifiers::NONE);
+    assert!(h.state().views[0].selected.is_empty());
+
+    // A click on the viewer returns Ctrl+A to text selection, even with Pages open.
+    let pos = rect(&h, 1).unwrap().center();
+    for pressed in [true, false] {
+        h.event(egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+    }
+    h.run_steps(3);
+    sidebar_key(&mut h, Key::A, Modifiers::COMMAND);
+    assert!(h.state().views[0].selected.is_empty(), "viewer shortcut must not select thumbnails");
+
+    // A different document does not inherit the previous sidebar's keyboard ownership.
+    h.get_by_label("Page 2").click();
+    h.run_steps(2);
+    h.state_mut().open_bytes("other.pdf", None, PAGES.to_vec()).unwrap();
+    h.run_steps(5);
+    sidebar_key(&mut h, Key::A, Modifiers::COMMAND);
+    let active = h.state().active.unwrap();
+    assert!(h.state().views[active].selected.is_empty());
+    h.get_by_label("Page 1").click();
+    h.run_steps(2);
+    sidebar_key(&mut h, Key::A, Modifiers::COMMAND);
+    assert_eq!(h.state().views[active].target_pages(), vec![0, 1, 2]);
+    assert!(h.state().views[0].selected.is_empty(), "selection remains document-local");
+}
+
 /// Two pages of different sizes: 300×400 then 600×300.
 const MIXED: &[u8] = b"%PDF-1.7
 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
diff --git a/docs/roadmap.md b/docs/roadmap.md
index fabb5e603d..142466a0bd 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,6 +1,6 @@
 # PdfCraft roadmap: milestones and what's next
 
-> **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-13 · **Change:** minor (M3 candidate: native opens retain chosen tools through password retries and defer startup intake while preparation is pending; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M4/#2052 candidate: keyboard-owned Pages sidebar select-all; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M13: CLI check visits each directory once through aliases and cycles; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M4: Extract and Split preserve shared Type 3 glyph resources; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M2: packed TIFF-predictor RGB rows retain their byte boundaries; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -95,7 +95,7 @@ total matches the parity estimate.
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. A custom text match that ends on a reconstructed separator stops before the next glyph (#1315). Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); Lab Bradford adaptation uses LMS white-point ratios, covered by independent neutral/chromatic and direct/Indexed render oracles; inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). |
-| M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Organize opens directly into the page overview, with checkbox selection, an editable page-range selection (#1092), and per-page rotate/delete controls; Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Extract and Split preserve shared Type 3 glyph resource graphs, retaining conservative pruning limits. Missing: page transitions, recovery on the web |
+| M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Organize opens directly into the page overview, with checkbox selection, an editable page-range selection (#1092), and per-page rotate/delete controls; Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize; #2052 candidate adds keyboard-owned Pages sidebar select-all without navigation, with focus and document-isolation regression coverage, Replace pages, bookmarks from tagged headings. Extract and Split preserve shared Type 3 glyph resource graphs, retaining conservative pruning limits. Missing: page transitions, recovery on the web |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Renderer-creation errors return to the existing OpenGL startup fallback; a real-GPU regression covers errors and device reuse. The underlying x86 DX12 shader compiler failure remains unresolved; see `windows-renderer-startup.md`. With Windows' Animation effects turned off, the wheel scrolls and zooms without easing and egui's animations take no time (`motion.rs`; macOS, Linux and the browser aren't asked yet); Preferences ▸ Animation effects (Use system setting, On, Off) decides it on every platform. |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page |
@@ -162,6 +162,7 @@ M2 (renderer), M7 (content editing), M10 (OCR and Office), M11 (Preflight and st
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-14 | minor | M4/#2052 candidate: Pages sidebar select-all, focus ownership, Escape and document isolation validated; estimates unchanged. |
 | 2026-10-12 | minor | M13: CLI check directory identity, with overlap and symlink regressions; estimates unchanged |
 | 2026-10-12 | minor | M4: shared Type 3 glyph resources survive extraction, with save/reopen and independent raster regressions; estimates unchanged |
 | 2026-10-12 | minor | M2: packed TIFF-predictor RGB row boundaries, with decoding and page-render regressions; estimates unchanged |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 359a71e9a6..c18ae42a21 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1250,8 +1250,8 @@ milestone = "M4"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/editing.rs::dragging_pages_panel_thumbnails_reorders_pages", "crates/ui-egui/tests/viewer.rs::pages_panel_thumbnails_have_a_context_menu", "crates/ui-egui/tests/editing.rs::deleting_pages_from_the_pages_panel_menu", "crates/ui-egui/tests/editing.rs::the_delete_key_deletes_pages_picked_in_the_pages_panel_but_never_every_page"]
-notes = "Drag the selection (or the page grabbed) to reorder, with a drop bar and edge scrolling; right-click offers Extract pages, Cut, Copy, Paste after and Delete pages (also the Delete key over the panel). Not yet: Rotate, Insert and Page labels in the menu, dragging pages between documents, or dropping files onto the panel."
+evidence = ["crates/ui-egui/tests/view.rs::pages_sidebar_select_all_keeps_current_page_and_keyboard_scope", "crates/ui-egui/tests/editing.rs::dragging_pages_panel_thumbnails_reorders_pages", "crates/ui-egui/tests/viewer.rs::pages_panel_thumbnails_have_a_context_menu", "crates/ui-egui/tests/editing.rs::deleting_pages_from_the_pages_panel_menu", "crates/ui-egui/tests/editing.rs::the_delete_key_deletes_pages_picked_in_the_pages_panel_but_never_every_page"]
+notes = "Ctrl/Cmd+A selects every page when the Pages sidebar owns the keyboard, without navigation; Escape clears the selection. Viewer and text-field shortcuts retain their own scope. Drag the selection (or the page grabbed) to reorder, with a drop bar and edge scrolling; right-click offers Extract pages, Cut, Copy, Paste after and Delete pages (also the Delete key over the panel). Not yet: Rotate, Insert and Page labels in the menu, dragging pages between documents, or dropping files onto the panel."
 
 [[feature]]
 id = "view.bookmarks-panel"

From 74eef8cc0f35bf342ac61fd2d5b310e6d5efe156 Mon Sep 17 00:00:00 2001
From: JM <srt8hellcat2@gmail.com>
Date: Wed, 14 Oct 2026 17:04:46 +0000
Subject: [PATCH 010/270] feat(xtask): add offline licensing self-check

---
 .github/workflows/ci.yml                      |   4 +-
 ATTRIBUTION.md                                | 372 +++++++-------
 ATTRIBUTION.toml                              | 372 +++++++-------
 LICENSES.toml                                 | 147 ++++++
 NOTICE                                        |   2 +-
 docs/licensing-self-check.md                  |  33 ++
 licenses/CMap-LICENSE.txt                     |  28 ++
 licenses/egui-Hack-Regular.txt                |  31 ++
 licenses/egui-OFL.txt                         |  92 ++++
 licenses/egui-UFL.txt                         |  96 ++++
 licenses/egui-emoji-icon-font-mit-license.txt |   9 +
 xtask/src/gates.rs                            |   2 +-
 xtask/src/license_check.rs                    | 467 ++++++++++++++++++
 xtask/src/main.rs                             |   4 +-
 14 files changed, 1282 insertions(+), 377 deletions(-)
 create mode 100644 LICENSES.toml
 create mode 100644 docs/licensing-self-check.md
 create mode 100644 licenses/CMap-LICENSE.txt
 create mode 100644 licenses/egui-Hack-Regular.txt
 create mode 100644 licenses/egui-OFL.txt
 create mode 100644 licenses/egui-UFL.txt
 create mode 100644 licenses/egui-emoji-icon-font-mit-license.txt
 create mode 100644 xtask/src/license_check.rs

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8249dcf0c7..20a4a9288e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,9 +87,9 @@ jobs:
         if: runner.os == 'Linux'
         run: cargo xtask layers
 
-      - name: Assets (licences and attribution)
+      - name: Source licences and attribution
         if: runner.os == 'Linux'
-        run: cargo xtask assets
+        run: cargo xtask license-check
 
       - name: CLI without the MCP server still builds
         if: runner.os == 'Linux'
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 3b451f246d..1e3da6e987 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -28,181 +28,181 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/ui-egui/src/i18n/ar.tsv` | Arabic interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Arabic UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/tr.tsv` | Turkish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Turkish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/lt.tsv` | Lithuanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; reviewed by a native Lithuanian-speaking contributor | Lithuanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `assets/icons/accessibility.svg` | Lucide icon "accessibility" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/align-left.svg` | Lucide icon "align-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/align-center.svg` | Lucide icon "align-center" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-center.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/square-terminal.svg` | Lucide icon "square-terminal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-terminal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-code.svg` | Lucide icon "file-code" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-code.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-spreadsheet.svg` | Lucide icon "file-spreadsheet" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-spreadsheet.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/align-justify.svg` | Lucide icon "align-justify" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-justify.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/align-right.svg` | Lucide icon "align-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/columns-3.svg` | Lucide icon "columns-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/rows-3.svg` | Lucide icon "rows-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rows-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/flip-horizontal-2.svg` | Lucide icon "flip-horizontal-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-horizontal-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/flip-vertical-2.svg` | Lucide icon "flip-vertical-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-vertical-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/app-window.svg` | Lucide icon "app-window" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/app-window.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/arrow-left-right.svg` | Lucide icon "arrow-left-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-left-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/arrow-up-down.svg` | Lucide icon "arrow-up-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/arrow-up-right.svg` | Lucide icon "arrow-up-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/badge-check.svg` | Lucide icon "badge-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/badge-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bandage.svg` | Lucide icon "bandage" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bandage.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bell.svg` | Lucide icon "bell" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bell.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/blend.svg` | Lucide icon "blend" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/blend.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bold.svg` | Lucide icon "bold" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bold.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/book-open.svg` | Lucide icon "book-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/book-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bookmark.svg` | Lucide icon "bookmark" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bookmark-plus.svg` | Lucide icon "bookmark-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/braces.svg` | Lucide icon "braces" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/braces.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/brush-cleaning.svg` | Lucide icon "brush-cleaning" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush-cleaning.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/brush.svg` | Lucide icon "brush" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/camera.svg` | Lucide icon "camera" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/camera.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/check-circle-2.svg` | Lucide icon "check-circle-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check-circle-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/check.svg` | Lucide icon "check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevron-down.svg` | Lucide icon "chevron-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevron-left.svg` | Lucide icon "chevron-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevron-right.svg` | Lucide icon "chevron-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevron-up.svg` | Lucide icon "chevron-up" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-up.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevrons-left.svg` | Lucide icon "chevrons-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevrons-right.svg` | Lucide icon "chevrons-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-check.svg` | Lucide icon "circle-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-dashed.svg` | Lucide icon "circle-dashed" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dashed.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-dot.svg` | Lucide icon "circle-dot" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dot.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-help.svg` | Lucide icon "circle-help" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-help.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle.svg` | Lucide icon "circle" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/clock-3.svg` | Lucide icon "clock-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/clock.svg` | Lucide icon "clock" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/cloud-upload.svg` | Lucide icon "cloud-upload" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud-upload.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/cloud.svg` | Lucide icon "cloud" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/code-xml.svg` | Lucide icon "code-xml" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/code-xml.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/columns-2.svg` | Lucide icon "columns-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/compass.svg` | Lucide icon "compass" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/compass.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/contrast.svg` | Lucide icon "contrast" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/contrast.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/copy-plus.svg` | Lucide icon "copy-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/copy.svg` | Lucide icon "copy" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/crop.svg` | Lucide icon "crop" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/crop.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/droplet.svg` | Lucide icon "droplet" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/droplet.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/ellipsis-vertical.svg` | Lucide icon "ellipsis-vertical" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis-vertical.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/ellipsis.svg` | Lucide icon "ellipsis" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/eraser.svg` | Lucide icon "eraser" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eraser.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/external-link.svg` | Lucide icon "external-link" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/external-link.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/eye-off.svg` | Lucide icon "eye-off" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye-off.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/eye.svg` | Lucide icon "eye" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-check.svg` | Lucide icon "file-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-down.svg` | Lucide icon "file-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-input.svg` | Lucide icon "file-input" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-input.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-lock-2.svg` | Lucide icon "file-lock-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-lock-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-minus.svg` | Lucide icon "file-minus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-minus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-output.svg` | Lucide icon "file-output" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-output.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-pen-line.svg` | Lucide icon "file-pen-line" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-pen-line.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-plus-2.svg` | Lucide icon "file-plus-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-plus.svg` | Lucide icon "file-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-scan.svg` | Lucide icon "file-scan" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-scan.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-search.svg` | Lucide icon "file-search" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-search.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-symlink.svg` | Lucide icon "file-symlink" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-symlink.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-text.svg` | Lucide icon "file-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-x.svg` | Lucide icon "file-x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/files.svg` | Lucide icon "files" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/files.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/film.svg` | Lucide icon "film" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/film.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/filter.svg` | Lucide icon "filter" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/filter.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/folder-open.svg` | Lucide icon "folder-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/folder-plus.svg` | Lucide icon "folder-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/folder.svg` | Lucide icon "folder" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/gauge.svg` | Lucide icon "gauge" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/gauge.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/git-compare.svg` | Lucide icon "git-compare" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/git-compare.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/globe.svg` | Lucide icon "globe" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/globe.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/grid-3x3.svg` | Lucide icon "grid-3x3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/grid-3x3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/hand.svg` | Lucide icon "hand" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hand.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/hash.svg` | Lucide icon "hash" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hash.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/heading.svg` | Lucide icon "heading" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/heading.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/highlighter.svg` | Lucide icon "highlighter" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/highlighter.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/house.svg` | Lucide icon "house" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/house.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/image-plus.svg` | Lucide icon "image-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/image.svg` | Lucide icon "image" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/info.svg` | Lucide icon "info" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/info.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/italic.svg` | Lucide icon "italic" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/italic.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/languages.svg` | Lucide icon "languages" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/languages.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/lasso.svg` | Lucide icon "lasso" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lasso.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/layers.svg` | Lucide icon "layers" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layers.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/layout-grid.svg` | Lucide icon "layout-grid" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layout-grid.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/link-2.svg` | Lucide icon "link-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/link.svg` | Lucide icon "link" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/list-checks.svg` | Lucide icon "list-checks" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-checks.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/list-ordered.svg` | Lucide icon "list-ordered" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-ordered.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/list.svg` | Lucide icon "list" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/lock-open.svg` | Lucide icon "lock-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/lock.svg` | Lucide icon "lock" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/maximize-2.svg` | Lucide icon "maximize-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/maximize.svg` | Lucide icon "maximize" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-circle-reply.svg` | Lucide icon "message-circle-reply" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-circle-reply.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-square-text.svg` | Lucide icon "message-square-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-square.svg` | Lucide icon "message-square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/messages-square.svg` | Lucide icon "messages-square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/messages-square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/mic.svg` | Lucide icon "mic" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mic.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/minimize.svg` | Lucide icon "minimize" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/minimize-2.svg` | Lucide icon "minimize-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/minus.svg` | Lucide icon "minus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/moon.svg` | Lucide icon "moon" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/moon.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/mouse-pointer-2.svg` | Lucide icon "mouse-pointer-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mouse-pointer-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/move.svg` | Lucide icon "move" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/navigation.svg` | Lucide icon "navigation" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/navigation.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/paint-bucket.svg` | Lucide icon "paint-bucket" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paint-bucket.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/palette.svg` | Lucide icon "palette" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/palette.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/panel-left.svg` | Lucide icon "panel-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/panel-right.svg` | Lucide icon "panel-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/panels-top-left.svg` | Lucide icon "panels-top-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panels-top-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/paperclip.svg` | Lucide icon "paperclip" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paperclip.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pen-line.svg` | Lucide icon "pen-line" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-line.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pen-tool.svg` | Lucide icon "pen-tool" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-tool.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pencil.svg` | Lucide icon "pencil" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pencil.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pipette.svg` | Lucide icon "pipette" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pipette.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/plus.svg` | Lucide icon "plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/presentation.svg` | Lucide icon "presentation" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/presentation.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/printer.svg` | Lucide icon "printer" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/printer.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/rectangle-horizontal.svg` | Lucide icon "rectangle-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rectangle-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/redo-2.svg` | Lucide icon "redo-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/redo-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/replace.svg` | Lucide icon "replace" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/replace.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/rotate-ccw.svg` | Lucide icon "rotate-ccw" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-ccw.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/rotate-cw.svg` | Lucide icon "rotate-cw" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-cw.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/ruler.svg` | Lucide icon "ruler" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ruler.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/save.svg` | Lucide icon "save" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/save.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/scan-text.svg` | Lucide icon "scan-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/scan.svg` | Lucide icon "scan" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/scissors.svg` | Lucide icon "scissors" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scissors.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/search.svg` | Lucide icon "search" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/search.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/send.svg` | Lucide icon "send" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/send.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/settings-2.svg` | Lucide icon "settings-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/settings.svg` | Lucide icon "settings" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/share-2.svg` | Lucide icon "share-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/share-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/shield-check.svg` | Lucide icon "shield-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/shield-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/signature.svg` | Lucide icon "signature" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/signature.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/sliders-horizontal.svg` | Lucide icon "sliders-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sliders-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/sparkles.svg` | Lucide icon "sparkles" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sparkles.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/spline.svg` | Lucide icon "spline" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/spline.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/square-dashed-mouse-pointer.svg` | Lucide icon "square-dashed-mouse-pointer" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed-mouse-pointer.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/square-dashed.svg` | Lucide icon "square-dashed" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/square.svg` | Lucide icon "square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/squares-subtract.svg` | Lucide icon "squares-subtract" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/squares-subtract.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/stamp.svg` | Lucide icon "stamp" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/stamp.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/star.svg` | Lucide icon "star" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/star.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/sticky-note.svg` | Lucide icon "sticky-note" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sticky-note.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/strikethrough.svg` | Lucide icon "strikethrough" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/strikethrough.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/sun.svg` | Lucide icon "sun" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sun.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/swatch-book.svg` | Lucide icon "swatch-book" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/swatch-book.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/tag.svg` | Lucide icon "tag" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/tag.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/text-cursor-input.svg` | Lucide icon "text-cursor-input" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-cursor-input.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/text-select.svg` | Lucide icon "text-select" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-select.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/trash-2.svg` | Lucide icon "trash-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/trash.svg` | Lucide icon "trash" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/triangle-alert.svg` | Lucide icon "triangle-alert" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/triangle-alert.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/type.svg` | Lucide icon "type" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/type.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/underline.svg` | Lucide icon "underline" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/underline.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/undo-2.svg` | Lucide icon "undo-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/undo-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/user-round.svg` | Lucide icon "user-round" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/user-round.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/wand-sparkles.svg` | Lucide icon "wand-sparkles" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wand-sparkles.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/wrench.svg` | Lucide icon "wrench" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wrench.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/x.svg` | Lucide icon "x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/zoom-in.svg` | Lucide icon "zoom-in" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-in.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/zoom-out.svg` | Lucide icon "zoom-out" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-out.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/accessibility.svg` | Lucide icon "accessibility" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/align-left.svg` | Lucide icon "align-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/align-center.svg` | Lucide icon "align-center" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-center.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/square-terminal.svg` | Lucide icon "square-terminal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-terminal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-code.svg` | Lucide icon "file-code" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-code.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-spreadsheet.svg` | Lucide icon "file-spreadsheet" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-spreadsheet.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/align-justify.svg` | Lucide icon "align-justify" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-justify.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/align-right.svg` | Lucide icon "align-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/columns-3.svg` | Lucide icon "columns-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/rows-3.svg` | Lucide icon "rows-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rows-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/flip-horizontal-2.svg` | Lucide icon "flip-horizontal-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-horizontal-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/flip-vertical-2.svg` | Lucide icon "flip-vertical-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-vertical-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/app-window.svg` | Lucide icon "app-window" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/app-window.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/arrow-left-right.svg` | Lucide icon "arrow-left-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-left-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/arrow-up-down.svg` | Lucide icon "arrow-up-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/arrow-up-right.svg` | Lucide icon "arrow-up-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/badge-check.svg` | Lucide icon "badge-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/badge-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bandage.svg` | Lucide icon "bandage" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bandage.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bell.svg` | Lucide icon "bell" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bell.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/blend.svg` | Lucide icon "blend" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/blend.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bold.svg` | Lucide icon "bold" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bold.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/book-open.svg` | Lucide icon "book-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/book-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bookmark.svg` | Lucide icon "bookmark" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bookmark-plus.svg` | Lucide icon "bookmark-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/braces.svg` | Lucide icon "braces" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/braces.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/brush-cleaning.svg` | Lucide icon "brush-cleaning" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush-cleaning.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/brush.svg` | Lucide icon "brush" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/camera.svg` | Lucide icon "camera" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/camera.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/check-circle-2.svg` | Lucide icon "check-circle-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check-circle-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/check.svg` | Lucide icon "check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevron-down.svg` | Lucide icon "chevron-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevron-left.svg` | Lucide icon "chevron-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevron-right.svg` | Lucide icon "chevron-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevron-up.svg` | Lucide icon "chevron-up" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-up.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevrons-left.svg` | Lucide icon "chevrons-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevrons-right.svg` | Lucide icon "chevrons-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-check.svg` | Lucide icon "circle-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-dashed.svg` | Lucide icon "circle-dashed" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dashed.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-dot.svg` | Lucide icon "circle-dot" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dot.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-help.svg` | Lucide icon "circle-help" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-help.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle.svg` | Lucide icon "circle" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/clock-3.svg` | Lucide icon "clock-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/clock.svg` | Lucide icon "clock" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/cloud-upload.svg` | Lucide icon "cloud-upload" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud-upload.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/cloud.svg` | Lucide icon "cloud" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/code-xml.svg` | Lucide icon "code-xml" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/code-xml.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/columns-2.svg` | Lucide icon "columns-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/compass.svg` | Lucide icon "compass" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/compass.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/contrast.svg` | Lucide icon "contrast" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/contrast.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/copy-plus.svg` | Lucide icon "copy-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/copy.svg` | Lucide icon "copy" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/crop.svg` | Lucide icon "crop" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/crop.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/droplet.svg` | Lucide icon "droplet" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/droplet.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/ellipsis-vertical.svg` | Lucide icon "ellipsis-vertical" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis-vertical.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/ellipsis.svg` | Lucide icon "ellipsis" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/eraser.svg` | Lucide icon "eraser" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eraser.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/external-link.svg` | Lucide icon "external-link" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/external-link.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/eye-off.svg` | Lucide icon "eye-off" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye-off.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/eye.svg` | Lucide icon "eye" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-check.svg` | Lucide icon "file-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-down.svg` | Lucide icon "file-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-input.svg` | Lucide icon "file-input" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-input.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-lock-2.svg` | Lucide icon "file-lock-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-lock-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-minus.svg` | Lucide icon "file-minus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-minus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-output.svg` | Lucide icon "file-output" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-output.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-pen-line.svg` | Lucide icon "file-pen-line" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-pen-line.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-plus-2.svg` | Lucide icon "file-plus-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-plus.svg` | Lucide icon "file-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-scan.svg` | Lucide icon "file-scan" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-scan.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-search.svg` | Lucide icon "file-search" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-search.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-symlink.svg` | Lucide icon "file-symlink" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-symlink.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-text.svg` | Lucide icon "file-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-x.svg` | Lucide icon "file-x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/files.svg` | Lucide icon "files" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/files.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/film.svg` | Lucide icon "film" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/film.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/filter.svg` | Lucide icon "filter" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/filter.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/folder-open.svg` | Lucide icon "folder-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/folder-plus.svg` | Lucide icon "folder-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/folder.svg` | Lucide icon "folder" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/gauge.svg` | Lucide icon "gauge" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/gauge.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/git-compare.svg` | Lucide icon "git-compare" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/git-compare.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/globe.svg` | Lucide icon "globe" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/globe.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/grid-3x3.svg` | Lucide icon "grid-3x3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/grid-3x3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/hand.svg` | Lucide icon "hand" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hand.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/hash.svg` | Lucide icon "hash" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hash.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/heading.svg` | Lucide icon "heading" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/heading.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/highlighter.svg` | Lucide icon "highlighter" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/highlighter.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/house.svg` | Lucide icon "house" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/house.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/image-plus.svg` | Lucide icon "image-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/image.svg` | Lucide icon "image" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/info.svg` | Lucide icon "info" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/info.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/italic.svg` | Lucide icon "italic" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/italic.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/languages.svg` | Lucide icon "languages" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/languages.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/lasso.svg` | Lucide icon "lasso" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lasso.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/layers.svg` | Lucide icon "layers" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layers.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/layout-grid.svg` | Lucide icon "layout-grid" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layout-grid.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/link-2.svg` | Lucide icon "link-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/link.svg` | Lucide icon "link" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/list-checks.svg` | Lucide icon "list-checks" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-checks.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/list-ordered.svg` | Lucide icon "list-ordered" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-ordered.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/list.svg` | Lucide icon "list" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/lock-open.svg` | Lucide icon "lock-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/lock.svg` | Lucide icon "lock" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/maximize-2.svg` | Lucide icon "maximize-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/maximize.svg` | Lucide icon "maximize" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-circle-reply.svg` | Lucide icon "message-circle-reply" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-circle-reply.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-square-text.svg` | Lucide icon "message-square-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-square.svg` | Lucide icon "message-square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/messages-square.svg` | Lucide icon "messages-square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/messages-square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/mic.svg` | Lucide icon "mic" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mic.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/minimize.svg` | Lucide icon "minimize" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/minimize-2.svg` | Lucide icon "minimize-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/minus.svg` | Lucide icon "minus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/moon.svg` | Lucide icon "moon" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/moon.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/mouse-pointer-2.svg` | Lucide icon "mouse-pointer-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mouse-pointer-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/move.svg` | Lucide icon "move" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/navigation.svg` | Lucide icon "navigation" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/navigation.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/paint-bucket.svg` | Lucide icon "paint-bucket" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paint-bucket.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/palette.svg` | Lucide icon "palette" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/palette.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/panel-left.svg` | Lucide icon "panel-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/panel-right.svg` | Lucide icon "panel-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/panels-top-left.svg` | Lucide icon "panels-top-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panels-top-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/paperclip.svg` | Lucide icon "paperclip" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paperclip.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pen-line.svg` | Lucide icon "pen-line" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-line.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pen-tool.svg` | Lucide icon "pen-tool" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-tool.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pencil.svg` | Lucide icon "pencil" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pencil.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pipette.svg` | Lucide icon "pipette" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pipette.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/plus.svg` | Lucide icon "plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/presentation.svg` | Lucide icon "presentation" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/presentation.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/printer.svg` | Lucide icon "printer" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/printer.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/rectangle-horizontal.svg` | Lucide icon "rectangle-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rectangle-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/redo-2.svg` | Lucide icon "redo-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/redo-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/replace.svg` | Lucide icon "replace" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/replace.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/rotate-ccw.svg` | Lucide icon "rotate-ccw" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-ccw.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/rotate-cw.svg` | Lucide icon "rotate-cw" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-cw.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/ruler.svg` | Lucide icon "ruler" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ruler.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/save.svg` | Lucide icon "save" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/save.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/scan-text.svg` | Lucide icon "scan-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/scan.svg` | Lucide icon "scan" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/scissors.svg` | Lucide icon "scissors" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scissors.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/search.svg` | Lucide icon "search" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/search.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/send.svg` | Lucide icon "send" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/send.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/settings-2.svg` | Lucide icon "settings-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/settings.svg` | Lucide icon "settings" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/share-2.svg` | Lucide icon "share-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/share-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/shield-check.svg` | Lucide icon "shield-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/shield-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/signature.svg` | Lucide icon "signature" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/signature.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/sliders-horizontal.svg` | Lucide icon "sliders-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sliders-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/sparkles.svg` | Lucide icon "sparkles" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sparkles.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/spline.svg` | Lucide icon "spline" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/spline.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/square-dashed-mouse-pointer.svg` | Lucide icon "square-dashed-mouse-pointer" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed-mouse-pointer.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/square-dashed.svg` | Lucide icon "square-dashed" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/square.svg` | Lucide icon "square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/squares-subtract.svg` | Lucide icon "squares-subtract" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/squares-subtract.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/stamp.svg` | Lucide icon "stamp" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/stamp.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/star.svg` | Lucide icon "star" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/star.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/sticky-note.svg` | Lucide icon "sticky-note" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sticky-note.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/strikethrough.svg` | Lucide icon "strikethrough" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/strikethrough.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/sun.svg` | Lucide icon "sun" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sun.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/swatch-book.svg` | Lucide icon "swatch-book" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/swatch-book.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/tag.svg` | Lucide icon "tag" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/tag.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/text-cursor-input.svg` | Lucide icon "text-cursor-input" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-cursor-input.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/text-select.svg` | Lucide icon "text-select" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-select.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/trash-2.svg` | Lucide icon "trash-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/trash.svg` | Lucide icon "trash" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/triangle-alert.svg` | Lucide icon "triangle-alert" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/triangle-alert.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/type.svg` | Lucide icon "type" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/type.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/underline.svg` | Lucide icon "underline" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/underline.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/undo-2.svg` | Lucide icon "undo-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/undo-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/user-round.svg` | Lucide icon "user-round" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/user-round.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/wand-sparkles.svg` | Lucide icon "wand-sparkles" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wand-sparkles.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/wrench.svg` | Lucide icon "wrench" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wrench.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/x.svg` | Lucide icon "x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/zoom-in.svg` | Lucide icon "zoom-in" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-in.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/zoom-out.svg` | Lucide icon "zoom-out" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-out.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/fonts/Inter-Regular.ttf` | Inter Regular | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/rsms/inter | UI font, embedded in the app; demo PDF labels; slanted fallback glyphs in Fill & Sign typed signatures for characters Dancing Script lacks (Cyrillic, Greek), drawn as filled paths |
 | `assets/fonts/Inter-Medium.ttf` | Inter Medium | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/rsms/inter | UI font, embedded in the app; demo PDF labels |
 | `assets/fonts/Inter-SemiBold.ttf` | Inter SemiBold | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/rsms/inter | UI font, embedded in the app; demo PDF labels |
@@ -260,23 +260,23 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `docs/images/pdfcraft-tools.png` | PdfCraft screenshot: All tools | PdfCraft contributors (generated by `cargo xtask screenshots`) | MIT OR Apache-2.0 | this repository | README: tool catalogue. Shows PdfCraft UI, Lucide icons, the showcase PDF built from the [[fetched]] OFL fonts, and the ArtCraft mark (Storyteller trademark from docs/brand/, not covered by this licence) |
 | `docs/images/pdfcraft-twoup.png` | PdfCraft screenshot: Two-up reading | PdfCraft contributors (generated by `cargo xtask screenshots`) | MIT OR Apache-2.0 | this repository | README: layouts. Shows only PdfCraft UI, Lucide icons and the showcase PDF built from the [[fetched]] OFL fonts |
 | `docs/images/pdfcraft-viewer.png` | PdfCraft screenshot: Viewer with comments | PdfCraft contributors (generated by `cargo xtask screenshots`) | MIT OR Apache-2.0 | this repository | README hero. Shows only PdfCraft UI, Lucide icons and the showcase PDF built from the [[fetched]] OFL fonts |
-| `assets/icons/pin.svg` | Lucide icon "pin" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pin.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/move-right.svg` | Lucide icon "move-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/reply.svg` | Lucide icon "reply" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/reply.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/thumbs-up.svg` | Lucide icon "thumbs-up" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-up.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/thumbs-down.svg` | Lucide icon "thumbs-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-square-plus.svg` | Lucide icon "message-square-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-x.svg` | Lucide icon "circle-x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pin.svg` | Lucide icon "pin" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pin.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/move-right.svg` | Lucide icon "move-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/reply.svg` | Lucide icon "reply" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/reply.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/thumbs-up.svg` | Lucide icon "thumbs-up" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-up.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/thumbs-down.svg` | Lucide icon "thumbs-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-square-plus.svg` | Lucide icon "message-square-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-x.svg` | Lucide icon "circle-x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `crates/ui-egui/tests/data/form.pdf` | One-page AcroForm test fixture (text, check box, radio group, combo box) | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects, no third-party content | Form-filling UI tests (crates/ui-egui/tests/forms.rs, commands.rs) |
-| `assets/icons/pentagon.svg` | Lucide icon "pentagon" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pentagon.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-square-quote.svg` | Lucide icon "message-square-quote" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-quote.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pentagon.svg` | Lucide icon "pentagon" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pentagon.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-square-quote.svg` | Lucide icon "message-square-quote" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-quote.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `crates/sign/tests/data/openssl-signed.pdf` | One-page PDF signed with OpenSSL CMS (adbe.pkcs7.detached) by the RSA test key | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects; signature made with `openssl cms -sign` over its byte ranges (see crates/sign/tests/data/README.md) | Signature validation tests (crates/sign/tests/pdf.rs): a signature PdfCraft did not make |
-| `assets/icons/clipboard-paste.svg` | Lucide icon "clipboard-paste" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clipboard-paste.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/clipboard-paste.svg` | Lucide icon "clipboard-paste" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clipboard-paste.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/fonts/DancingScript.ttf` | Dancing Script (variable) | The Dancing Script Project Authors (Pablo Impallari) | OFL-1.1 | https://github.com/google/fonts/blob/9710da1eacb3be272583c3224dcb70f9da6eadbb/ofl/dancingscript/DancingScript%5Bwght%5D.ttf | Fill & Sign typed signatures and initials: the typed name's glyph outlines, drawn as filled paths (the font file itself is not embedded in PDFs) |
 | `packaging/macos/dmg/background.svg` | PdfCraft macOS DMG window background | @XusBadia | MIT OR Apache-2.0 | Original work for this repository, derived from the PdfCraft app icon (assets/app-icon/pdfcraft.svg, referenced via an SVG image element, not copied) | Finder window of the macOS DMG; rendered to background.tiff by packaging/macos/dmg/generate.py |
 | `packaging/macos/dmg/background.tiff` | PdfCraft macOS DMG window background (rendered) | @XusBadia | MIT OR Apache-2.0 | Rendered from packaging/macos/dmg/background.svg by packaging/macos/dmg/generate.py | 1x + 2x HiDPI 16-colour palette TIFF copied into the macOS DMG by packaging/macos/package.sh; includes the app icon and the free LittleCMS built-in sRGB profile |
 | `crates/sign/tests/data/x509-rsa-sha1.pdf` | One-page PDF with a legacy adbe.x509.rsa_sha1 signature by the RSA test key | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects; signature made with `openssl dgst -sha1 -sign` over its byte ranges (see crates/sign/tests/data/README.md) | Signature validation tests (crates/sign/tests/pdf.rs): the legacy adbe.x509.rsa_sha1 format |
-| `assets/icons/monitor.svg` | Lucide icon "monitor" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/monitor.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/monitor.svg` | Lucide icon "monitor" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/monitor.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `crates/ui-egui/src/i18n/sl.tsv` | Slovene interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Slovene UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 
 ## Compiled in through dependencies (6)
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 07433fc453..4afb3a7b2e 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -235,7 +235,7 @@ path = "assets/icons/accessibility.svg"
 title = "Lucide icon \"accessibility\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -246,7 +246,7 @@ path = "assets/icons/align-left.svg"
 title = "Lucide icon \"align-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -257,7 +257,7 @@ path = "assets/icons/align-center.svg"
 title = "Lucide icon \"align-center\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-center.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -268,7 +268,7 @@ path = "assets/icons/square-terminal.svg"
 title = "Lucide icon \"square-terminal\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-terminal.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -279,7 +279,7 @@ path = "assets/icons/file-code.svg"
 title = "Lucide icon \"file-code\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-code.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -290,7 +290,7 @@ path = "assets/icons/file-spreadsheet.svg"
 title = "Lucide icon \"file-spreadsheet\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-spreadsheet.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -301,7 +301,7 @@ path = "assets/icons/align-justify.svg"
 title = "Lucide icon \"align-justify\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-justify.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -312,7 +312,7 @@ path = "assets/icons/align-right.svg"
 title = "Lucide icon \"align-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -323,7 +323,7 @@ path = "assets/icons/columns-3.svg"
 title = "Lucide icon \"columns-3\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-3.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -334,7 +334,7 @@ path = "assets/icons/rows-3.svg"
 title = "Lucide icon \"rows-3\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rows-3.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -345,7 +345,7 @@ path = "assets/icons/flip-horizontal-2.svg"
 title = "Lucide icon \"flip-horizontal-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-horizontal-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -356,7 +356,7 @@ path = "assets/icons/flip-vertical-2.svg"
 title = "Lucide icon \"flip-vertical-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-vertical-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -367,7 +367,7 @@ path = "assets/icons/app-window.svg"
 title = "Lucide icon \"app-window\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/app-window.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -378,7 +378,7 @@ path = "assets/icons/arrow-left-right.svg"
 title = "Lucide icon \"arrow-left-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-left-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -389,7 +389,7 @@ path = "assets/icons/arrow-up-down.svg"
 title = "Lucide icon \"arrow-up-down\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-down.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -400,7 +400,7 @@ path = "assets/icons/arrow-up-right.svg"
 title = "Lucide icon \"arrow-up-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -411,7 +411,7 @@ path = "assets/icons/badge-check.svg"
 title = "Lucide icon \"badge-check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/badge-check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -422,7 +422,7 @@ path = "assets/icons/bandage.svg"
 title = "Lucide icon \"bandage\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bandage.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -433,7 +433,7 @@ path = "assets/icons/bell.svg"
 title = "Lucide icon \"bell\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bell.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -444,7 +444,7 @@ path = "assets/icons/blend.svg"
 title = "Lucide icon \"blend\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/blend.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -455,7 +455,7 @@ path = "assets/icons/bold.svg"
 title = "Lucide icon \"bold\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bold.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -466,7 +466,7 @@ path = "assets/icons/book-open.svg"
 title = "Lucide icon \"book-open\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/book-open.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -477,7 +477,7 @@ path = "assets/icons/bookmark.svg"
 title = "Lucide icon \"bookmark\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -488,7 +488,7 @@ path = "assets/icons/bookmark-plus.svg"
 title = "Lucide icon \"bookmark-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -499,7 +499,7 @@ path = "assets/icons/braces.svg"
 title = "Lucide icon \"braces\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/braces.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -510,7 +510,7 @@ path = "assets/icons/brush-cleaning.svg"
 title = "Lucide icon \"brush-cleaning\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush-cleaning.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -521,7 +521,7 @@ path = "assets/icons/brush.svg"
 title = "Lucide icon \"brush\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -532,7 +532,7 @@ path = "assets/icons/camera.svg"
 title = "Lucide icon \"camera\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/camera.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -543,7 +543,7 @@ path = "assets/icons/check-circle-2.svg"
 title = "Lucide icon \"check-circle-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check-circle-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -554,7 +554,7 @@ path = "assets/icons/check.svg"
 title = "Lucide icon \"check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -565,7 +565,7 @@ path = "assets/icons/chevron-down.svg"
 title = "Lucide icon \"chevron-down\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-down.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -576,7 +576,7 @@ path = "assets/icons/chevron-left.svg"
 title = "Lucide icon \"chevron-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -587,7 +587,7 @@ path = "assets/icons/chevron-right.svg"
 title = "Lucide icon \"chevron-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -598,7 +598,7 @@ path = "assets/icons/chevron-up.svg"
 title = "Lucide icon \"chevron-up\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-up.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -609,7 +609,7 @@ path = "assets/icons/chevrons-left.svg"
 title = "Lucide icon \"chevrons-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -620,7 +620,7 @@ path = "assets/icons/chevrons-right.svg"
 title = "Lucide icon \"chevrons-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -631,7 +631,7 @@ path = "assets/icons/circle-check.svg"
 title = "Lucide icon \"circle-check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -642,7 +642,7 @@ path = "assets/icons/circle-dashed.svg"
 title = "Lucide icon \"circle-dashed\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dashed.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -653,7 +653,7 @@ path = "assets/icons/circle-dot.svg"
 title = "Lucide icon \"circle-dot\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dot.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -664,7 +664,7 @@ path = "assets/icons/circle-help.svg"
 title = "Lucide icon \"circle-help\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-help.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -675,7 +675,7 @@ path = "assets/icons/circle.svg"
 title = "Lucide icon \"circle\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -686,7 +686,7 @@ path = "assets/icons/clock-3.svg"
 title = "Lucide icon \"clock-3\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock-3.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -697,7 +697,7 @@ path = "assets/icons/clock.svg"
 title = "Lucide icon \"clock\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -708,7 +708,7 @@ path = "assets/icons/cloud-upload.svg"
 title = "Lucide icon \"cloud-upload\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud-upload.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -719,7 +719,7 @@ path = "assets/icons/cloud.svg"
 title = "Lucide icon \"cloud\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -730,7 +730,7 @@ path = "assets/icons/code-xml.svg"
 title = "Lucide icon \"code-xml\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/code-xml.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -741,7 +741,7 @@ path = "assets/icons/columns-2.svg"
 title = "Lucide icon \"columns-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -752,7 +752,7 @@ path = "assets/icons/compass.svg"
 title = "Lucide icon \"compass\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/compass.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -763,7 +763,7 @@ path = "assets/icons/contrast.svg"
 title = "Lucide icon \"contrast\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/contrast.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -774,7 +774,7 @@ path = "assets/icons/copy-plus.svg"
 title = "Lucide icon \"copy-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -785,7 +785,7 @@ path = "assets/icons/copy.svg"
 title = "Lucide icon \"copy\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -796,7 +796,7 @@ path = "assets/icons/crop.svg"
 title = "Lucide icon \"crop\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/crop.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -807,7 +807,7 @@ path = "assets/icons/droplet.svg"
 title = "Lucide icon \"droplet\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/droplet.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -818,7 +818,7 @@ path = "assets/icons/ellipsis-vertical.svg"
 title = "Lucide icon \"ellipsis-vertical\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis-vertical.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -829,7 +829,7 @@ path = "assets/icons/ellipsis.svg"
 title = "Lucide icon \"ellipsis\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -840,7 +840,7 @@ path = "assets/icons/eraser.svg"
 title = "Lucide icon \"eraser\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eraser.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -851,7 +851,7 @@ path = "assets/icons/external-link.svg"
 title = "Lucide icon \"external-link\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/external-link.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -862,7 +862,7 @@ path = "assets/icons/eye-off.svg"
 title = "Lucide icon \"eye-off\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye-off.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -873,7 +873,7 @@ path = "assets/icons/eye.svg"
 title = "Lucide icon \"eye\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -884,7 +884,7 @@ path = "assets/icons/file-check.svg"
 title = "Lucide icon \"file-check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -895,7 +895,7 @@ path = "assets/icons/file-down.svg"
 title = "Lucide icon \"file-down\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-down.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -906,7 +906,7 @@ path = "assets/icons/file-input.svg"
 title = "Lucide icon \"file-input\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-input.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -917,7 +917,7 @@ path = "assets/icons/file-lock-2.svg"
 title = "Lucide icon \"file-lock-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-lock-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -928,7 +928,7 @@ path = "assets/icons/file-minus.svg"
 title = "Lucide icon \"file-minus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-minus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -939,7 +939,7 @@ path = "assets/icons/file-output.svg"
 title = "Lucide icon \"file-output\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-output.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -950,7 +950,7 @@ path = "assets/icons/file-pen-line.svg"
 title = "Lucide icon \"file-pen-line\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-pen-line.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -961,7 +961,7 @@ path = "assets/icons/file-plus-2.svg"
 title = "Lucide icon \"file-plus-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -972,7 +972,7 @@ path = "assets/icons/file-plus.svg"
 title = "Lucide icon \"file-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -983,7 +983,7 @@ path = "assets/icons/file-scan.svg"
 title = "Lucide icon \"file-scan\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-scan.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -994,7 +994,7 @@ path = "assets/icons/file-search.svg"
 title = "Lucide icon \"file-search\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-search.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1005,7 +1005,7 @@ path = "assets/icons/file-symlink.svg"
 title = "Lucide icon \"file-symlink\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-symlink.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1016,7 +1016,7 @@ path = "assets/icons/file-text.svg"
 title = "Lucide icon \"file-text\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1027,7 +1027,7 @@ path = "assets/icons/file-x.svg"
 title = "Lucide icon \"file-x\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-x.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1038,7 +1038,7 @@ path = "assets/icons/files.svg"
 title = "Lucide icon \"files\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/files.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1049,7 +1049,7 @@ path = "assets/icons/film.svg"
 title = "Lucide icon \"film\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/film.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1060,7 +1060,7 @@ path = "assets/icons/filter.svg"
 title = "Lucide icon \"filter\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/filter.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1071,7 +1071,7 @@ path = "assets/icons/folder-open.svg"
 title = "Lucide icon \"folder-open\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-open.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1082,7 +1082,7 @@ path = "assets/icons/folder-plus.svg"
 title = "Lucide icon \"folder-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1093,7 +1093,7 @@ path = "assets/icons/folder.svg"
 title = "Lucide icon \"folder\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1104,7 +1104,7 @@ path = "assets/icons/gauge.svg"
 title = "Lucide icon \"gauge\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/gauge.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1115,7 +1115,7 @@ path = "assets/icons/git-compare.svg"
 title = "Lucide icon \"git-compare\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/git-compare.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1126,7 +1126,7 @@ path = "assets/icons/globe.svg"
 title = "Lucide icon \"globe\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/globe.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1137,7 +1137,7 @@ path = "assets/icons/grid-3x3.svg"
 title = "Lucide icon \"grid-3x3\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/grid-3x3.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1148,7 +1148,7 @@ path = "assets/icons/hand.svg"
 title = "Lucide icon \"hand\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hand.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1159,7 +1159,7 @@ path = "assets/icons/hash.svg"
 title = "Lucide icon \"hash\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hash.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1170,7 +1170,7 @@ path = "assets/icons/heading.svg"
 title = "Lucide icon \"heading\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/heading.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1181,7 +1181,7 @@ path = "assets/icons/highlighter.svg"
 title = "Lucide icon \"highlighter\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/highlighter.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1192,7 +1192,7 @@ path = "assets/icons/house.svg"
 title = "Lucide icon \"house\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/house.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1203,7 +1203,7 @@ path = "assets/icons/image-plus.svg"
 title = "Lucide icon \"image-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1214,7 +1214,7 @@ path = "assets/icons/image.svg"
 title = "Lucide icon \"image\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1225,7 +1225,7 @@ path = "assets/icons/info.svg"
 title = "Lucide icon \"info\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/info.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1236,7 +1236,7 @@ path = "assets/icons/italic.svg"
 title = "Lucide icon \"italic\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/italic.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1247,7 +1247,7 @@ path = "assets/icons/languages.svg"
 title = "Lucide icon \"languages\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/languages.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1258,7 +1258,7 @@ path = "assets/icons/lasso.svg"
 title = "Lucide icon \"lasso\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lasso.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1269,7 +1269,7 @@ path = "assets/icons/layers.svg"
 title = "Lucide icon \"layers\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layers.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1280,7 +1280,7 @@ path = "assets/icons/layout-grid.svg"
 title = "Lucide icon \"layout-grid\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layout-grid.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1291,7 +1291,7 @@ path = "assets/icons/link-2.svg"
 title = "Lucide icon \"link-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1302,7 +1302,7 @@ path = "assets/icons/link.svg"
 title = "Lucide icon \"link\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1313,7 +1313,7 @@ path = "assets/icons/list-checks.svg"
 title = "Lucide icon \"list-checks\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-checks.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1324,7 +1324,7 @@ path = "assets/icons/list-ordered.svg"
 title = "Lucide icon \"list-ordered\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-ordered.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1335,7 +1335,7 @@ path = "assets/icons/list.svg"
 title = "Lucide icon \"list\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1346,7 +1346,7 @@ path = "assets/icons/lock-open.svg"
 title = "Lucide icon \"lock-open\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock-open.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1357,7 +1357,7 @@ path = "assets/icons/lock.svg"
 title = "Lucide icon \"lock\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1368,7 +1368,7 @@ path = "assets/icons/maximize-2.svg"
 title = "Lucide icon \"maximize-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1379,7 +1379,7 @@ path = "assets/icons/maximize.svg"
 title = "Lucide icon \"maximize\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1390,7 +1390,7 @@ path = "assets/icons/message-circle-reply.svg"
 title = "Lucide icon \"message-circle-reply\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-circle-reply.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1401,7 +1401,7 @@ path = "assets/icons/message-square-text.svg"
 title = "Lucide icon \"message-square-text\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-text.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1412,7 +1412,7 @@ path = "assets/icons/message-square.svg"
 title = "Lucide icon \"message-square\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1423,7 +1423,7 @@ path = "assets/icons/messages-square.svg"
 title = "Lucide icon \"messages-square\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/messages-square.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1434,7 +1434,7 @@ path = "assets/icons/mic.svg"
 title = "Lucide icon \"mic\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mic.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1445,7 +1445,7 @@ path = "assets/icons/minimize.svg"
 title = "Lucide icon \"minimize\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1456,7 +1456,7 @@ path = "assets/icons/minimize-2.svg"
 title = "Lucide icon \"minimize-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1467,7 +1467,7 @@ path = "assets/icons/minus.svg"
 title = "Lucide icon \"minus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1478,7 +1478,7 @@ path = "assets/icons/moon.svg"
 title = "Lucide icon \"moon\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/moon.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1489,7 +1489,7 @@ path = "assets/icons/mouse-pointer-2.svg"
 title = "Lucide icon \"mouse-pointer-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mouse-pointer-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1500,7 +1500,7 @@ path = "assets/icons/move.svg"
 title = "Lucide icon \"move\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1511,7 +1511,7 @@ path = "assets/icons/navigation.svg"
 title = "Lucide icon \"navigation\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/navigation.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1522,7 +1522,7 @@ path = "assets/icons/paint-bucket.svg"
 title = "Lucide icon \"paint-bucket\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paint-bucket.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1533,7 +1533,7 @@ path = "assets/icons/palette.svg"
 title = "Lucide icon \"palette\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/palette.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1544,7 +1544,7 @@ path = "assets/icons/panel-left.svg"
 title = "Lucide icon \"panel-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1555,7 +1555,7 @@ path = "assets/icons/panel-right.svg"
 title = "Lucide icon \"panel-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1566,7 +1566,7 @@ path = "assets/icons/panels-top-left.svg"
 title = "Lucide icon \"panels-top-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panels-top-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1577,7 +1577,7 @@ path = "assets/icons/paperclip.svg"
 title = "Lucide icon \"paperclip\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paperclip.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1588,7 +1588,7 @@ path = "assets/icons/pen-line.svg"
 title = "Lucide icon \"pen-line\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-line.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1599,7 +1599,7 @@ path = "assets/icons/pen-tool.svg"
 title = "Lucide icon \"pen-tool\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-tool.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1610,7 +1610,7 @@ path = "assets/icons/pencil.svg"
 title = "Lucide icon \"pencil\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pencil.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1621,7 +1621,7 @@ path = "assets/icons/pipette.svg"
 title = "Lucide icon \"pipette\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pipette.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1632,7 +1632,7 @@ path = "assets/icons/plus.svg"
 title = "Lucide icon \"plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1643,7 +1643,7 @@ path = "assets/icons/presentation.svg"
 title = "Lucide icon \"presentation\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/presentation.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1654,7 +1654,7 @@ path = "assets/icons/printer.svg"
 title = "Lucide icon \"printer\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/printer.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1665,7 +1665,7 @@ path = "assets/icons/rectangle-horizontal.svg"
 title = "Lucide icon \"rectangle-horizontal\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rectangle-horizontal.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1676,7 +1676,7 @@ path = "assets/icons/redo-2.svg"
 title = "Lucide icon \"redo-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/redo-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1687,7 +1687,7 @@ path = "assets/icons/replace.svg"
 title = "Lucide icon \"replace\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/replace.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1698,7 +1698,7 @@ path = "assets/icons/rotate-ccw.svg"
 title = "Lucide icon \"rotate-ccw\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-ccw.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1709,7 +1709,7 @@ path = "assets/icons/rotate-cw.svg"
 title = "Lucide icon \"rotate-cw\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-cw.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1720,7 +1720,7 @@ path = "assets/icons/ruler.svg"
 title = "Lucide icon \"ruler\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ruler.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1731,7 +1731,7 @@ path = "assets/icons/save.svg"
 title = "Lucide icon \"save\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/save.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1742,7 +1742,7 @@ path = "assets/icons/scan-text.svg"
 title = "Lucide icon \"scan-text\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan-text.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1753,7 +1753,7 @@ path = "assets/icons/scan.svg"
 title = "Lucide icon \"scan\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1764,7 +1764,7 @@ path = "assets/icons/scissors.svg"
 title = "Lucide icon \"scissors\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scissors.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1775,7 +1775,7 @@ path = "assets/icons/search.svg"
 title = "Lucide icon \"search\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/search.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1786,7 +1786,7 @@ path = "assets/icons/send.svg"
 title = "Lucide icon \"send\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/send.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1797,7 +1797,7 @@ path = "assets/icons/settings-2.svg"
 title = "Lucide icon \"settings-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1808,7 +1808,7 @@ path = "assets/icons/settings.svg"
 title = "Lucide icon \"settings\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1819,7 +1819,7 @@ path = "assets/icons/share-2.svg"
 title = "Lucide icon \"share-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/share-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1830,7 +1830,7 @@ path = "assets/icons/shield-check.svg"
 title = "Lucide icon \"shield-check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/shield-check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1841,7 +1841,7 @@ path = "assets/icons/signature.svg"
 title = "Lucide icon \"signature\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/signature.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1852,7 +1852,7 @@ path = "assets/icons/sliders-horizontal.svg"
 title = "Lucide icon \"sliders-horizontal\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sliders-horizontal.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1863,7 +1863,7 @@ path = "assets/icons/sparkles.svg"
 title = "Lucide icon \"sparkles\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sparkles.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1874,7 +1874,7 @@ path = "assets/icons/spline.svg"
 title = "Lucide icon \"spline\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/spline.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1885,7 +1885,7 @@ path = "assets/icons/square-dashed-mouse-pointer.svg"
 title = "Lucide icon \"square-dashed-mouse-pointer\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed-mouse-pointer.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1896,7 +1896,7 @@ path = "assets/icons/square-dashed.svg"
 title = "Lucide icon \"square-dashed\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1907,7 +1907,7 @@ path = "assets/icons/square.svg"
 title = "Lucide icon \"square\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1918,7 +1918,7 @@ path = "assets/icons/squares-subtract.svg"
 title = "Lucide icon \"squares-subtract\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/squares-subtract.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1929,7 +1929,7 @@ path = "assets/icons/stamp.svg"
 title = "Lucide icon \"stamp\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/stamp.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1940,7 +1940,7 @@ path = "assets/icons/star.svg"
 title = "Lucide icon \"star\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/star.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1951,7 +1951,7 @@ path = "assets/icons/sticky-note.svg"
 title = "Lucide icon \"sticky-note\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sticky-note.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1962,7 +1962,7 @@ path = "assets/icons/strikethrough.svg"
 title = "Lucide icon \"strikethrough\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/strikethrough.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1973,7 +1973,7 @@ path = "assets/icons/sun.svg"
 title = "Lucide icon \"sun\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sun.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1984,7 +1984,7 @@ path = "assets/icons/swatch-book.svg"
 title = "Lucide icon \"swatch-book\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/swatch-book.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1995,7 +1995,7 @@ path = "assets/icons/tag.svg"
 title = "Lucide icon \"tag\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/tag.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2006,7 +2006,7 @@ path = "assets/icons/text-cursor-input.svg"
 title = "Lucide icon \"text-cursor-input\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-cursor-input.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2017,7 +2017,7 @@ path = "assets/icons/text-select.svg"
 title = "Lucide icon \"text-select\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-select.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2028,7 +2028,7 @@ path = "assets/icons/trash-2.svg"
 title = "Lucide icon \"trash-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2039,7 +2039,7 @@ path = "assets/icons/trash.svg"
 title = "Lucide icon \"trash\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2050,7 +2050,7 @@ path = "assets/icons/triangle-alert.svg"
 title = "Lucide icon \"triangle-alert\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/triangle-alert.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2061,7 +2061,7 @@ path = "assets/icons/type.svg"
 title = "Lucide icon \"type\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/type.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2072,7 +2072,7 @@ path = "assets/icons/underline.svg"
 title = "Lucide icon \"underline\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/underline.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2083,7 +2083,7 @@ path = "assets/icons/undo-2.svg"
 title = "Lucide icon \"undo-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/undo-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2094,7 +2094,7 @@ path = "assets/icons/user-round.svg"
 title = "Lucide icon \"user-round\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/user-round.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2105,7 +2105,7 @@ path = "assets/icons/wand-sparkles.svg"
 title = "Lucide icon \"wand-sparkles\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wand-sparkles.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2116,7 +2116,7 @@ path = "assets/icons/wrench.svg"
 title = "Lucide icon \"wrench\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wrench.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2127,7 +2127,7 @@ path = "assets/icons/x.svg"
 title = "Lucide icon \"x\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/x.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2138,7 +2138,7 @@ path = "assets/icons/zoom-in.svg"
 title = "Lucide icon \"zoom-in\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-in.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2149,7 +2149,7 @@ path = "assets/icons/zoom-out.svg"
 title = "Lucide icon \"zoom-out\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-out.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3122,7 +3122,7 @@ path = "assets/icons/pin.svg"
 title = "Lucide icon \"pin\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pin.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3133,7 +3133,7 @@ path = "assets/icons/move-right.svg"
 title = "Lucide icon \"move-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3144,7 +3144,7 @@ path = "assets/icons/reply.svg"
 title = "Lucide icon \"reply\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/reply.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3155,7 +3155,7 @@ path = "assets/icons/thumbs-up.svg"
 title = "Lucide icon \"thumbs-up\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-up.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3166,7 +3166,7 @@ path = "assets/icons/thumbs-down.svg"
 title = "Lucide icon \"thumbs-down\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-down.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3177,7 +3177,7 @@ path = "assets/icons/message-square-plus.svg"
 title = "Lucide icon \"message-square-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3188,7 +3188,7 @@ path = "assets/icons/circle-x.svg"
 title = "Lucide icon \"circle-x\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-x.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3210,7 +3210,7 @@ path = "assets/icons/pentagon.svg"
 title = "Lucide icon \"pentagon\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pentagon.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3221,7 +3221,7 @@ path = "assets/icons/message-square-quote.svg"
 title = "Lucide icon \"message-square-quote\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-quote.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3243,7 +3243,7 @@ path = "assets/icons/clipboard-paste.svg"
 title = "Lucide icon \"clipboard-paste\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clipboard-paste.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3336,7 +3336,7 @@ path = "assets/icons/monitor.svg"
 title = "Lucide icon \"monitor\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/monitor.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
diff --git a/LICENSES.toml b/LICENSES.toml
new file mode 100644
index 0000000000..1db65150b3
--- /dev/null
+++ b/LICENSES.toml
@@ -0,0 +1,147 @@
+# Stage 1 source documents only. Destinations are logical names, not packaging instructions.
+# licences lists audited full-text identifiers; omission grants no bundle applicability.
+
+[[document]]
+source = "LICENSE-APACHE"
+licences = ["Apache-2.0"]
+destination = "LICENSE-APACHE"
+sha256 = "0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594"
+
+[[document]]
+source = "LICENSE-MIT"
+licences = ["MIT"]
+destination = "LICENSE-MIT"
+sha256 = "cd7032ea33b71427f188e34ffb4aee9d6868a57fd196037c5c8b2be03a2a0352"
+
+[[document]]
+source = "NOTICE"
+destination = "NOTICE"
+sha256 = "40c86b3b25c603fcc0ef7918c29caf55906e09c1a9f7e853fe0765e5fe24ca5e"
+
+[[document]]
+source = "assets/app-icon/LICENSE-document.txt"
+destination = "assets/app-icon/LICENSE-document.txt"
+sha256 = "64a3137e3d5cc41e5b78d2ad8dd9ddddd6588283f9f7b3128aa6a8a50852fb9a"
+
+[[document]]
+source = "assets/app-icon/LICENSE.txt"
+destination = "assets/app-icon/LICENSE.txt"
+sha256 = "b768acafe6cbad8247eedf86b5b5381feefcd4ee0f8c7808b86811bc687cf37b"
+
+[[document]]
+source = "assets/fonts/OFL-DancingScript.txt"
+destination = "assets/fonts/OFL-DancingScript.txt"
+sha256 = "6f090277c00af96651ce6dbcc38ff1591047a3bffef486e80b6a32e8276a8201"
+
+[[document]]
+source = "assets/fonts/OFL-Inter.txt"
+destination = "assets/fonts/OFL-Inter.txt"
+sha256 = "262481e844521b326f5ecd053e59b98c8b2da78c8ee1bdbb6e8174305e54935a"
+
+[[document]]
+source = "assets/fonts/OFL-JetBrainsMono.txt"
+destination = "assets/fonts/OFL-JetBrainsMono.txt"
+sha256 = "a76abf002c49097d146e86740a3105a5d00450b1592e820a1109a8c5680cd697"
+
+[[document]]
+source = "assets/icons/LICENSE-lucide.txt"
+destination = "assets/icons/LICENSE-lucide.txt"
+sha256 = "b495047bd93a9b06913511076f504daba17d5bbeb3e0650f3bb53a4220329c57"
+
+[[document]]
+source = "docs/brand/LICENSE-brand.txt"
+destination = "docs/brand/LICENSE-brand.txt"
+sha256 = "0f33f48e7a96cd359d4e4e5b11424b13cebeb59cc70c77928186695e4173585c"
+
+[[document]]
+source = "licenses/CMap-LICENSE.txt"
+licences = ["BSD-3-Clause"]
+destination = "licenses/CMap-LICENSE.txt"
+sha256 = "742665db9c8e1bc72603c6d319ca3e90b83bd6d95202f0cd4ef11068a07a9c29"
+origin = "https://static.crates.io/crates/hayro-cmap/hayro-cmap-0.1.0.crate#assets/LICENSE.txt"
+
+[[document]]
+source = "licenses/egui-Hack-Regular.txt"
+licences = ["MIT", "Bitstream-Vera"]
+destination = "licenses/egui-Hack-Regular.txt"
+sha256 = "47c0cccbeec7e8614548cc485588b28149e7874188df5f41b36efebcee285c87"
+origin = "https://raw.githubusercontent.com/emilk/egui/0.36.2/crates/epaint_default_fonts/fonts/Hack-Regular.txt"
+
+[[document]]
+source = "licenses/egui-OFL.txt"
+licences = ["OFL-1.1"]
+destination = "licenses/egui-OFL.txt"
+sha256 = "6a73f9541c2de74158c0e7cf6b0a58ef774f5a780bf191f2d7ec9cc53efe2bf2"
+origin = "https://raw.githubusercontent.com/emilk/egui/0.36.2/crates/epaint_default_fonts/fonts/OFL.txt"
+
+[[document]]
+source = "licenses/egui-UFL.txt"
+licences = ["Ubuntu-font-1.0"]
+destination = "licenses/egui-UFL.txt"
+sha256 = "2f0015108d68627bd788d313f529c21ff4da2c2c42a5e1f3883acc83480f9002"
+origin = "https://raw.githubusercontent.com/emilk/egui/0.36.2/crates/epaint_default_fonts/fonts/UFL.txt"
+
+[[document]]
+source = "licenses/egui-emoji-icon-font-mit-license.txt"
+licences = ["MIT"]
+destination = "licenses/egui-emoji-icon-font-mit-license.txt"
+sha256 = "b9d2c1d909aa149996fd4c91dcb92b2362a04431640c1d200959da94caf8cde1"
+origin = "https://raw.githubusercontent.com/emilk/egui/0.36.2/crates/epaint_default_fonts/fonts/emoji-icon-font-mit-license.txt"
+
+[[document]]
+source = "vendor/hayro-interpret/LICENSE-APACHE"
+licences = ["Apache-2.0"]
+destination = "vendor/hayro-interpret/LICENSE-APACHE"
+sha256 = "0cec06e0e55fbc3dc5cee4fca9b607f66cb8f4e4dbcf3b3c013594dd156732e9"
+
+[[document]]
+source = "vendor/hayro-interpret/LICENSE-MIT"
+licences = ["MIT"]
+destination = "vendor/hayro-interpret/LICENSE-MIT"
+sha256 = "51b50e6120c344dcc146bbd6375ca1c78e079d97c8bea76e67a53d6ff0efebac"
+
+[[document]]
+source = "vendor/hayro-interpret/assets/CGATS_LICENSE.txt"
+destination = "vendor/hayro-interpret/assets/CGATS_LICENSE.txt"
+sha256 = "469d87b5fa48f8aaf69e25f4fcac3a309c97dbb7d561b917638abdb640e004d9"
+
+[[document]]
+source = "vendor/hayro-interpret/assets/LICENSE_FOXIT"
+destination = "vendor/hayro-interpret/assets/LICENSE_FOXIT"
+sha256 = "b578cdd2345840ada550bd12519533812320d5f1d21cf4c1c7e1b1b0a31c98b7"
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/Ubuntu-Light.ttf"
+licence = "Ubuntu-font-1.0"
+documents = ["licenses/egui-UFL.txt"]
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/Hack-Regular.ttf"
+licence = "MIT AND Bitstream-Vera"
+documents = ["licenses/egui-Hack-Regular.txt"]
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/NotoEmoji-Regular.ttf"
+licence = "OFL-1.1"
+documents = ["licenses/egui-OFL.txt"]
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/emoji-icon-font.ttf"
+licence = "MIT"
+documents = ["licenses/egui-emoji-icon-font-mit-license.txt"]
+
+[[bundled]]
+crate = "hayro-cmap"
+path = "assets/cmaps.brotli"
+licence = "BSD-3-Clause"
+documents = ["licenses/CMap-LICENSE.txt"]
+
+[[bundled]]
+crate = "hayro-interpret"
+path = "src/font/generated/metrics.rs"
+licence = "MIT OR Apache-2.0"
+documents = ["vendor/hayro-interpret/LICENSE-MIT", "vendor/hayro-interpret/LICENSE-APACHE"]
diff --git a/NOTICE b/NOTICE
index 8cacb0b585..5e60d33f40 100644
--- a/NOTICE
+++ b/NOTICE
@@ -12,7 +12,7 @@ Third-party material
 This product bundles third-party material under its own licenses, listed below. The per-file
 list (author, source, license) is in ATTRIBUTION.md.
 
-- Lucide icons (assets/icons/*.svg) — ISC License. See assets/icons/LICENSE-lucide.txt.
+- Lucide icons (assets/icons/*.svg) — ISC and MIT licences (Feather-derived icons). See assets/icons/LICENSE-lucide.txt.
   The Windows PDF file icon (assets/app-icon/pdfcraft-document.svg and .ico) adapts Lucide's
   file-text outline and combines it with contributor-original artwork. See
   assets/app-icon/LICENSE-document.txt (ISC AND (MIT OR Apache-2.0)), packaged as
diff --git a/docs/licensing-self-check.md b/docs/licensing-self-check.md
new file mode 100644
index 0000000000..305d756ff7
--- /dev/null
+++ b/docs/licensing-self-check.md
@@ -0,0 +1,33 @@
+# Source licensing self-check
+
+Run `cargo xtask license-check` to validate the checked-out source, offline. The command
+does not download assets, fetch models, inspect installers, or generate dependency notices.
+It reuses `cargo xtask assets` for attribution, asset policy and locked dependency versions,
+then checks the documents recorded in `LICENSES.toml`.
+
+Each document has a repository-relative source, a unique portable logical destination and
+the SHA-256 of its audited text. Destinations are validation metadata, not instructions to
+copy files into packages. Required project documents and every asset's `licence_file` must
+be mapped. Every dependency-bundled asset must have a document mapping matching its existing
+`ATTRIBUTION.toml` licence expression. Foxit has an explicit required document. Licence
+texts for egui's default fonts and CMaps are retained in `licenses/`, with their pinned
+upstream origins recorded in the manifest. Existing font and asset texts stay in place.
+
+Missing files, empty or invalid text, changed hashes, duplicate mappings, case-insensitive
+destination collisions, parent-file conflicts and unsafe paths fail the check. Source
+symlinks must resolve inside the checkout. OCR models need complete attribution and valid
+hashes and destination names; the model binaries and downloaded licence texts need not be
+present. The optional craft-fonts checkout remains governed by its own attribution and
+the existing asset validator; this command does not audit that external checkout.
+
+When changing attribution, edit `ATTRIBUTION.toml`, run `cargo xtask assets --write`. Generated attribution consistency remains checked only
+by the existing asset validator. When changing licence or notice text, re-audit
+its provenance before updating the corresponding hash. Do not replace a licence with
+guessed terms or update a hash merely to silence a failure. `LICENSES.toml` is validated
+with unknown fields rejected.
+
+The existing Linux source-validation step in `.github/workflows/ci.yml` and `cargo xtask ci`
+run `license-check` in place of `assets`; the asset validator runs once within that command.
+This Stage 1 check establishes source-document consistency, not completed-package
+compliance or legal sufficiency. Installer inspection, dependency-notice generation and
+font-delivery packaging changes remain separate work.
diff --git a/licenses/CMap-LICENSE.txt b/licenses/CMap-LICENSE.txt
new file mode 100644
index 0000000000..2552cc990c
--- /dev/null
+++ b/licenses/CMap-LICENSE.txt
@@ -0,0 +1,28 @@
+Copyright 1990-2023 Adobe. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+Redistributions of source code must retain the above copyright notice,
+this list of conditions and the following disclaimer.
+
+Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+Neither the name of Adobe nor the names of its contributors may be
+used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/licenses/egui-Hack-Regular.txt b/licenses/egui-Hack-Regular.txt
new file mode 100644
index 0000000000..b0ec74488a
--- /dev/null
+++ b/licenses/egui-Hack-Regular.txt
@@ -0,0 +1,31 @@
+The work in the Hack project is Copyright 2018 Source Foundry Authors and licensed under the MIT License
+
+The work in the DejaVu project was committed to the public domain.
+
+Bitstream Vera Sans Mono Copyright 2003 Bitstream Inc. and licensed under the Bitstream Vera License with Reserved Font Names "Bitstream" and "Vera"
+MIT License
+
+Copyright (c) 2018 Source Foundry Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+BITSTREAM VERA LICENSE
+
+Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved. Bitstream Vera is a trademark of Bitstream, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of the fonts accompanying this license ("Fonts") and associated documentation files (the "Font Software"), to reproduce and distribute the Font Software, including without limitation the rights to use, copy, merge, publish, distribute, and/or sell copies of the Font Software, and to permit persons to whom the Font Software is furnished to do so, subject to the following conditions:
+
+The above copyright and trademark notices and this permission notice shall be included in all copies of one or more of the Font Software typefaces.
+
+The Font Software may be modified, altered, or added to, and in particular the designs of glyphs or characters in the Fonts may be modified and additional glyphs or characters may be added to the Fonts, only if the fonts are renamed to names not containing either the words "Bitstream" or the word "Vera".
+
+This License becomes null and void to the extent applicable to Fonts or Font Software that has been modified and is distributed under the "Bitstream Vera" names.
+
+The Font Software may be sold as part of a larger software package but no copy of one or more of the Font Software typefaces may be sold by itself.
+
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL BITSTREAM OR THE GNOME FOUNDATION BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER DEALINGS IN THE FONT SOFTWARE.
+
+Except as contained in this notice, the names of Gnome, the Gnome Foundation, and Bitstream Inc., shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Font Software without prior written authorization from the Gnome Foundation or Bitstream Inc., respectively. For further information, contact: fonts at gnome dot org.
diff --git a/licenses/egui-OFL.txt b/licenses/egui-OFL.txt
new file mode 100644
index 0000000000..d952d62c06
--- /dev/null
+++ b/licenses/egui-OFL.txt
@@ -0,0 +1,92 @@
+This Font Software is licensed under the SIL Open Font License,
+Version 1.1.
+
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font
+creation efforts of academic and linguistic communities, and to
+provide a free and open framework in which fonts may be shared and
+improved in partnership with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply to
+any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software
+components as distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to,
+deleting, or substituting -- in part or in whole -- any of the
+components of the Original Version, by changing formats or by porting
+the Font Software to a new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed,
+modify, redistribute, and sell modified and unmodified copies of the
+Font Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components, in
+Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the
+corresponding Copyright Holder. This restriction only applies to the
+primary font name as presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created using
+the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/licenses/egui-UFL.txt b/licenses/egui-UFL.txt
new file mode 100644
index 0000000000..ae78a8f94e
--- /dev/null
+++ b/licenses/egui-UFL.txt
@@ -0,0 +1,96 @@
+-------------------------------
+UBUNTU FONT LICENCE Version 1.0
+-------------------------------
+
+PREAMBLE
+This licence allows the licensed fonts to be used, studied, modified and
+redistributed freely. The fonts, including any derivative works, can be
+bundled, embedded, and redistributed provided the terms of this licence
+are met. The fonts and derivatives, however, cannot be released under
+any other licence. The requirement for fonts to remain under this
+licence does not require any document created using the fonts or their
+derivatives to be published under this licence, as long as the primary
+purpose of the document is not to be a vehicle for the distribution of
+the fonts.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this licence and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Original Version" refers to the collection of Font Software components
+as received under this licence.
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to
+a new environment.
+
+"Copyright Holder(s)" refers to all individuals and companies who have a
+copyright ownership of the Font Software.
+
+"Substantially Changed" refers to Modified Versions which can be easily
+identified as dissimilar to the Font Software by users of the Font
+Software comparing the Original Version with the Modified Version.
+
+To "Propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification and with or without charging
+a redistribution fee), making available to the public, and in some
+countries other activities as well.
+
+PERMISSION & CONDITIONS
+This licence does not grant any rights under trademark law and all such
+rights are reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of the Font Software, to propagate the Font Software, subject to
+the below conditions:
+
+1) Each copy of the Font Software must contain the above copyright
+notice and this licence. These can be included either as stand-alone
+text files, human-readable headers or in the appropriate machine-
+readable metadata fields within text or binary files as long as those
+fields can be easily viewed by the user.
+
+2) The font name complies with the following:
+(a) The Original Version must retain its name, unmodified.
+(b) Modified Versions which are Substantially Changed must be renamed to
+avoid use of the name of the Original Version or similar names entirely.
+(c) Modified Versions which are not Substantially Changed must be
+renamed to both (i) retain the name of the Original Version and (ii) add
+additional naming elements to distinguish the Modified Version from the
+Original Version. The name of such Modified Versions must be the name of
+the Original Version, with "derivative X" where X represents the name of
+the new work, appended to that name.
+
+3) The name(s) of the Copyright Holder(s) and any contributor to the
+Font Software shall not be used to promote, endorse or advertise any
+Modified Version, except (i) as required by this licence, (ii) to
+acknowledge the contribution(s) of the Copyright Holder(s) or (iii) with
+their explicit written permission.
+
+4) The Font Software, modified or unmodified, in part or in whole, must
+be distributed entirely under this licence, and must not be distributed
+under any other licence. The requirement for fonts to remain under this
+licence does not affect any document created using the Font Software,
+except any version of the Font Software extracted from a document
+created using the Font Software may only be distributed under this
+licence.
+
+TERMINATION
+This licence becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
+COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER
+DEALINGS IN THE FONT SOFTWARE.
diff --git a/licenses/egui-emoji-icon-font-mit-license.txt b/licenses/egui-emoji-icon-font-mit-license.txt
new file mode 100644
index 0000000000..99016e120b
--- /dev/null
+++ b/licenses/egui-emoji-icon-font-mit-license.txt
@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2014 John Slegers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/xtask/src/gates.rs b/xtask/src/gates.rs
index 4406a957c4..0d4ab7db3f 100644
--- a/xtask/src/gates.rs
+++ b/xtask/src/gates.rs
@@ -102,7 +102,7 @@ pub fn ci(_: &[String]) -> anyhow::Result<()> {
         ("test", Box::new(|| run_args(&["test", "--workspace"]))),
         ("layers", Box::new(|| layers(&[]))),
         ("wasm", Box::new(|| wasm(&[]))),
-        ("assets", Box::new(|| crate::assets::run(&[]))),
+        ("license-check", Box::new(|| crate::license_check::run(&[]))),
         ("deny", Box::new(|| deny(&[]))),
         ("parity", Box::new(|| crate::parity::run(&[]))),
     ];
diff --git a/xtask/src/license_check.rs b/xtask/src/license_check.rs
new file mode 100644
index 0000000000..6b8b8c57fb
--- /dev/null
+++ b/xtask/src/license_check.rs
@@ -0,0 +1,467 @@
+//! Offline source-document checks. This does not inspect completed packages or dependencies.
+use std::collections::BTreeSet;
+use std::path::Path;
+
+use anyhow::{Context, Result, bail};
+use serde::Deserialize;
+
+use crate::assets;
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Documents {
+    document: Vec<Document>,
+    bundled: Vec<Bundled>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Document {
+    source: String,
+    destination: String,
+    sha256: String,
+    /// Audited identifiers of the full licence texts in this document, not inferred from its contents.
+    #[serde(default)]
+    licences: Vec<String>,
+    #[serde(default)]
+    origin: Option<String>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Bundled {
+    #[serde(rename = "crate")]
+    krate: String,
+    path: String,
+    licence: String,
+    documents: Vec<String>,
+}
+
+pub fn run(args: &[String]) -> Result<()> {
+    if !args.is_empty() {
+        bail!("usage: cargo xtask license-check (no downloads or write mode)");
+    }
+    let root = assets::root();
+    // Reuse the existing policy and generated-attribution validator, once.
+    assets::run(&[])?;
+    validate(&root)?;
+    println!("license-check: source documents and licensing metadata are consistent");
+    Ok(())
+}
+
+fn validate(root: &Path) -> Result<()> {
+    let text = std::fs::read_to_string(root.join("LICENSES.toml")).context("reading LICENSES.toml")?;
+    let docs: Documents = toml::from_str(&text).context("parsing LICENSES.toml")?;
+    let attribution = assets::load(root)?;
+    let mut problems = check(root, &docs, &attribution);
+    let ocr_source = std::fs::read_to_string(root.join("crates/ocr/src/lib.rs")).context("reading OCR model filename constants")?;
+    problems.extend(check_required_ocr_metadata(&ocr_source, &attribution)?);
+    if !problems.is_empty() {
+        bail!("source licensing errors:\n{}", problems.join("\n"));
+    }
+    Ok(())
+}
+
+/// Read only the two filename constants consumed by the OCR application. Fail closed if their
+/// declaration format changes; do not guess filenames or add a dependency on the OCR engine.
+fn check_required_ocr_metadata(source: &str, attribution: &assets::Manifest) -> Result<Vec<String>> {
+    let mut problems = Vec::new();
+    for name in ["DETECTION_MODEL", "RECOGNITION_MODEL"] {
+        let prefix = format!("pub const {name}: &str = \"");
+        let declarations: Vec<_> = source.lines().map(str::trim).filter_map(|line| line.strip_prefix(&prefix)).collect();
+        let file = declarations.first().and_then(|value| value.strip_suffix("\";"));
+        let Some(file) = file.filter(|file| declarations.len() == 1 && safe_path(file) && !file.contains('/')) else {
+            bail!(
+                "OCR constant {name}: expected one literal filename declaration in crates/ocr/src/lib.rs; update the source validator if its syntax changed"
+            );
+        };
+        let entries: Vec<_> = attribution.fetched.iter().filter(|f| f.file == file).collect();
+        if entries.is_empty() {
+            problems.push(format!("{file}: required OCR licensing metadata missing from ATTRIBUTION.toml"));
+        } else {
+            if entries.len() != 1 {
+                problems.push(format!("{file}: required OCR licensing metadata must have exactly one entry"));
+            }
+            if entries.iter().any(|f| f.kind != "model") {
+                problems.push(format!("{file}: required OCR licensing metadata must have kind = \"model\""));
+            }
+        }
+    }
+    Ok(problems)
+}
+
+/// The audited bundle inventory currently uses identifiers and flat AND/OR expressions only.
+/// Keep their semantics distinct, and fail closed on mixed operators, grouping or exceptions
+/// rather than introducing a general SPDX parser or flattening an unsupported expression.
+fn licence_coverage(expression: &str, covered: &BTreeSet<&str>) -> Result<bool> {
+    let mut tokens = expression.split_whitespace();
+    let Some(first) = tokens.next().filter(|id| assets::ALLOWED_LICENCES.contains(id)) else {
+        bail!("unsupported bundle licence expression `{expression}`");
+    };
+    let mut ids = vec![first];
+    let mut operator = None;
+    while let Some(op) = tokens.next() {
+        if !matches!(op, "AND" | "OR") || operator.is_some_and(|previous| previous != op) {
+            bail!("unsupported bundle licence expression `{expression}`; audit its applicability before extending the validator");
+        }
+        operator = Some(op);
+        let Some(id) = tokens.next().filter(|id| assets::ALLOWED_LICENCES.contains(id)) else {
+            bail!("unsupported bundle licence expression `{expression}`");
+        };
+        ids.push(id);
+    }
+    Ok(if operator == Some("OR") { ids.iter().any(|id| covered.contains(id)) } else { ids.iter().all(|id| covered.contains(id)) })
+}
+
+// A portable relative path, including on Windows; reject aliases before comparing mappings.
+fn safe_path(s: &str) -> bool {
+    !s.is_empty()
+        && !s.contains(['\\', ':'])
+        && s.split('/').all(|p| {
+            !p.is_empty()
+                && p != "."
+                && p != ".."
+                && !p.ends_with(['.', ' '])
+                && p.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.'))
+                && !matches!(
+                    p.split('.').next().unwrap_or_default().to_ascii_uppercase().as_str(),
+                    "CON"
+                        | "PRN"
+                        | "AUX"
+                        | "NUL"
+                        | "COM1"
+                        | "COM2"
+                        | "COM3"
+                        | "COM4"
+                        | "COM5"
+                        | "COM6"
+                        | "COM7"
+                        | "COM8"
+                        | "COM9"
+                        | "LPT1"
+                        | "LPT2"
+                        | "LPT3"
+                        | "LPT4"
+                        | "LPT5"
+                        | "LPT6"
+                        | "LPT7"
+                        | "LPT8"
+                        | "LPT9"
+                )
+        })
+}
+
+fn hash(s: &str) -> bool {
+    s.len() == 64 && s.bytes().all(|b| b.is_ascii_hexdigit())
+}
+
+fn check(root: &Path, docs: &Documents, attribution: &assets::Manifest) -> Vec<String> {
+    let mut problems = Vec::new();
+    let mut sources = BTreeSet::new();
+    let mut destinations = BTreeSet::new();
+    for d in &docs.document {
+        if !safe_path(&d.source) || !safe_path(&d.destination) {
+            problems.push(format!("{}: unsafe document source or destination", d.source));
+            continue;
+        }
+        let new_source = sources.insert(d.source.as_str());
+        let new_destination = destinations.insert(d.destination.to_ascii_lowercase());
+        if !new_source || !new_destination {
+            problems.push(format!("{}: duplicate document source or destination", d.source));
+        }
+        if d.origin.as_ref().is_some_and(|u| !u.starts_with("https://") || u.trim().len() <= 8) {
+            problems.push(format!("{}: invalid document origin", d.source));
+        }
+        let mut identifiers = BTreeSet::new();
+        for id in &d.licences {
+            if !assets::ALLOWED_LICENCES.contains(&id.as_str()) || !identifiers.insert(id.as_str()) {
+                problems.push(format!("{}: invalid or duplicate audited licence identifier `{id}`", d.source));
+            }
+        }
+        let path = root.join(&d.source);
+        // Canonical confinement also catches symlinks escaping the checkout.
+        let confined = root.canonicalize().and_then(|r| path.canonicalize().map(|p| p.starts_with(r))).unwrap_or(false);
+        if !confined || !path.is_file() {
+            problems.push(format!("{}: required document missing or outside checkout", d.source));
+            continue;
+        }
+        match std::fs::read_to_string(&path) {
+            Ok(text) if !text.trim().is_empty() && !text.contains('\0') => {
+                if !hash(&d.sha256) || assets::sha256_hex(text.as_bytes()) != d.sha256 {
+                    problems.push(format!("{}: document hash mismatch; re-audit the source before updating LICENSES.toml", d.source));
+                }
+            }
+            _ => problems.push(format!("{}: required document empty or invalid UTF-8 text", d.source)),
+        }
+    }
+    for destination in &destinations {
+        for (i, _) in destination.match_indices('/') {
+            if destination.get(..i).is_some_and(|prefix| destinations.contains(prefix)) {
+                problems.push(format!("{destination}: document destination conflicts with a parent file"));
+            }
+        }
+    }
+    for required in ["LICENSE-MIT", "LICENSE-APACHE", "NOTICE", "vendor/hayro-interpret/assets/LICENSE_FOXIT"]
+        .into_iter()
+        .chain(attribution.asset.iter().map(|a| a.licence_file.as_str()))
+    {
+        if !sources.contains(required) {
+            problems.push(format!("{required}: required document has no LICENSES.toml mapping"));
+        }
+    }
+    // One mapping per bundled asset, using the existing attribution's licence expression.
+    let mut seen = BTreeSet::new();
+    for b in &docs.bundled {
+        if !seen.insert((b.krate.as_str(), b.path.as_str())) {
+            problems.push(format!("{} {}: duplicate bundled mapping", b.krate, b.path));
+        }
+        if !attribution.bundled.iter().any(|a| a.krate == b.krate && a.path == b.path && a.licence == b.licence) {
+            problems.push(format!("{} {}: bundled mapping disagrees with ATTRIBUTION.toml", b.krate, b.path));
+        }
+        if b.documents.is_empty() || b.documents.iter().any(|d| !sources.contains(d.as_str())) {
+            problems.push(format!("{} {}: bundled licence documents missing", b.krate, b.path));
+        }
+        for document in docs.document.iter().filter(|d| b.documents.contains(&d.source)) {
+            if !document.licences.iter().any(|id| b.licence.split_whitespace().any(|token| token == id)) {
+                problems.push(format!("{} {}: inapplicable mapped document {}", b.krate, b.path, document.source));
+            }
+        }
+        let covered: BTreeSet<_> =
+            docs.document.iter().filter(|d| b.documents.contains(&d.source)).flat_map(|d| d.licences.iter().map(String::as_str)).collect();
+        match licence_coverage(&b.licence, &covered) {
+            Ok(true) => {}
+            Ok(false) => problems
+                .push(format!("{} {}: inapplicable licence documents; mapped audited identifiers do not cover `{}`", b.krate, b.path, b.licence)),
+            Err(error) => problems.push(format!("{} {}: {error}", b.krate, b.path)),
+        }
+    }
+    for b in &attribution.bundled {
+        if !seen.contains(&(b.krate.as_str(), b.path.as_str())) {
+            problems.push(format!("{} {}: bundled asset has no licence document mapping", b.krate, b.path));
+        }
+    }
+    for a in attribution.asset.iter().filter(|a| a.licence_file == "assets/icons/LICENSE-lucide.txt") {
+        if a.licence != "ISC AND MIT" {
+            problems.push(format!("{}: Lucide collection must credit ISC and Feather MIT", a.path));
+        }
+    }
+    let mut model_paths = BTreeSet::new();
+    for f in attribution.fetched.iter().filter(|f| f.kind == "model") {
+        if [f.title.as_str(), &f.author, &f.source, &f.usage, &f.licence].iter().any(|v| v.trim().is_empty())
+            || !hash(&f.sha256)
+            || !hash(&f.licence_sha256)
+            || !f.url.starts_with("https://")
+            || !f.licence_url.starts_with("https://")
+        {
+            problems.push(format!("{}: incomplete OCR model licensing metadata", f.file));
+        }
+        for path in [f.file.clone(), format!("{}.LICENCE.txt", f.file)] {
+            if !safe_path(&path)
+                || path.contains('/')
+                || path.eq_ignore_ascii_case("ATTRIBUTION.txt")
+                || !model_paths.insert(path.to_ascii_lowercase())
+            {
+                problems.push(format!("{}: duplicate or unsafe OCR model destination", f.file));
+            }
+        }
+    }
+    problems
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    fn fixture() -> (std::path::PathBuf, Documents) {
+        static NEXT: AtomicU64 = AtomicU64::new(0);
+        let root = std::env::temp_dir().join(format!("pdfcraft-license-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&root).unwrap();
+        let document = ["LICENSE-MIT", "LICENSE-APACHE", "NOTICE", "vendor/hayro-interpret/assets/LICENSE_FOXIT"]
+            .into_iter()
+            .map(|p| {
+                let path = root.join(p);
+                std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+                std::fs::write(path, "synthetic licence text\n").unwrap();
+                Document {
+                    source: p.into(),
+                    destination: p.into(),
+                    sha256: assets::sha256_hex(b"synthetic licence text\n"),
+                    licences: match p {
+                        "LICENSE-MIT" => vec!["MIT".into()],
+                        "LICENSE-APACHE" => vec!["Apache-2.0".into()],
+                        _ => vec![],
+                    },
+                    origin: None,
+                }
+            })
+            .collect();
+        (root, Documents { document, bundled: vec![] })
+    }
+
+    #[test]
+    fn missing_license_fails_and_restoring_recovers() {
+        let (root, docs) = fixture();
+        let m = assets::Manifest::default();
+        assert!(check(&root, &docs, &m).is_empty());
+        std::fs::remove_file(root.join("LICENSE-MIT")).unwrap();
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("LICENSE-MIT: required document missing")));
+        std::fs::write(root.join("LICENSE-MIT"), "synthetic licence text\n").unwrap();
+        assert!(check(&root, &docs, &m).is_empty());
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn empty_invalid_and_changed_documents_fail() {
+        let (root, docs) = fixture();
+        for text in [b" ".as_slice(), b"\xff", b"changed licence", b"text\0"] {
+            std::fs::write(root.join("NOTICE"), text).unwrap();
+            assert!(!check(&root, &docs, &assets::Manifest::default()).is_empty());
+        }
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn duplicate_and_unsafe_destinations_fail() {
+        let (root, mut docs) = fixture();
+        for dest in ["license-mit", "../NOTICE", "/NOTICE", "C:/NOTICE", "a\\NOTICE", "a//NOTICE", "CON.txt", "NOTICE."] {
+            docs.document.get_mut(2).unwrap().destination = dest.into();
+            assert!(!check(&root, &docs, &assets::Manifest::default()).is_empty(), "{dest}");
+        }
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn removing_required_mapping_fails() {
+        let (root, mut docs) = fixture();
+        docs.document.retain(|d| d.source != "LICENSE-MIT");
+        assert!(check(&root, &docs, &assets::Manifest::default()).iter().any(|p| p.contains("LICENSE-MIT: required document has no")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn bundled_documents_must_match_attribution() {
+        let (root, mut docs) = fixture();
+        let mut m = assets::Manifest::default();
+        m.bundled.push(assets::Bundled {
+            krate: "synthetic".into(),
+            version: "1.0.0".into(),
+            path: "font.ttf".into(),
+            title: "test".into(),
+            author: "test".into(),
+            source: "https://example.org".into(),
+            licence: "MIT".into(),
+            kind: "font".into(),
+            usage: "test".into(),
+            sha256: "a".repeat(64),
+            adobe_data: false,
+        });
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("no licence document mapping")));
+        docs.bundled.push(Bundled {
+            krate: "synthetic".into(),
+            path: "font.ttf".into(),
+            licence: "MIT".into(),
+            documents: vec!["LICENSE-MIT".into()],
+        });
+        assert!(check(&root, &docs, &m).is_empty());
+        docs.bundled.get_mut(0).unwrap().documents = vec!["LICENSE-APACHE".into()];
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("inapplicable")));
+        docs.bundled.get_mut(0).unwrap().documents = vec!["LICENSE-MIT".into(), "LICENSE-APACHE".into()];
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("inapplicable mapped document")));
+        docs.bundled.get_mut(0).unwrap().documents = vec!["LICENSE-MIT".into()];
+        docs.bundled.get_mut(0).unwrap().licence = "ISC".into();
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("disagrees")));
+        docs.bundled.get_mut(0).unwrap().documents.clear();
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("documents missing")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn ocr_metadata_and_destinations_are_checked_without_models() {
+        let (root, docs) = fixture();
+        let mut m = assets::Manifest::default();
+        m.fetched.push(assets::Fetched {
+            file: "synthetic.rten".into(),
+            url: "https://example.org/model".into(),
+            title: "test model".into(),
+            author: "test".into(),
+            source: "https://example.org/card".into(),
+            licence: "CC-BY-SA-4.0".into(),
+            licence_url: "https://example.org/licence".into(),
+            licence_sha256: "a".repeat(64),
+            kind: "model".into(),
+            usage: "test".into(),
+            sha256: "b".repeat(64),
+        });
+        assert!(check(&root, &docs, &m).is_empty());
+        m.fetched.get_mut(0).unwrap().licence_sha256 = "z".repeat(64);
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("incomplete OCR")));
+        m.fetched.get_mut(0).unwrap().file = "../outside.rten".into();
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("unsafe OCR")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn required_ocr_models_cannot_be_missing() {
+        let source = include_str!("../../crates/ocr/src/lib.rs");
+        let original = assets::load(&assets::root()).unwrap();
+        assert_eq!(original.fetched.iter().filter(|f| f.kind == "model").count(), 2);
+        assert!(check_required_ocr_metadata(source, &original).unwrap().is_empty());
+        for model in original.fetched.iter().filter(|f| f.kind == "model") {
+            let mut m = assets::load(&assets::root()).unwrap();
+            m.fetched.retain(|f| f.file != model.file);
+            assert!(check_required_ocr_metadata(source, &m).unwrap().iter().any(|p| p.contains(&model.file) && p.contains("missing")));
+        }
+    }
+
+    #[test]
+    fn required_ocr_models_cannot_be_misclassified() {
+        let source = include_str!("../../crates/ocr/src/lib.rs");
+        let original = assets::load(&assets::root()).unwrap();
+        assert_eq!(original.fetched.iter().filter(|f| f.kind == "model").count(), 2);
+        for model in original.fetched.iter().filter(|f| f.kind == "model") {
+            let mut m = assets::load(&assets::root()).unwrap();
+            m.fetched.iter_mut().find(|f| f.file == model.file).unwrap().kind = "font".into();
+            assert!(check_required_ocr_metadata(source, &m).unwrap().iter().any(|p| p.contains(&model.file) && p.contains("kind")));
+        }
+    }
+
+    #[test]
+    fn licence_alternatives_and_combined_obligations_are_distinct() {
+        let mit = BTreeSet::from(["MIT"]);
+        assert!(licence_coverage("MIT OR Apache-2.0", &mit).unwrap());
+        assert!(!licence_coverage("MIT AND Apache-2.0", &mit).unwrap());
+        let both = BTreeSet::from(["MIT", "Bitstream-Vera"]);
+        assert!(licence_coverage("MIT AND Bitstream-Vera", &both).unwrap());
+        assert!(!licence_coverage("MIT OR Apache-2.0", &BTreeSet::from(["OFL-1.1"])).unwrap());
+        for expression in ["", "MIT AND", "MIT OR Apache-2.0 AND ISC", "(MIT OR Apache-2.0)", "MIT WITH exception"] {
+            assert!(licence_coverage(expression, &both).is_err(), "{expression}");
+        }
+    }
+
+    #[test]
+    fn changed_ocr_constant_syntax_fails_closed() {
+        assert!(check_required_ocr_metadata("", &assets::Manifest::default()).is_err());
+    }
+
+    #[test]
+    fn parent_file_destination_conflicts_fail() {
+        let (root, mut docs) = fixture();
+        docs.document.get_mut(2).unwrap().destination = "LICENSE-MIT/NOTICE".into();
+        assert!(check(&root, &docs, &assets::Manifest::default()).iter().any(|p| p.contains("parent file")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn symlink_escape_fails() {
+        let (root, docs) = fixture();
+        let outside = root.with_extension("outside");
+        std::fs::write(&outside, "synthetic licence text\n").unwrap();
+        std::fs::remove_file(root.join("LICENSE-MIT")).unwrap();
+        std::os::unix::fs::symlink(&outside, root.join("LICENSE-MIT")).unwrap();
+        assert!(check(&root, &docs, &assets::Manifest::default()).iter().any(|p| p.contains("outside checkout")));
+        std::fs::remove_dir_all(root).unwrap();
+        std::fs::remove_file(outside).unwrap();
+    }
+}
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 70741d22b7..240eb7294a 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -8,6 +8,7 @@ mod demo_pdf;
 mod fuzz;
 mod gates;
 mod layers;
+mod license_check;
 mod macos_integration;
 mod parity;
 mod screenshots;
@@ -21,7 +22,8 @@ const COMMANDS: &[(&str, &str, Command)] = &[
     ("layers", "Enforce the crate dependency layering (plan/architecture.md §3)", gates::layers),
     ("wasm", "cargo check --target wasm32-unknown-unknown for every crate below L8", gates::wasm),
     ("deny", "Dependency licences, bans, sources and advisories (deny.toml; needs cargo-deny)", gates::deny),
-    ("ci", "fmt --check, clippy -D warnings, test, layers, wasm, assets, deny, parity (stops at first failure)", gates::ci),
+    ("ci", "fmt --check, clippy -D warnings, test, layers, wasm, license-check, deny, parity (stops at first failure)", gates::ci),
+    ("license-check", "Offline source licence documents, attribution and metadata", license_check::run),
     ("assets", "Enforce the asset policy (AGENTS.md §1) against ATTRIBUTION.toml; --write regenerates ATTRIBUTION.md", assets::run),
     ("corpus", "Fetch the pinned pdf.js test corpus into corpus/ (git-ignored) and verify it; --update-pin re-records the pin", gates::corpus),
     ("check", "Robustness sweep over corpus/ with pdfcraft-cli; fails on crashes or regressions vs xtask/baselines", gates::check),

From 1d5c20c5c41ac268110bcf67e3638a69440592eb Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Thu, 15 Oct 2026 20:02:36 +0200
Subject: [PATCH 011/270] Support typed font sizes and Fill and Sign text
 colours (#2444, #2496)

---
 ROADMAP.md                            |  2 +
 crates/automation/README.md           |  7 +++
 crates/automation/src/comments.rs     |  9 ++-
 crates/automation/src/tools.rs        |  3 +-
 crates/automation/tests/automation.rs | 32 +++++++++++
 crates/ui-egui/src/canvas.rs          |  9 +++
 crates/ui-egui/src/content_ui.rs      | 83 +++++++++++++++++++++++++--
 crates/ui-egui/src/editing.rs         |  2 +-
 crates/ui-egui/src/fill_sign.rs       | 34 +++++++++--
 crates/ui-egui/src/lib.rs             |  9 +++
 crates/ui-egui/tests/control.rs       | 10 +++-
 crates/ui-egui/tests/editing.rs       | 35 +++++++++++
 crates/ui-egui/tests/fill_sign.rs     | 51 +++++++++++++++-
 docs/roadmap.md                       |  2 +
 parity/acrobat-features.toml          | 12 ++--
 15 files changed, 275 insertions(+), 25 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index fe9723fdf6..88625a7f41 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,5 +1,7 @@
 # PdfCraft roadmap
 
+> **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (typed small Edit font sizes and Fill & Sign text/date colour, #2444/#2496; estimates unchanged)
+
 **Stage: alpha** · next: beta, ~25% (ready for real work 50% → 75%) and ~400–700 h away
 
 > **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-14 · **Change:** minor (M14: the Italian catalog has every entry the other catalogs had and the code looks up; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
diff --git a/crates/automation/README.md b/crates/automation/README.md
index 4e27702a32..ddd844df1e 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -209,3 +209,10 @@ behavior. Back/Forward
 returns to page tops, does not restore zoom, does not switch documents, and is not saved across
 restarts. Standalone engine/MCP sessions have no viewport, so they do not have a separate
 navigation-history tool; use the opt-in UI control channel to navigate the displayed document.
+
+## Fill & Sign text appearance
+
+`fill_sign_add` accepts `font_size` (4–300 pt, default 10) and `color`
+(`#RRGGBB`, default black) for `text` and `date`. The colour is saved in the
+FreeText appearance and survives reopening. Other mark/signature types reject
+`color`; their appearance controls are separate.
diff --git a/crates/automation/src/comments.rs b/crates/automation/src/comments.rs
index 302688f729..481d75f741 100644
--- a/crates/automation/src/comments.rs
+++ b/crates/automation/src/comments.rs
@@ -477,6 +477,10 @@ impl Automation {
         if sensitivity.is_some() && !scan {
             return Err(ToolError::InvalidArgs("sensitivity is only for scan: true".into()));
         }
+        let requested_color = a.color("color")?;
+        if requested_color.is_some() && !matches!(kind, "text" | "date") {
+            return Err(ToolError::InvalidArgs("color is only for type text or date".into()));
+        }
         let requested_size = a.opt_num("font_size")?;
         if requested_size.is_some() && !matches!(kind, "text" | "date") {
             return Err(ToolError::InvalidArgs("font_size is only for type text or date".into()));
@@ -555,7 +559,10 @@ impl Automation {
                 (Shape::Mark { rect: [at[0] - w / 2.0, at[1] - h / 2.0, at[0] + w / 2.0, at[1] + h / 2.0], mark }, String::new())
             }
         };
-        let style = Style::default_for(&shape);
+        let mut style = Style::default_for(&shape);
+        if let Some(color) = requested_color {
+            style.color = color;
+        }
         self.apply(a, Edit::AddAnnotation(NewAnnotation { page, shape, style, contents, author }))
     }
 
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 5e89aef78a..1bf59596f6 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1162,7 +1162,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "fill_sign_add",
             "Fill & Sign: type text or place a mark",
-            "Fill in a form that has no fields, as Acrobat's Fill & Sign does: type text (`text`, default 10 pt; `font_size` 4–300 pt), place a check, cross, dot or line, today's date (in Preferences ▸ Date format, see fill_sign_date_format, or `format`; `font_size` also applies), or a signature or initials (either `text` drawn in a script font, or `path` to a local PNG/JPEG image up to 4 MiB and 32 megapixels, scaled down to 4 megapixels, preserving transparency; with `scan: true`, `path` is instead a photo of a signature on paper, within the same limits: the signature is found, and the paper, shadows and table around it are removed, with `sensitivity` 0–100, default 50, picking up fainter ink when higher). `at` [x, y] is in points from the top-left of the page: text's top-left, mark's centre, signature's left edge centred vertically. Image signatures fit within 150 pt wide and 32 pt tall (24 pt for initials). Creates movable, undoable annotations. Typed text the standard fonts can't draw is saved and drawn as `?` (`warnings` in the result says so); a typed signature neither the script font nor its fallback can draw is refused (pass `path` instead).",
+            "Fill in a form that has no fields, as Acrobat's Fill & Sign does: type text (`text`, default 10 pt; `font_size` 4–300 pt; optional `color` as #RRGGBB for text/date, default black), place a check, cross, dot or line, today's date (in Preferences ▸ Date format, see fill_sign_date_format, or `format`; `font_size` also applies), or a signature or initials (either `text` drawn in a script font, or `path` to a local PNG/JPEG image up to 4 MiB and 32 megapixels, scaled down to 4 megapixels, preserving transparency; with `scan: true`, `path` is instead a photo of a signature on paper, within the same limits: the signature is found, and the paper, shadows and table around it are removed, with `sensitivity` 0–100, default 50, picking up fainter ink when higher). `at` [x, y] is in points from the top-left of the page: text's top-left, mark's centre, signature's left edge centred vertically. Image signatures fit within 150 pt wide and 32 pt tall (24 pt for initials). Creates movable, undoable annotations. Typed text the standard fonts can't draw is saved and drawn as `?` (`warnings` in the result says so); a typed signature neither the script font nor its fallback can draw is refused (pass `path` instead).",
         )
         .cmd("sign.fill.text")
         .with(schema(
@@ -1173,6 +1173,7 @@ pub fn tools() -> Vec<ToolDef> {
                 "at": point(),
                 "text": { "type": "string", "minLength": 1 },
                 "font_size": { "type": "number", "minimum": 4, "maximum": 300, "description": "For type text or date (default 10 pt)." },
+                "color": color(),
                 "path": { "type": "string", "description": "PNG or JPEG for signature/initials; pass either path or text." },
                 "scan": { "type": "boolean", "description": "With path: scan a photo of a signature on paper (default false)." },
                 "sensitivity": { "type": "integer", "minimum": 0, "maximum": 100, "description": "With scan: how faint ink may be, 0–100 (default 50)." },
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index 1e662d8f38..21b1794cf1 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -2785,6 +2785,38 @@ fn fill_sign_text_font_size_is_saved_and_validated() {
     ));
 }
 
+#[test]
+fn fill_sign_text_and_date_colours_are_saved_and_validated() {
+    let dir = workdir("fill-sign-text-colour");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    for (kind, y) in [("text", 40), ("date", 80)] {
+        ok(
+            &mut a,
+            "fill_sign_add",
+            json!({ "doc": doc, "page": 1, "type": kind, "at": [20, y], "text": "Blue", "color": "#3366CC", "font_size": 6.5 }),
+        );
+    }
+    for (kind, color) in [("text", "not-a-colour"), ("signature", "#3366CC"), ("check", "#3366CC")] {
+        assert!(matches!(
+            a.call("fill_sign_add", &json!({ "doc": doc, "page": 1, "type": kind, "at": [20, 100], "text": "No", "color": color })),
+            Err(ToolError::InvalidArgs(_))
+        ));
+    }
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "coloured.pdf" }));
+    let pdf = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join("coloured.pdf")).unwrap())).unwrap();
+    let page = pdfcraft_model::pages(&pdf).remove(0);
+    let annotations = pdf.resolve(page.dict.get(b"Annots").unwrap());
+    let annotations = annotations.as_array().unwrap();
+    assert_eq!(annotations.len(), 2, "invalid requests add nothing");
+    for reference in annotations {
+        let annotation = pdf.resolve(reference);
+        // FreeText stores its text colour in DA; C is the annotation background.
+        let da = annotation.as_dict().unwrap().get(b"DA").unwrap().as_string().unwrap();
+        assert_eq!(String::from_utf8(da.bytes.to_vec()).unwrap(), "0.2 0.4 0.8 rg /Helv 6.5 Tf");
+    }
+}
+
 #[test]
 fn image_signatures_through_tools_preserve_transparency_and_survive_save() {
     let dir = workdir("image-signatures");
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 989b731b7e..42454d7d9a 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -2850,6 +2850,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     info,
                     ft,
                     app.fill_text_size,
+                    app.fill_text_color,
                     view,
                     signature.as_ref(),
                     initials.as_ref(),
@@ -4436,6 +4437,14 @@ fn quick_bar(app: &mut PdfCraftApp, area: Rect, ui: &mut egui::Ui) {
                                 .suffix(" pt"),
                         );
                     }
+                    if matches!(current_fill, Some(crate::fill_sign::FillTool::Text | crate::fill_sign::FillTool::Date)) {
+                        ui.menu_button(tl!("Colour"), |ui| {
+                            if let Some(color) = comments::swatch_grid(ui, Some(app.fill_text_color)) {
+                                app.fill_text_color = color;
+                                ui.close();
+                            }
+                        });
+                    }
                     if let QuickTool::Comment(tool) = app.quick_tool {
                         let (r, _) = ui.allocate_exact_size(vec2(32.0, 9.0), Sense::hover());
                         ui.painter().hline(r.x_range().shrink(6.0), r.center().y, Stroke::new(1.0, t.divider));
diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 5f5ef32f77..110e608150 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -605,6 +605,43 @@ fn finish(cv: &mut ContentView, d: TextDraft, added: &[Added]) -> Option<Edit> {
     }
 }
 
+/// Commit a typed size once (Enter or leaving the field), rather than one undo step per key.
+/// The bounds match AddedText validation, so the panel also accepts coloured text below 8 pt.
+fn font_size_input(ui: &mut egui::Ui, size: &mut f64) {
+    let id = ui.make_persistent_id("font-size-input");
+    let (previous, mut text) = ui.data(|d| d.get_temp::<(u64, String)>(id)).unwrap_or_else(|| (size.to_bits(), size.to_string()));
+    if previous != size.to_bits() {
+        text = size.to_string();
+    }
+    let response = ui.add(egui::TextEdit::singleline(&mut text).id(id).desired_width(44.0));
+    response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::TextEdit, ui.is_enabled(), tl!("Font size:")));
+    let cancel = response.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Escape));
+    if cancel {
+        text = size.to_string();
+        response.surrender_focus();
+    } else if response.lost_focus() || (response.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter))) {
+        if let Some(value) = typed_font_size(&text) {
+            *size = value;
+        }
+        text = size.to_string();
+    }
+    let before = *size;
+    egui::ComboBox::from_id_salt("font-size").selected_text("pt").width(28.0).show_ui(ui, |ui| {
+        for value in [4.0, 6.0, 8.0, 9.0, 10.0, 11.0, 12.0, 14.0, 16.0, 18.0, 20.0, 24.0, 28.0, 36.0, 48.0, 72.0] {
+            ui.selectable_value(size, value, format!("{value} pt"));
+        }
+    });
+    if *size != before {
+        text = size.to_string();
+    }
+    ui.data_mut(|d| d.insert_temp(id, (size.to_bits(), text)));
+}
+
+fn typed_font_size(text: &str) -> Option<f64> {
+    let value = text.trim().parse::<f64>().ok()?;
+    (value.is_finite() && (1.0..=500.0).contains(&value)).then_some(value)
+}
+
 /// Format text (shown in the Edit panel while a text item is selected, or for new text).
 /// Returns the changed style; for a selected item the caller turns it into an update.
 pub(crate) fn format_panel(ui: &mut egui::Ui, t: &Tokens, style: &AddedText) -> Option<AddedText> {
@@ -616,12 +653,7 @@ pub(crate) fn format_panel(ui: &mut egui::Ui, t: &Tokens, style: &AddedText) ->
                 ui.selectable_value(&mut s.family, f, f.label());
             }
         });
-        // A list rather than a drag value: every change is an undo step.
-        egui::ComboBox::from_id_salt("font-size").selected_text(format!("{} pt", s.size)).width(70.0).show_ui(ui, |ui| {
-            for size in [8.0, 9.0, 10.0, 11.0, 12.0, 14.0, 16.0, 18.0, 20.0, 24.0, 28.0, 36.0, 48.0, 72.0] {
-                ui.selectable_value(&mut s.size, size, format!("{size} pt"));
-            }
-        });
+        font_size_input(ui, &mut s.size);
     });
     ui.horizontal(|ui| {
         if ui.selectable_label(s.bold, egui::RichText::new("B").strong()).on_hover_text(tl!("Bold")).clicked() {
@@ -911,6 +943,45 @@ mod tests {
 
     use super::*;
 
+    #[test]
+    fn typed_sizes_accept_small_fractional_values_and_reject_invalid_input() {
+        for value in ["1", "4", "6.5", " 13.25 ", "500"] {
+            assert_eq!(typed_font_size(value), Some(value.trim().parse().unwrap()));
+        }
+        for value in ["", "0", "-1", "0.5", "501", "NaN", "inf", "1e999", "small"] {
+            assert_eq!(typed_font_size(value), None, "{value}");
+        }
+    }
+
+    #[test]
+    fn typed_size_commits_once_and_invalid_input_preserves_the_style() {
+        let mut h = egui_kittest::Harness::new_ui_state(
+            |ui, state: &mut (f64, usize)| {
+                let before = state.0;
+                ui.horizontal(|ui| font_size_input(ui, &mut state.0));
+                if state.0 != before {
+                    state.1 += 1;
+                }
+            },
+            (12.0, 0),
+        );
+        h.run();
+        let enter = || egui::Event::Key { key: egui::Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE };
+        let select_all =
+            || egui::Event::Key { key: egui::Key::A, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::COMMAND };
+        for (text, expected, changes) in [("6.5", 6.5, 1), ("NaN", 6.5, 1), ("0", 6.5, 1), ("13.25", 13.25, 2)] {
+            h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Font size:").click();
+            h.run();
+            h.event(select_all());
+            h.event(egui::Event::Text(text.into()));
+            h.run_steps(2);
+            assert_eq!(h.state().1, changes - usize::from(text == "6.5" || text == "13.25"), "typing alone does not commit");
+            h.event(enter());
+            h.run_steps(2);
+            assert_eq!(*h.state(), (expected, changes));
+        }
+    }
+
     /// The image a flip button leaves behind, as the panel returns it.
     fn flipped(tooltip: &str) -> pdfcraft_engine::AddedImage {
         let img = pdfcraft_engine::AddedImage::new([0.0, 0.0, 100.0, 50.0], pdfcraft_cos::ObjRef::new(7, 0));
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index be1347d68d..38a26b871b 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -531,7 +531,7 @@ impl PdfCraftApp {
         }
         let author = self.comment_prefs.author.clone();
         let rotation = self.session.get(id).map_or(0, |doc| crate::comments::page_rotation(&doc.info, tb.page));
-        let edit = crate::fill_sign::typed(tb.page, tb.at, &text, tb.size, rotation, &author);
+        let edit = crate::fill_sign::typed_with_color(tb.page, tb.at, &text, tb.size, rotation, &author, tb.color);
         if self.apply_edit(edit) {
             if let Some(view) = self.views.get_mut(i) {
                 view.fill_text = None;
diff --git a/crates/ui-egui/src/fill_sign.rs b/crates/ui-egui/src/fill_sign.rs
index 794fe0bf1b..084b5290f4 100644
--- a/crates/ui-egui/src/fill_sign.rs
+++ b/crates/ui-egui/src/fill_sign.rs
@@ -404,6 +404,7 @@ pub struct TypeBox {
     pub at: [f64; 2],
     pub text: String,
     pub size: f64,
+    pub color: [f64; 3],
     pub focus: bool,
 }
 
@@ -416,6 +417,10 @@ pub fn valid_text_size(size: f64) -> Option<f64> {
     (size.is_finite() && (MIN_TEXT_SIZE..=MAX_TEXT_SIZE).contains(&size)).then_some(size)
 }
 
+pub fn valid_text_color(color: [f64; 3]) -> Option<[f64; 3]> {
+    color.iter().all(|v| v.is_finite() && (0.0..=1.0).contains(v)).then_some(color)
+}
+
 fn to_user(xf: &PageXform, info: &DocInfo, page: usize, p: Pos2) -> [f64; 2] {
     let (vx, vy) = xf.screen_to_view(p);
     let u = info.pages[page].view_to_user(vx, vy);
@@ -430,8 +435,16 @@ fn new(page: usize, shape: Shape, contents: String, author: &str) -> Edit {
 /// A typewriter annotation sized to its text, its displayed top-left at `at` on a page turned by
 /// `rotation` (its `/Rotate`).
 pub fn typed(page: usize, at: [f64; 2], text: &str, size: f64, rotation: i64, author: &str) -> Edit {
+    typed_with_color(page, at, text, size, rotation, author, [0.0; 3])
+}
+
+/// Typed text/date colour applies to its annotation appearance and survives saving.
+pub fn typed_with_color(page: usize, at: [f64; 2], text: &str, size: f64, rotation: i64, author: &str, color: [f64; 3]) -> Edit {
     let rect = crate::comments::text_box_rect(at, text, size, rotation);
-    new(page, Shape::Typewriter { rect, font_size: size }, text.to_string(), author)
+    let shape = Shape::Typewriter { rect, font_size: size };
+    let mut style = Style::default_for(&shape);
+    style.color = valid_text_color(color).unwrap_or([0.0; 3]);
+    Edit::AddAnnotation(NewAnnotation { page, shape, style, contents: text.to_string(), author: author.to_string() })
 }
 
 /// Place a saved signature (strokes normalised to a 0–1 box, y up) with its left edge at `at`,
@@ -620,6 +633,7 @@ pub(crate) fn page_input(
     info: &DocInfo,
     tool: FillTool,
     text_size: f64,
+    text_color: [f64; 3],
     view: &mut DocView,
     signature: Option<&SavedSig>,
     initials: Option<&SavedSig>,
@@ -657,13 +671,21 @@ pub(crate) fn page_input(
         FillTool::Text => {
             // Clicking away from an open box commits it: the page sees this click before the box
             // sees its lost focus, so replacing the box first would drop what was typed.
-            let open = view.fill_text.replace(TypeBox { page, at: top, text: String::new(), size: text_size, focus: true });
+            let open = view.fill_text.replace(TypeBox { page, at: top, text: String::new(), size: text_size, color: text_color, focus: true });
             open.filter(|tb| !tb.text.trim().is_empty()).map(|tb| {
-                FillAction::Edit(Box::new(typed(tb.page, tb.at, tb.text.trim(), tb.size, crate::comments::page_rotation(info, tb.page), author)))
+                FillAction::Edit(Box::new(typed_with_color(
+                    tb.page,
+                    tb.at,
+                    tb.text.trim(),
+                    tb.size,
+                    crate::comments::page_rotation(info, tb.page),
+                    author,
+                    tb.color,
+                )))
             })
         }
         FillTool::Date => Some(match date_text {
-            Ok(text) => FillAction::Edit(Box::new(typed(page, top, text, text_size, rotation, author))),
+            Ok(text) => FillAction::Edit(Box::new(typed_with_color(page, top, text, text_size, rotation, author, text_color))),
             Err(why) => FillAction::Refused(why.clone()),
         }),
         FillTool::Signature => match signature {
@@ -719,7 +741,7 @@ pub(crate) fn type_box(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
                 .font(egui::FontId::proportional((t.size as f32 * zoom).max(8.0)))
                 .desired_width(width)
                 .background_color(Color32::from_rgba_unmultiplied(255, 255, 255, 230))
-                .text_color(Color32::BLACK)
+                .text_color(crate::comments::color32(t.color))
                 .hint_text(tl!("Type text"))
                 .id_salt("fill-text-edit"),
         );
@@ -740,7 +762,7 @@ pub(crate) fn type_box(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
     if commit {
         let tb = view.fill_text.take()?;
         if !tb.text.trim().is_empty() {
-            return Some(typed(tb.page, tb.at, tb.text.trim(), tb.size, crate::comments::page_rotation(info, tb.page), author));
+            return Some(typed_with_color(tb.page, tb.at, tb.text.trim(), tb.size, crate::comments::page_rotation(info, tb.page), author, tb.color));
         }
     }
     None
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index d101d812e0..576784e190 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -550,6 +550,8 @@ pub struct PdfCraftApp {
     pub flatten_fill_sign_on_save: bool,
     /// Point size for new Fill & Sign text and dates, kept across launches.
     pub fill_text_size: f64,
+    /// Colour for new Fill & Sign text and dates, kept across launches.
+    pub fill_text_color: [f64; 3],
     pub dialog: Option<Dialog>,
     /// How to ask for the latest release (the desktop app sets it; see `updates`).
     pub update_source: Option<updates::UpdateSource>,
@@ -921,6 +923,7 @@ impl PdfCraftApp {
             ui_scale_applied: None,
             flatten_fill_sign_on_save: false,
             fill_text_size: fill_sign::TEXT_SIZE,
+            fill_text_color: [0.0; 3],
             dialog: None,
             update_source: None,
             updates: updates::Updates::default(),
@@ -2276,6 +2279,7 @@ impl PdfCraftApp {
             "right_panel_closed": self.right_panel_closed,
         });
         // Set apart: one more key inside the macro above passes serde_json's recursion limit.
+        v["fill_text_color"] = serde_json::json!(self.fill_text_color);
         v["redact_prefs"] = self.redact_defaults.to_json();
         // Set outside json! above, which is at serde_json's macro recursion limit.
         v["hide_empty_highlight_hover"] = serde_json::Value::Bool(self.comment_prefs.hide_empty_highlight_hover);
@@ -2357,6 +2361,11 @@ impl PdfCraftApp {
         if let Some(size) = v["fill_text_size"].as_f64().and_then(fill_sign::valid_text_size) {
             self.fill_text_size = size;
         }
+        if let Ok(color) = serde_json::from_value::<[f64; 3]>(v["fill_text_color"].clone())
+            && let Some(color) = fill_sign::valid_text_color(color)
+        {
+            self.fill_text_color = color;
+        }
         if let Some(prefs) = RedactPrefs::from_json(&v["redact_prefs"]) {
             self.redact_prefs = prefs.clone();
             self.redact_defaults = prefs;
diff --git a/crates/ui-egui/tests/control.rs b/crates/ui-egui/tests/control.rs
index 88ed1c0a90..a93e035c77 100644
--- a/crates/ui-egui/tests/control.rs
+++ b/crates/ui-egui/tests/control.rs
@@ -1425,8 +1425,14 @@ fn rail_reveals_its_remembered_inactive_inspector_then_closes_the_visible_panel(
 #[test]
 fn control_quit_retains_inactive_fill_sign_typing_after_cancel() {
     let (mut h, c) = harness();
-    h.state_mut().views[0].fill_text =
-        Some(pdfcraft_ui_egui::fill_sign::TypeBox { page: 0, at: [40.0, 200.0], text: "Unsaved signature note".into(), size: 10.0, focus: false });
+    h.state_mut().views[0].fill_text = Some(pdfcraft_ui_egui::fill_sign::TypeBox {
+        page: 0,
+        at: [40.0, 200.0],
+        text: "Unsaved signature note".into(),
+        size: 10.0,
+        color: [0.0; 3],
+        focus: false,
+    });
     h.state_mut().active = None;
     assert!(!h.state().session.get(h.state().views[0].id).unwrap().dirty);
     assert_eq!(ok(&mut h, &c, "ui.quit", json!({})), json!({"quitting":false,"needs_confirmation":true}));
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index f8db525751..4a31784246 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -2876,6 +2876,41 @@ fn the_format_panel_restyles_the_paragraph_being_edited() {
     assert!(s.views[0].line_editor.as_ref().is_some_and(|e| e.extras.underline));
 }
 
+#[test]
+fn typed_small_coloured_text_size_survives_save_and_reopen() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).unwrap();
+    let at = egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height());
+    h.hover_at(at);
+    h.run_steps(1);
+    h.drag_at(at);
+    h.run_steps(1);
+    h.drop_at(at);
+    h.run_steps(3);
+    assert!(h.state().views[0].line_editor.is_some());
+    h.get_by_label("Font size:").click();
+    h.run_steps(1);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::A);
+    h.event(egui::Event::Text("6.5".into()));
+    h.key_press(Key::Enter);
+    h.run_steps(4);
+    h.get_by_label("Blue").click();
+    h.run_steps(4);
+    let id = h.state().views[0].id;
+    let lines = h.state().session.get(id).unwrap().text_lines(0);
+    assert!(!lines.is_empty());
+    for line in &lines {
+        assert!((line.size - 6.5).abs() < 0.01, "{line:?}");
+        assert!(line.color[2] > line.color[0], "the small text stays blue: {line:?}");
+    }
+    let saved = h.state().session.save_bytes(id).unwrap();
+    let mut reopened = pdfcraft_engine::Session::new();
+    let rid = reopened.open("small-blue.pdf", None, saved, None).unwrap();
+    assert_eq!(reopened.get(rid).unwrap().text_lines(0), lines);
+}
+
 #[test]
 fn selected_text_formatting_keeps_the_rest_of_the_paragraph_and_reopens() {
     let mut h = harness(1, |_| {});
diff --git a/crates/ui-egui/tests/fill_sign.rs b/crates/ui-egui/tests/fill_sign.rs
index 27fd6dd8a5..b888e1e23e 100644
--- a/crates/ui-egui/tests/fill_sign.rs
+++ b/crates/ui-egui/tests/fill_sign.rs
@@ -168,6 +168,53 @@ fn fill_text_size_controls_new_text_and_survives_settings_restore() {
     assert_eq!(restored.fill_text_size, 24.0, "invalid settings do not change the size");
 }
 
+#[test]
+fn fill_text_colour_survives_preview_commit_settings_and_save() {
+    let mut h = harness();
+    h.state_mut().execute("sign.fill.text");
+    h.run_steps(2);
+    h.get_by_label("Colour").click();
+    h.run_steps(2);
+    h.get_by_label("Blue").click();
+    h.run_steps(2);
+    let color = h.state().fill_text_color;
+    assert!(color[2] > color[0], "blue was selected: {color:?}");
+    click(&mut h, 50.0, 250.0);
+    assert_eq!(h.state().views[0].fill_text.as_ref().unwrap().color, color, "the editor uses the selected colour");
+    h.event(egui::Event::Text("Blue form text".into()));
+    h.run_steps(2);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    let id = h.state().views[0].id;
+    let expected = color.map(|v| v as f32);
+    let annotation = h.state().session.get(id).unwrap().info.annotations.iter().find(|a| a.contents.as_deref() == Some("Blue form text")).unwrap();
+    assert_eq!(annotation.color, Some(expected));
+    let bytes = h.state().session.save_bytes(id).unwrap();
+    let reopened = harness_bytes(&bytes);
+    let saved = reopened
+        .state()
+        .session
+        .get(reopened.state().views[0].id)
+        .unwrap()
+        .info
+        .annotations
+        .iter()
+        .find(|a| a.contents.as_deref() == Some("Blue form text"))
+        .unwrap();
+    assert_eq!(saved.color, Some(expected));
+    let mut restored = PdfCraftApp::new();
+    restored.restore(&h.state().persist());
+    assert_eq!(restored.fill_text_color, color);
+    restored.restore(r#"{"fill_text_color":[2,0,0]}"#);
+    assert_eq!(restored.fill_text_color, color, "invalid saved colours are ignored");
+    h.state_mut().execute("edit.undo");
+    h.run_steps(2);
+    assert!(!items(&h).iter().any(|(_, text)| text.as_deref() == Some("Blue form text")));
+    h.state_mut().execute("edit.redo");
+    h.run_steps(2);
+    assert!(items(&h).iter().any(|(_, text)| text.as_deref() == Some("Blue form text")));
+}
+
 #[test]
 fn the_type_box_grows_as_text_is_typed() {
     let mut h = harness();
@@ -995,7 +1042,7 @@ fn saving_flattens_fill_and_sign_only_when_the_preference_is_on() {
     app.open_bytes("form.pdf", None, FIXTURE.to_vec()).unwrap();
     let id = app.views[0].id;
     app.session.apply(id, mark).unwrap();
-    app.views[0].fill_text = Some(TypeBox { page: 0, at: [40.0, 200.0], text: "Typed".into(), size: 10.0, focus: false });
+    app.views[0].fill_text = Some(TypeBox { page: 0, at: [40.0, 200.0], text: "Typed".into(), size: 10.0, color: [0.0; 3], focus: false });
     let kept = dir.join("kept.pdf");
     app.save_override = Some(kept.to_string_lossy().into_owned());
     assert!(app.save_active(SaveTarget::InPlace));
@@ -1006,7 +1053,7 @@ fn saving_flattens_fill_and_sign_only_when_the_preference_is_on() {
     assert!(texts.iter().any(|t| t == "Typed"), "an open type box is saved: {texts:?}");
     assert_eq!(reopened.session.get(reopened.views[0].id).unwrap().info.annotations.len(), 2, "the check mark stays too");
 
-    app.views[0].fill_text = Some(TypeBox { page: 0, at: [40.0, 160.0], text: "More".into(), size: 10.0, focus: false });
+    app.views[0].fill_text = Some(TypeBox { page: 0, at: [40.0, 160.0], text: "More".into(), size: 10.0, color: [0.0; 3], focus: false });
     app.flatten_fill_sign_on_save = true;
     let flat = dir.join("flat.pdf");
     app.save_override = Some(flat.to_string_lossy().into_owned());
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 3148823ea5..ffb34ffd7a 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,5 +1,7 @@
 # PdfCraft roadmap: milestones and what's next
 
+> **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (typed small Edit font sizes and Fill & Sign text/date colour, #2444/#2496; estimates unchanged)
+
 > **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-14 · **Change:** minor (M14: the Italian catalog has every entry the other catalogs had and the code looks up, 2,528 entries; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-13 · **Change:** minor (M2/M6: spot-colour images convert once per pixel value; widget placement and the Fields panel scale with the field count; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M3 candidate: coordinate control clicks on slow frames and coalesced text selection; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 533013b547..7c35e73b5a 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1926,8 +1926,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text", "edit.text"]
 tools = ["text_edit", "content_update"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_take_new_formatting", "crates/ui-egui/tests/editing.rs::the_format_panel_restyles_the_paragraph_being_edited", "crates/automation/tests/automation.rs::editing_existing_text_through_tools"]
-notes = "existing paragraphs and added text: font family (Helvetica, Times, Courier) with bold and italic, size, colour; existing paragraphs are rewrapped"
+evidence = ["crates/edit/src/tests.rs::paragraphs_take_new_formatting", "crates/ui-egui/tests/editing.rs::the_format_panel_restyles_the_paragraph_being_edited", "crates/automation/tests/automation.rs::editing_existing_text_through_tools", "crates/ui-egui/src/content_ui.rs::typed_sizes_accept_small_fractional_values_and_reject_invalid_input", "crates/ui-egui/src/content_ui.rs::typed_size_commits_once_and_invalid_input_preserves_the_style", "crates/ui-egui/tests/editing.rs::typed_small_coloured_text_size_survives_save_and_reopen"]
+notes = "existing paragraphs and added text: font family (Helvetica, Times, Courier) with bold and italic, size, colour; existing paragraphs are rewrapped; the Edit font-size field accepts typed fractional values from 1–500 pt, including below 8 pt; Enter/focus loss commits once and invalid input preserves the previous value"
 
 [[feature]]
 id = "edit.text-format-style"
@@ -5268,8 +5268,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["sign.fill.text"]
 tools = ["fill_sign_add"]
-evidence = ["crates/ui-egui/tests/fill_sign.rs::text_marks_and_date", "crates/annot/src/tests.rs::fill_and_sign_items_are_drawn", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/engine/src/tests.rs::typed_text_reads_across_as_displayed_on_rotated_pages"]
-notes = "typewriter FreeText, 10 pt Helvetica. Reads across as displayed on pages with /Rotate (sideways-stored scans): the box follows the displayed axes and the appearance is turned back (PdfCraft key /PCTextRotate); other apps that regenerate the appearance from /DA draw it unturned. A later page rotation does not re-turn it. Field detection does not work on scanned (image-only) forms yet"
+evidence = ["crates/ui-egui/tests/fill_sign.rs::text_marks_and_date", "crates/annot/src/tests.rs::fill_and_sign_items_are_drawn", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/engine/src/tests.rs::typed_text_reads_across_as_displayed_on_rotated_pages", "crates/ui-egui/tests/fill_sign.rs::fill_text_colour_survives_preview_commit_settings_and_save", "crates/automation/tests/automation.rs::fill_sign_text_and_date_colours_are_saved_and_validated"]
+notes = "typewriter FreeText, 10 pt Helvetica. Reads across as displayed on pages with /Rotate (sideways-stored scans): the box follows the displayed axes and the appearance is turned back (PdfCraft key /PCTextRotate); other apps that regenerate the appearance from /DA draw it unturned. A later page rotation does not re-turn it. Field detection does not work on scanned (image-only) forms yet; text/date colour is selectable, remembered and preserved in saved appearances; fill_sign_add exposes color and font_size"
 
 [[feature]]
 id = "form.fill-sign-marks"
@@ -5292,8 +5292,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["sign.fill.date"]
 tools = ["fill_sign_add", "fill_sign_date_format"]
-evidence = ["crates/ui-egui/tests/fill_sign.rs::text_marks_and_date", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/date_format.rs::fill_and_sign_dates_follow_the_date_format_preference_and_it_is_remembered", "crates/engine/src/dates.rs::presets_write_the_day_in_their_own_order", "crates/engine/src/dates.rs::names_follow_the_date_language", "crates/ui-egui/tests/date_format.rs::month_names_follow_the_date_language_or_else_the_interface_language", "crates/ui-egui/tests/date_format.rs::a_date_the_pdf_cannot_hold_is_refused_with_a_warning_first"]
-notes = "local date in Preferences ▸ Date format (default m/d/yyyy; 12 presets or any pattern in Acrobat date letters with \\ escapes, checked and previewed as typed, remembered; only whole date codes accepted; month and weekday names in the interface languages, Czech months in the genitive after a day, following the interface language unless one is picked; fill_sign_add takes a one-off format and language). Beyond Acrobat: its Fill & Sign has no format setting (only Acrobat Sign accounts do). Missing: Fill & Sign text is Helvetica/WinAnsi, so a date with letters outside Western European (Czech ř, Japanese, Chinese names) is refused with a warning instead of being saved as ?; the OS locale's format isn't offered as a preset; names in languages without an interface translation"
+evidence = ["crates/ui-egui/tests/fill_sign.rs::text_marks_and_date", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/date_format.rs::fill_and_sign_dates_follow_the_date_format_preference_and_it_is_remembered", "crates/engine/src/dates.rs::presets_write_the_day_in_their_own_order", "crates/engine/src/dates.rs::names_follow_the_date_language", "crates/ui-egui/tests/date_format.rs::month_names_follow_the_date_language_or_else_the_interface_language", "crates/ui-egui/tests/date_format.rs::a_date_the_pdf_cannot_hold_is_refused_with_a_warning_first", "crates/automation/tests/automation.rs::fill_sign_text_and_date_colours_are_saved_and_validated"]
+notes = "local date in Preferences ▸ Date format (default m/d/yyyy; 12 presets or any pattern in Acrobat date letters with \\ escapes, checked and previewed as typed, remembered; only whole date codes accepted; month and weekday names in the interface languages, Czech months in the genitive after a day, following the interface language unless one is picked; fill_sign_add takes a one-off format and language). Beyond Acrobat: its Fill & Sign has no format setting (only Acrobat Sign accounts do). Missing: Fill & Sign text is Helvetica/WinAnsi, so a date with letters outside Western European (Czech ř, Japanese, Chinese names) is refused with a warning instead of being saved as ?; the OS locale's format isn't offered as a preset; names in languages without an interface translation; shares the Fill & Sign text colour preference and tool argument"
 
 [[feature]]
 id = "form.fill-sign-signature"

From a9b0db12c62f81beb8d2b57851d650d10bdb37e8 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Fri, 16 Oct 2026 10:46:02 +0200
Subject: [PATCH 012/270] fix(edit): show backgrounds on pages that paint their
 own white backdrop

Add Background draws behind the page content, so on a page that first
fills itself with opaque white (browsers' Save as PDF, print drivers) the
background was hidden completely and the tool looked broken.

- pdfcraft-edit: new `backdrop` module. A strictly detected backdrop (one
  axis-aligned `re`, opaque white in a device colour space, painted before
  anything else and covering the crop box) is replaced by turning that one
  fill into `n` in a per-page copy of its stream; the original stream is
  left untouched for other pages. Remove background restores it, unless
  the copy was edited since. Page-sized pictures (scans) are reported only.
- Background gains `replace_backdrop` (default on); the default colour is
  a visible light yellow instead of near-white.
- Dialog: offers to replace the backdrop, warns about scanned pages,
  checks pages a few per frame, preview draws text over the colour.
- Automation: `doc_background` takes `replace_backdrop`; new read-only
  `doc_backdrops` lists pages with a backdrop.

Acrobat's behaviour on such pages is unobserved; recorded as our choice
in parity/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ROADMAP.md                             |   1 +
 crates/automation/src/lib.rs           |  23 ++
 crates/automation/src/tools.rs         |   8 +-
 crates/automation/tests/backdrop.rs    | 109 +++++++++
 crates/edit/src/backdrop.rs            | 323 +++++++++++++++++++++++++
 crates/edit/src/backdrop_tests.rs      | 233 ++++++++++++++++++
 crates/edit/src/lib.rs                 |  22 +-
 crates/engine/src/lib.rs               |   7 +-
 crates/ui-egui/src/marks_ui.rs         | 101 +++++++-
 crates/ui-egui/tests/ui_group/marks.rs |  67 +++++
 parity/acrobat-features.toml           |  10 +-
 11 files changed, 892 insertions(+), 12 deletions(-)
 create mode 100644 crates/automation/tests/backdrop.rs
 create mode 100644 crates/edit/src/backdrop.rs
 create mode 100644 crates/edit/src/backdrop_tests.rs

diff --git a/ROADMAP.md b/ROADMAP.md
index 259dbfec04..b90b9f5679 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -157,6 +157,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 | 8 | 1.0 polish: performance, right-to-left, missing languages, keyboard-only (M14) | 55–95 |
 
 ## Progress log
+- **2026-10-16 (M7, Add Background):** A background added behind a page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) was hidden completely, so the tool looked broken. The dialog now detects such pages and offers to replace the backdrop (on by default): the one fill becomes `n` in a per-page copy of its stream, and Remove background puts the original back unless the copy was edited since. Scanned pages are warned about, not touched. New `doc_backdrops` tool; `doc_background` takes `replace_backdrop`. The default colour is a visible light yellow and the preview shows text over it. Acrobat's own behaviour on such pages is unobserved. Estimates unchanged.
 - **2026-10-15 (M2, gap 12):** `cargo xtask text-oracle` scores reading order as well as word F1: the longest common subsequence of the two word sequences over the longer one. F1 is a bag of words and cannot see order at all -- measuring #2431, a change that moves text and nothing else, it called 26 of the 29 files whose output changed identical, where the order score separated 18 improvements from 6 regressions. Reports, does not gate; a disagreement with Poppler, not a verdict. Estimates unchanged.
 - **2026-10-15 (M2, #2305 follow-up):** WinAnsiEncoding 0xA0 and 0xAD and MacRomanEncoding 0xCA extract as the ordinary space and hyphen Annex D.2 names them, in the vendored hayro tables (patch 30) as well as `crates/fonts`, so search, copy and redaction see characters that were hidden behind U+00A0 and U+00AD. Across the pdf.js corpus the soft hyphens we extract fall 117 to 13 and the non-breaking spaces 30 to 26; the rest come from `/ToUnicode`. An explicit `/Differences` name keeps its glyph list value, as pdftotext does. Estimates unchanged.
 - **2026-10-13 (community, M3, #1569 review):** Pixel-only Wayland wheel, wheel-tilt and continuous input use standalone moved events, so Ctrl zoom does not remain latched after the modifier is released (#991); vendored winit patch (13), with a policy test. Estimates unchanged.
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 88856305b2..564dd8e882 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -704,6 +704,7 @@ impl Automation {
             }
             "doc_export_images" | "doc_export_text" | "doc_export_all_images" => self.export(name, &a)?,
             "doc_header_footer" | "doc_watermark" | "doc_background" | "doc_remove_marks" => self.marks(name, &a)?,
+            "doc_backdrops" => self.backdrops(&a)?,
             "doc_unprotect" => {
                 let mut out = self.apply(&a, Edit::RemoveProtection)?;
                 out["security"] = security(self.doc(&a)?);
@@ -1172,6 +1173,27 @@ impl Automation {
         Ok(out)
     }
 
+    /// Pages whose own backdrop hides a background (see `pdfcraft_edit::backdrop`).
+    fn backdrops(&mut self, a: &Args) -> Result<Value> {
+        let n = self.doc(a)?.info.pages.len();
+        let pages = match a.opt_ints("pages")? {
+            Some(_) => self.pages(a, "pages")?,
+            None => (0..n).collect(),
+        };
+        let doc = self.doc(a)?;
+        let found: Vec<Value> = pages
+            .into_iter()
+            .filter_map(|p| {
+                let kind = match doc.page_backdrop(p)? {
+                    pdfcraft_engine::Backdrop::Fill => "fill",
+                    pdfcraft_engine::Backdrop::Image => "image",
+                };
+                Some(json!({ "page": p + 1, "backdrop": kind }))
+            })
+            .collect();
+        Ok(json!({ "pages": found }))
+    }
+
     fn marks(&mut self, tool: &str, a: &Args) -> Result<Value> {
         use pdfcraft_engine::{Background, HeaderFooter, MarkKind, Watermark};
         let n = self.doc(a)?.info.pages.len();
@@ -1230,6 +1252,7 @@ impl Automation {
                     color: color("color", [1.0; 3])?,
                     opacity: a.opt_num("opacity")?.unwrap_or(1.0),
                     scale: a.opt_num("scale")?.unwrap_or(1.0).clamp(0.01, 1.0),
+                    replace_backdrop: a.opt_bool("replace_backdrop")?.unwrap_or(true),
                     ..Background::default()
                 },
                 replace,
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 5e89aef78a..e520b7bb63 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -902,12 +902,16 @@ pub fn tools() -> Vec<ToolDef> {
                 }),
                 &["doc"],
             )),
-        t("doc_background", "Add background", "Fill page backgrounds with a colour, or a picture from `file` (an image, or page `file_page` of a PDF) fitted at `scale` (default 1), behind the content. Undoable.")
+        t("doc_background", "Add background", "Fill page backgrounds with a colour, or a picture from `file` (an image, or page `file_page` of a PDF) fitted at `scale` (default 1), behind the content. A page that paints its own opaque white backdrop would hide it, so that backdrop is replaced unless replace_backdrop is false (removing the background puts it back); a scanned page's picture still hides it (doc_backdrops lists both). Undoable.")
             .cmd("edit.background")
             .with(schema(
-                json!({ "doc": doc(), "pages": pages("to fill (default: all)"), "color": { "type": "string" }, "file": { "type": "string" }, "file_page": { "type": "integer", "minimum": 1 }, "scale": { "type": "number", "exclusiveMinimum": 0, "maximum": 1 }, "opacity": { "type": "number", "minimum": 0, "maximum": 1 }, "replace": { "type": "boolean" } }),
+                json!({ "doc": doc(), "pages": pages("to fill (default: all)"), "color": { "type": "string" }, "file": { "type": "string" }, "file_page": { "type": "integer", "minimum": 1 }, "scale": { "type": "number", "exclusiveMinimum": 0, "maximum": 1 }, "opacity": { "type": "number", "minimum": 0, "maximum": 1 }, "replace": { "type": "boolean" }, "replace_backdrop": { "type": "boolean", "description": "Replace a white backdrop the page paints itself, which would hide the background. Default true." } }),
                 &["doc"],
             )),
+        t("doc_backdrops", "List page backdrops", "Pages that paint their own backdrop, which hides a background added behind the content: `fill` (an opaque white fill doc_background can replace) or `image` (a page-sized picture, e.g. a scan, that still hides it). Pages are 1-based; pages without one are left out.")
+            .ro()
+            .cmd("edit.background")
+            .with(schema(json!({ "doc": doc(), "pages": pages("to check (default: all)") }), &["doc"])),
         t("doc_remove_marks", "Remove header & footer, watermark or background", "Remove every header and footer, watermark or background PdfCraft (or a compatible tool) added. Undoable.")
             .destructive()
             .with(schema(json!({ "doc": doc(), "kind": { "type": "string", "enum": ["header_footer", "watermark", "background"] } }), &["doc", "kind"])),
diff --git a/crates/automation/tests/backdrop.rs b/crates/automation/tests/backdrop.rs
new file mode 100644
index 0000000000..1a8a71eb8e
--- /dev/null
+++ b/crates/automation/tests/backdrop.rs
@@ -0,0 +1,109 @@
+//! Add Background on pages that paint their own backdrop, end to end through the tools: what
+//! `page_render` draws, `doc_backdrops`, save and reopen, and Remove putting the page back.
+
+use std::path::PathBuf;
+
+use pdfcraft_automation::{Automation, Content};
+use serde_json::{Value, json};
+
+/// Two 200 × 100 pt pages saying "Hi": page 1 on a white fill of its own (as browsers write),
+/// page 2 on bare paper; a third page is a "scan" (a page-sized grey picture).
+fn fixture() -> Vec<u8> {
+    let text = "0 g BT /F1 24 Tf 20 40 Td (Hi) Tj ET";
+    let contents = [format!("q 1 1 1 rg 0 0 200 100 re f Q {text}"), text.to_string(), format!("q 200 0 0 100 0 0 cm /Im0 Do Q {text}")];
+    let mut objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [4 0 R 6 0 R 8 0 R] /Count 3 /MediaBox [0 0 200 100] >>".into(),
+        "<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 1 >>\nstream\n\u{80}\nendstream"
+            .into(),
+    ];
+    for (i, c) in contents.iter().enumerate() {
+        objs.push(format!(
+            "<< /Type /Page /Parent 2 0 R /Contents {} 0 R /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> /XObject << /Im0 3 0 R >> >> >>",
+            5 + 2 * i
+        ));
+        objs.push(format!("<< /Length {} >>\nstream\n{c}\nendstream", c.len()));
+    }
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+fn workdir() -> PathBuf {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-automation-backdrop-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("a.pdf"), fixture()).unwrap();
+    dir
+}
+
+fn ok(a: &mut Automation, tool: &str, args: Value) -> Value {
+    match a.call(tool, &args) {
+        Ok(mut c) => match c.remove(0) {
+            Content::Json(v) => v,
+            other => panic!("{tool}: expected JSON, got {other:?}"),
+        },
+        Err(e) => panic!("{tool} {args}: {e}"),
+    }
+}
+
+/// The RGB of a blank spot (top-right corner area) of a page rendered at 72 dpi.
+fn blank_spot(a: &mut Automation, doc: u64, page: u64) -> [u8; 3] {
+    let rendered = a.call("page_render", &json!({ "doc": doc, "page": page, "dpi": 72 })).unwrap();
+    let Content::Png { data, width, .. } = &rendered[0] else { panic!("expected a PNG") };
+    let mut reader = png::Decoder::new(std::io::Cursor::new(data)).read_info().unwrap();
+    let mut pixels = vec![0; reader.output_buffer_size().unwrap()];
+    let info = reader.next_frame(&mut pixels).unwrap();
+    let channels = info.color_type.samples();
+    let at = (10 * *width as usize + 180) * channels;
+    [pixels[at], pixels[at + 1], pixels[at + 2]]
+}
+
+const RED: [u8; 3] = [255, 0, 0];
+const WHITE: [u8; 3] = [255, 255, 255];
+
+#[test]
+fn a_background_shows_on_a_page_that_paints_its_own_white_backdrop() {
+    let dir = workdir();
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(
+        ok(&mut a, "doc_backdrops", json!({ "doc": doc }))["pages"],
+        json!([{ "page": 1, "backdrop": "fill" }, { "page": 3, "backdrop": "image" }])
+    );
+
+    // Not replacing: the page's own white hides the background, as it always did.
+    ok(&mut a, "doc_background", json!({ "doc": doc, "color": "#FF0000", "replace_backdrop": false }));
+    assert_eq!(blank_spot(&mut a, doc, 1), WHITE);
+    assert_eq!(blank_spot(&mut a, doc, 2), RED);
+    ok(&mut a, "edit_undo", json!({ "doc": doc }));
+
+    // The default replaces it: red on both pages; the scan still hides it.
+    ok(&mut a, "doc_background", json!({ "doc": doc, "color": "#FF0000" }));
+    assert_eq!(blank_spot(&mut a, doc, 1), RED);
+    assert_eq!(blank_spot(&mut a, doc, 2), RED);
+    assert_ne!(blank_spot(&mut a, doc, 3), RED);
+    assert_eq!(ok(&mut a, "doc_backdrops", json!({ "doc": doc }))["pages"], json!([{ "page": 3, "backdrop": "image" }]));
+
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "out.pdf" }));
+    let saved = ok(&mut a, "doc_open", json!({ "path": "out.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(blank_spot(&mut a, saved, 1), RED, "after save and reopen");
+    ok(&mut a, "doc_remove_marks", json!({ "doc": saved, "kind": "background" }));
+    assert_eq!(blank_spot(&mut a, saved, 1), WHITE);
+    assert_eq!(
+        ok(&mut a, "doc_backdrops", json!({ "doc": saved, "pages": [1] }))["pages"],
+        json!([{ "page": 1, "backdrop": "fill" }]),
+        "the backdrop is back"
+    );
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/edit/src/backdrop.rs b/crates/edit/src/backdrop.rs
new file mode 100644
index 0000000000..d15652f82b
--- /dev/null
+++ b/crates/edit/src/backdrop.rs
@@ -0,0 +1,323 @@
+//! A page's own backdrop: an opaque white fill (or a picture) covering the whole visible page
+//! before anything else is drawn. Many writers paint one (browsers' Save as PDF, print drivers;
+//! scans are a page-sized picture), and it hides anything placed behind the content, so a
+//! background added behind such a page never shows.
+//!
+//! A white fill can be replaced: the one fill operator becomes `n` (end the path without
+//! painting), which looks the same on white paper. The page then gets a copy of the content
+//! stream that held it, tagged `/PCBackdrop << /Original ref /At n /Len n >>`, and the stream
+//! itself is left alone (other pages may share it). [`restore`] puts the original back when the
+//! background is removed, unless the copy has been edited since. A picture can't be replaced
+//! without losing it, so it is only reported.
+//!
+//! Detection is deliberately strict: only one rectangle (`re`), in DeviceGray, DeviceRGB or
+//! DeviceCMYK, opaque in the graphics state, with an axis-aligned transform, filled before any
+//! other painting, and covering the crop box. Anything else is real content and stays.
+
+use pdfcraft_content::{Matrix, Op, Pieces};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
+
+use crate::EditError;
+
+/// How much of a page's content is read looking for a backdrop: it has to come first.
+const SCAN_BYTES: usize = 64 * 1024;
+/// How many operators are walked before giving up.
+const SCAN_OPS: usize = 4096;
+/// How far (in points) a backdrop may fall short of the crop box and still count as covering it.
+const COVER_EPS: f64 = 1.0;
+/// Components at least this close to white (per channel) count as white.
+const WHITE: f64 = 0.98;
+
+/// What paints a page's backdrop.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Backdrop {
+    /// An opaque white fill: replaceable.
+    Fill,
+    /// A picture covering the page (a scan): a background behind it stays hidden.
+    Image,
+}
+
+/// Where a replaceable fill is: the content streams (references in `/Contents` order, untagged
+/// ones only), their joined bytes, and the fill operator's joined byte range.
+struct Found {
+    refs: Vec<(usize, ObjRef)>,
+    pieces: Pieces,
+    op: std::ops::Range<usize>,
+}
+
+#[derive(Clone)]
+struct State {
+    ctm: Matrix,
+    /// Clip in default user space, when it is a known rectangle; `None` = unknown shape.
+    clip: Option<[f64; 4]>,
+    /// The fill colour is white.
+    white: bool,
+    /// Non-stroking colour space components (1, 3, 4), or 0 for a space we don't read.
+    space: usize,
+    opaque: bool,
+}
+
+/// The backdrop `page` (0-based) paints, if any.
+pub fn page_backdrop(doc: &Document, page: usize) -> Result<Option<Backdrop>, EditError> {
+    Ok(scan(doc, page)?.map(|(b, _)| b))
+}
+
+/// Replace `page`'s white backdrop fill, if it has one (see the module doc). Returns whether it
+/// did. A picture backdrop is left alone.
+pub(crate) fn replace(doc: &mut Document, page: usize) -> Result<bool, EditError> {
+    let Some((Backdrop::Fill, Some(found))) = scan(doc, page)? else { return Ok(false) };
+    let edited = found.pieces.splice([(found.op.clone(), b"n".to_vec())]);
+    let piece = found.pieces.piece_of(found.op.start);
+    let (Some(&(slot, original)), Some(bytes)) = (found.refs.get(piece), edited.get(piece)) else { return Ok(false) };
+    // Where the operator sits in that piece: the joined offset less the pieces before it.
+    let before: usize = (0..piece).filter_map(|i| edited.get(i)).map(|p| p.len() + 1).sum();
+    let at = found.op.start.saturating_sub(before);
+    let len = found.op.end.saturating_sub(found.op.start);
+    let mut note = Dict::new();
+    note.set(b"Original".to_vec(), Object::Ref(original));
+    note.set(b"At".to_vec(), Object::Int(i64::try_from(at).unwrap_or(i64::MAX)));
+    note.set(b"Len".to_vec(), Object::Int(i64::try_from(len).unwrap_or(i64::MAX)));
+    let mut dict = Dict::new();
+    dict.set(b"PCBackdrop".to_vec(), Object::Dict(note));
+    let copy = doc.add(Object::Stream(Stream::flate(dict, bytes)));
+    let p = page_of(doc, page)?;
+    let mut list = crate::contents(doc, &p)?;
+    let Some(entry) = list.get_mut(slot) else { return Ok(false) };
+    *entry = Object::Ref(copy);
+    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+    Ok(true)
+}
+
+/// Put back the original content streams [`replace`] copied on `page`, where the copy is still
+/// exactly what it wrote. Returns how many it restored.
+pub(crate) fn restore(doc: &mut Document, page: &pdfcraft_model::Page) -> Result<usize, EditError> {
+    let mut list = crate::contents(doc, page)?;
+    let mut restored = 0;
+    for entry in list.iter_mut() {
+        if let Some(original) = unchanged_copy_of(doc, entry) {
+            *entry = Object::Ref(original);
+            restored += 1;
+        }
+    }
+    if restored > 0 {
+        doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+    }
+    Ok(restored)
+}
+
+/// The original of a backdrop copy whose bytes are still the original's with the fill turned to
+/// `n`; `None` for anything else (including a copy edited since, which is kept).
+fn unchanged_copy_of(doc: &Document, entry: &Object) -> Option<ObjRef> {
+    let copy = doc.resolve(entry);
+    let Object::Stream(copy) = &*copy else { return None };
+    let note = copy.dict.get(b"PCBackdrop").map(|n| doc.resolve(n))?;
+    let note = note.as_dict()?;
+    let Some(Object::Ref(original)) = note.get(b"Original") else { return None };
+    let at = usize::try_from(note.get(b"At")?.as_int()?).ok()?;
+    let len = usize::try_from(note.get(b"Len")?.as_int()?).ok()?;
+    let orig = doc.get(*original);
+    let Object::Stream(orig) = &*orig else { return None };
+    let source = orig.decoded().ok()?;
+    let mut expect = source.get(..at)?.to_vec();
+    expect.push(b'n');
+    expect.extend_from_slice(source.get(at.checked_add(len)?..)?);
+    (copy.decoded().ok()? == expect).then_some(*original)
+}
+
+fn page_of(doc: &Document, page: usize) -> Result<pdfcraft_model::Page, EditError> {
+    pdfcraft_model::pages(doc).into_iter().nth(page).ok_or(EditError::NoSuchPage(page))
+}
+
+/// Find the backdrop, and for a fill, where it is.
+fn scan(doc: &Document, page: usize) -> Result<Option<(Backdrop, Option<Found>)>, EditError> {
+    let p = page_of(doc, page)?;
+    let crop = p.crop(doc);
+    let list: Vec<Object> = match p.dict.get(b"Contents") {
+        None => return Ok(None),
+        Some(c) => match &*doc.resolve(c) {
+            Object::Array(a) => a.clone(),
+            _ => vec![c.clone()],
+        },
+    };
+    // The page's own content: untagged streams (marks and the q/Q wrapper carry /PCMark). Read
+    // only as far as a backdrop could be.
+    let mut refs = Vec::new();
+    let mut data = Vec::new();
+    let mut total = 0usize;
+    for (slot, o) in list.iter().enumerate() {
+        if total >= SCAN_BYTES {
+            break;
+        }
+        let Object::Ref(r) = o else { return Ok(None) };
+        let obj = doc.get(*r);
+        let Object::Stream(s) = &*obj else { continue };
+        if s.dict.get(b"PCMark").is_some() {
+            continue;
+        }
+        let bytes = s.decoded().unwrap_or_default();
+        total = total.saturating_add(bytes.len()).saturating_add(1);
+        refs.push((slot, *r));
+        data.push(bytes);
+    }
+    let pieces = Pieces::join(&data);
+    let head = pieces.data().get(..pieces.data().len().min(SCAN_BYTES)).unwrap_or_default();
+    let parsed = pdfcraft_content::parse(head);
+    let res = resources(doc, &p.dict);
+    let found = walk(doc, &res, crop, &parsed.ops);
+    Ok(found.map(|(b, op)| match (b, op) {
+        (Backdrop::Fill, Some(op)) => (b, Some(Found { refs, pieces, op })),
+        _ => (b, None),
+    }))
+}
+
+fn resources(doc: &Document, page: &Dict) -> Dict {
+    page.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default()
+}
+
+fn sub(doc: &Document, res: &Dict, kind: &[u8], name: &[u8]) -> Option<std::sync::Arc<Object>> {
+    let d = res.get(kind).map(|d| doc.resolve(d))?;
+    let o = d.as_dict()?.get(name)?.clone();
+    Some(doc.resolve(&o))
+}
+
+/// Walk the operators until the first one that paints; a backdrop is that one, or nothing.
+fn walk(doc: &Document, res: &Dict, crop: [f64; 4], ops: &[Op]) -> Option<(Backdrop, Option<std::ops::Range<usize>>)> {
+    let mut st = State { ctm: Matrix::IDENTITY, clip: Some([f64::MIN, f64::MIN, f64::MAX, f64::MAX]), white: false, space: 1, opaque: true };
+    let mut saved: Vec<State> = Vec::new();
+    // Current path: its rectangles in user space, or `None` once it is anything else.
+    let mut path: Option<Vec<[f64; 4]>> = Some(Vec::new());
+    let mut clip_next = false;
+    for op in ops.iter().take(SCAN_OPS) {
+        match op.op.as_slice() {
+            b"q" => {
+                if saved.len() >= 64 {
+                    return None;
+                }
+                saved.push(st.clone());
+            }
+            b"Q" => st = saved.pop()?,
+            b"cm" => {
+                let m = Matrix::from_operands(op.operands.get(op.operands.len().checked_sub(6)?..)?)?;
+                if !m.0.iter().all(|v| v.is_finite()) {
+                    return None;
+                }
+                st.ctm = m.then(&st.ctm);
+            }
+            b"gs" => st.opaque = opaque_state(doc, res, op.name(0)?)?,
+            b"g" => set_colour(&mut st, 1, op),
+            b"rg" => set_colour(&mut st, 3, op),
+            b"k" => set_colour(&mut st, 4, op),
+            b"cs" => {
+                st.space = match op.name(0)? {
+                    b"DeviceGray" => 1,
+                    b"DeviceRGB" => 3,
+                    b"DeviceCMYK" => 4,
+                    _ => 0,
+                };
+                // The initial colour of these spaces is black.
+                st.white = false;
+            }
+            b"sc" | b"scn" => {
+                let n = st.space;
+                set_colour(&mut st, n, op)
+            }
+            b"re" => {
+                let [x, y, w, h] = op.nums::<4>()?;
+                let finite = [x, y, w, h].iter().all(|v| v.is_finite());
+                match (&mut path, finite && axis_aligned(&st.ctm)) {
+                    (Some(rects), true) => rects.push(st.ctm.bbox([x.min(x + w), y.min(y + h), x.max(x + w), y.max(y + h)])),
+                    _ => path = None,
+                }
+            }
+            b"m" | b"l" | b"c" | b"v" | b"y" | b"h" => path = None,
+            b"W" | b"W*" => clip_next = true,
+            b"n" => {
+                if clip_next {
+                    st.clip = clipped(st.clip, path.as_deref());
+                }
+                path = Some(Vec::new());
+                clip_next = false;
+            }
+            b"f" | b"F" | b"f*" => {
+                // One rectangle: with two, a fill rule can cut a hole where content shows.
+                let covers = match path.as_deref() {
+                    Some([r]) => st.clip.and_then(|c| intersect(*r, c)).is_some_and(|r| pdfcraft_content::contains(r, crop, COVER_EPS)),
+                    _ => false,
+                };
+                return (covers && st.white && st.opaque && !clip_next).then(|| (Backdrop::Fill, Some(op.span.clone())));
+            }
+            b"Do" => {
+                let xo = sub(doc, res, b"XObject", op.name(0)?)?;
+                let Object::Stream(s) = &*xo else { return None };
+                // A stencil or masked picture lets what is behind it show.
+                let masked = [&b"SMask"[..], b"Mask"].iter().any(|k| s.dict.get(k).is_some())
+                    || s.dict.get(b"ImageMask").is_some_and(|m| matches!(*doc.resolve(m), Object::Bool(true)));
+                let image = s.dict.name(b"Subtype") == Some(b"Image") && !masked;
+                return covers_unit_square(&st, crop, image).then_some((Backdrop::Image, None));
+            }
+            b"BI" => {
+                let masked = op
+                    .inline
+                    .as_ref()
+                    .is_some_and(|(d, _)| [&b"IM"[..], b"ImageMask"].iter().any(|k| d.get(k).is_some_and(|m| matches!(m, Object::Bool(true)))));
+                return covers_unit_square(&st, crop, !masked).then_some((Backdrop::Image, None));
+            }
+            // Anything else that paints comes first: no backdrop.
+            b"S" | b"s" | b"B" | b"B*" | b"b" | b"b*" | b"sh" | b"Tj" | b"TJ" | b"'" | b"\"" | b"EI" | b"d0" | b"d1" => return None,
+            _ => {}
+        }
+    }
+    None
+}
+
+/// A picture placed by the CTM (onto the unit square) covering the crop box, opaque, unclipped.
+fn covers_unit_square(st: &State, crop: [f64; 4], image: bool) -> bool {
+    image
+        && st.opaque
+        && axis_aligned(&st.ctm)
+        && st.clip.and_then(|c| intersect(st.ctm.bbox([0.0, 0.0, 1.0, 1.0]), c)).is_some_and(|r| pdfcraft_content::contains(r, crop, COVER_EPS))
+}
+
+fn set_colour(st: &mut State, components: usize, op: &Op) {
+    st.space = components;
+    let vals: Vec<f64> = op.operands.iter().filter_map(Object::as_f64).collect();
+    st.white = vals.len() == components
+        && match components {
+            1 | 3 => vals.iter().all(|v| *v >= WHITE),
+            4 => vals.iter().all(|v| *v <= 1.0 - WHITE),
+            _ => false,
+        };
+}
+
+/// Does the named ExtGState keep painting opaque and normal? `None` when it can't be read.
+fn opaque_state(doc: &Document, res: &Dict, name: &[u8]) -> Option<bool> {
+    let gs = sub(doc, res, b"ExtGState", name)?;
+    let gs = gs.as_dict()?;
+    let alpha = gs.get(b"ca").map(|a| doc.resolve(a).as_f64()).unwrap_or(Some(1.0))?;
+    let soft = gs.get(b"SMask").is_some_and(|m| doc.resolve(m).as_name() != Some(b"None"));
+    let blend = gs.get(b"BM").is_some_and(|b| !matches!(doc.resolve(b).as_name(), Some(b"Normal" | b"Compatible")));
+    Some(alpha >= 0.999 && !soft && !blend)
+}
+
+/// Rotations by multiples of 90° and scales only: rectangles stay rectangles.
+fn axis_aligned(m: &Matrix) -> bool {
+    let [a, b, c, d, ..] = m.0;
+    (b.abs() < 1e-9 && c.abs() < 1e-9) || (a.abs() < 1e-9 && d.abs() < 1e-9)
+}
+
+fn intersect(a: [f64; 4], b: [f64; 4]) -> Option<[f64; 4]> {
+    let r = [a[0].max(b[0]), a[1].max(b[1]), a[2].min(b[2]), a[3].min(b[3])];
+    (r.iter().all(|v| v.is_finite()) && r[2] > r[0] && r[3] > r[1]).then_some(r)
+}
+
+/// The clip after intersecting with a path: known only when the path is one rectangle.
+fn clipped(clip: Option<[f64; 4]>, path: Option<&[[f64; 4]]>) -> Option<[f64; 4]> {
+    match path {
+        Some([r]) => intersect(clip?, *r).or(Some([0.0, 0.0, 0.0, 0.0])),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+#[path = "backdrop_tests.rs"]
+mod tests;
diff --git a/crates/edit/src/backdrop_tests.rs b/crates/edit/src/backdrop_tests.rs
new file mode 100644
index 0000000000..88f058b4f5
--- /dev/null
+++ b/crates/edit/src/backdrop_tests.rs
@@ -0,0 +1,233 @@
+use std::sync::Arc;
+
+use pdfcraft_cos::{Document, ObjRef, Object, SaveOptions, Stream, write_incremental};
+
+use super::*;
+use crate::{Background, MarkKind, add_background, remove_marks};
+
+const TEXT: &str = "BT /F1 24 Tf 40 90 Td (Hello) Tj ET";
+
+/// A document from its objects (object 1 is the catalog, 2 the page tree).
+fn build(objs: &[String]) -> Document {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+fn stream(dict: &str, data: &str) -> String {
+    format!("<< {dict} /Length {} >>\nstream\n{data}\nendstream", data.len())
+}
+
+/// One 300 × 200 page drawing `pieces` (objects 5…), with a font, a page-sized image `/Im0`
+/// (object 4) and two graphics states, `/Half` (ca 0.5) and `/Full` (ca 1).
+fn page(pieces: &[&str]) -> Document {
+    let refs: Vec<String> = (0..pieces.len()).map(|i| format!("{} 0 R", i + 5)).collect();
+    let mut objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        format!(
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents [{}] /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> /XObject << /Im0 4 0 R >> /ExtGState << /Half << /ca 0.5 >> /Full << /ca 1 /CA 1 >> >> >> >>",
+            refs.join(" ")
+        ),
+        stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", "\u{80}"),
+    ];
+    objs.extend(pieces.iter().map(|p| stream("", p)));
+    build(&objs)
+}
+
+/// The decoded content of a page, stream by stream.
+fn streams(doc: &Document) -> Vec<String> {
+    let p = &pdfcraft_model::pages(doc)[0];
+    let list = match p.dict.get(b"Contents").map(|c| doc.resolve(c)).as_deref() {
+        Some(Object::Array(a)) => a.clone(),
+        _ => vec![],
+    };
+    list.iter()
+        .map(|o| match &*doc.resolve(o) {
+            Object::Stream(s) => String::from_utf8_lossy(&s.decoded().unwrap()).into_owned(),
+            _ => String::new(),
+        })
+        .collect()
+}
+
+fn reopen(doc: &Document) -> Document {
+    let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
+    Document::open(Arc::new(bytes)).unwrap()
+}
+
+fn red() -> Background {
+    Background { color: [1.0, 0.0, 0.0], ..Background::default() }
+}
+
+#[test]
+fn a_white_fill_backdrop_is_replaced_and_put_back_when_the_background_goes() {
+    let content = format!("q 1 1 1 rg 0 0 300 200 re f Q {TEXT}");
+    let mut doc = page(&[&content]);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Fill));
+    let original = streams(&doc);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    let s = streams(&reopen(&doc));
+    assert_eq!(s.len(), 2, "{s:?}");
+    assert!(s[0].contains("/PCMark /Background"));
+    assert_eq!(s[1], format!("q 1 1 1 rg 0 0 300 200 re n Q {TEXT}"), "only the fill operator changed");
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), None, "nothing hides the background now");
+    // The original stream object is untouched; the page points at a copy.
+    let Object::Stream(orig) = &*doc.get(ObjRef { num: 5, generation: 0 }) else { panic!("object 5 is the content") };
+    assert_eq!(String::from_utf8_lossy(&orig.decoded().unwrap()), content);
+    assert_eq!(remove_marks(&mut doc, &[0], MarkKind::Background).unwrap(), 1);
+    assert_eq!(streams(&reopen(&doc)), original, "exactly the original content");
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Fill));
+}
+
+#[test]
+fn updating_the_background_replaces_the_backdrop_once_and_removing_still_restores() {
+    let mut doc = page(&[&format!("1 1 1 rg 0 0 300 200 re f 0 g {TEXT}")]);
+    let original = streams(&doc);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    add_background(&mut doc, &[0], &Background { color: [0.0, 0.0, 1.0], ..Background::default() }, true).unwrap();
+    let s = streams(&doc);
+    assert_eq!(s.len(), 2, "one background, one copy: {s:?}");
+    assert!(s[1].contains("re n"));
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&doc), original);
+}
+
+#[test]
+fn a_backdrop_split_across_content_streams_is_replaced_in_the_piece_holding_the_operator() {
+    let mut doc = page(&["1 1 1 rg 0 0 300 200 re", &format!("f* {TEXT}")]);
+    let original = streams(&doc);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Fill));
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    let s = streams(&doc);
+    assert_eq!(s[1..], ["1 1 1 rg 0 0 300 200 re".to_string(), format!("n {TEXT}")], "{s:?}");
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&doc), original);
+}
+
+#[test]
+fn backdrops_writers_paint_are_recognised() {
+    for content in [
+        // Browsers: a flipped, scaled coordinate system and a page clip first.
+        "q 0.5 0 0 -0.5 0 200 cm 0 0 600 400 re W n 1 1 1 rg 0 0 600 400 re f Q",
+        // Larger than the page, in CMYK, through an opaque graphics state.
+        "/Full gs 0 0 0 0 k -10 -10 320 220 re f",
+        "/DeviceRGB cs 1 1 1 sc 0 0 300 200 re F",
+        "0.99 g 0 0 300 200 re f",
+        // Turned a quarter: still a rectangle.
+        "0 1 -1 0 300 0 cm 1 g 0 0 200 300 re f",
+    ] {
+        let doc = page(&[&format!("{content} 0 g {TEXT}")]);
+        assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Fill), "{content}");
+    }
+}
+
+#[test]
+fn content_that_is_not_a_page_backdrop_is_left_alone() {
+    for content in [
+        // Not the whole page.
+        "1 g 0 0 300 150 re f",
+        "q 0 0 100 100 re W n 1 g 0 0 300 200 re f Q",
+        // Not white, or not opaque.
+        "0.5 g 0 0 300 200 re f",
+        "1 0 0 rg 0 0 300 200 re f",
+        "0 0 0 0.5 k 0 0 300 200 re f",
+        "/Half gs 1 g 0 0 300 200 re f",
+        "/Missing gs 1 g 0 0 300 200 re f",
+        "/Pattern cs /P0 scn 0 0 300 200 re f",
+        // The initial colour is black.
+        "0 0 300 200 re f",
+        // Something else is painted first.
+        "BT /F1 9 Tf (x) Tj ET 1 g 0 0 300 200 re f",
+        "0 g 0 0 1 1 re f 1 g 0 0 300 200 re f",
+        "1 g 0 0 300 200 re S 1 g 0 0 300 200 re f",
+        // Not a single rectangle: a hole, a turned square, a fill-and-stroke.
+        "1 g 0 0 300 200 re 50 50 10 10 re f*",
+        "1 g 0 0 m 300 0 l 300 200 l 0 200 l h f",
+        "0.7 0.7 -0.7 0.7 150 -100 cm 1 g 0 0 400 400 re f",
+        "1 g 0 0 300 200 re B",
+        // Malformed.
+        "Q 1 g 0 0 300 200 re f",
+        "1 g 0 0 300 re f",
+        "1 g 0 0 1e400 200 re f",
+    ] {
+        let mut doc = page(&[&format!("{content} {TEXT}")]);
+        assert_eq!(page_backdrop(&doc, 0).unwrap(), None, "{content}");
+        let before = streams(&doc);
+        add_background(&mut doc, &[0], &red(), false).unwrap();
+        assert_eq!(streams(&doc)[1..], before[..], "{content}: the page's content is unchanged");
+    }
+}
+
+#[test]
+fn a_scanned_page_is_reported_and_its_picture_kept() {
+    let mut doc = page(&[&format!("q 300 0 0 200 0 0 cm /Im0 Do Q {TEXT}")]);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Image));
+    let before = streams(&doc);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    assert_eq!(streams(&doc)[1..], before[..]);
+    // A small picture is content, not a backdrop.
+    let doc = page(&["q 30 0 0 20 0 0 cm /Im0 Do Q"]);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), None);
+}
+
+#[test]
+fn replacing_can_be_turned_off() {
+    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+    let before = streams(&doc);
+    add_background(&mut doc, &[0], &Background { replace_backdrop: false, ..red() }, false).unwrap();
+    assert_eq!(streams(&doc)[1..], before[..]);
+}
+
+#[test]
+fn a_backdrop_copy_edited_since_is_kept_when_the_background_goes() {
+    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    // Something else rewrites the copy (as Edit text does), keeping its dictionary.
+    let p = &pdfcraft_model::pages(&doc)[0];
+    let Some(Object::Array(list)) = p.dict.get(b"Contents").cloned() else { panic!("contents") };
+    let Object::Ref(copy) = list[1] else { panic!("a reference") };
+    let Object::Stream(s) = (*doc.get(copy)).clone() else { panic!("a stream") };
+    let edited = "1 g 0 0 300 200 re n BT /F1 24 Tf 40 90 Td (Edited) Tj ET";
+    doc.set(copy, Object::Stream(Stream::flate(s.dict.clone(), edited.as_bytes())));
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&doc), [edited.to_string()], "the edit survives");
+}
+
+#[test]
+fn a_content_stream_shared_by_two_pages_is_copied_for_the_one_page() {
+    let content = format!("1 g 0 0 300 200 re f {TEXT}");
+    let mut doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents 5 0 R >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents 5 0 R >>".into(),
+        stream("", &content),
+    ]);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), None);
+    assert_eq!(page_backdrop(&doc, 1).unwrap(), Some(Backdrop::Fill), "the other page keeps its backdrop");
+}
+
+#[test]
+fn pages_without_content_or_with_odd_contents_have_no_backdrop() {
+    let doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents [5 0 R 99 0 R] >>".into(),
+        "<< /Not /AStream >>".into(),
+    ]);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), None);
+    assert_eq!(page_backdrop(&doc, 1).unwrap(), None);
+    assert!(matches!(page_backdrop(&doc, 7), Err(EditError::NoSuchPage(7))));
+}
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 515f17d8da..a8ab1d51b5 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -150,11 +150,16 @@ pub struct Background {
     pub source: Option<MarkSource>,
     /// Pictures: size relative to the page (1.0 fits the page).
     pub scale: f64,
+    /// Replace a white backdrop the page paints itself, which would hide the background
+    /// ([`backdrop`]). Removing the background puts it back.
+    pub replace_backdrop: bool,
 }
 
 impl Default for Background {
+    /// A light yellow that still reads as a colour on screen (a near-white default looked as if
+    /// nothing had happened).
     fn default() -> Self {
-        Self { color: [1.0, 1.0, 0.85], opacity: 1.0, source: None, scale: 1.0 }
+        Self { color: [1.0, 0.95, 0.7], opacity: 1.0, source: None, scale: 1.0, replace_backdrop: true }
     }
 }
 
@@ -583,7 +588,9 @@ pub fn add_watermark(doc: &mut Document, pages: &[usize], wm: &Watermark, replac
     Ok(())
 }
 
-/// Add a solid-colour background behind the content of `pages`.
+/// Add a solid-colour background behind the content of `pages`. With `bg.replace_backdrop`, a
+/// white backdrop a page paints itself is replaced first, so the background shows (see
+/// [`backdrop`]); a picture backdrop (a scan) still hides it.
 pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, replace: bool) -> Result<(), EditError> {
     let all = page_list(doc);
     check(pages, all.len())?;
@@ -592,6 +599,9 @@ pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, repl
     }
     let opacity = if bg.opacity.is_finite() { bg.opacity.clamp(0.0, 1.0) } else { 1.0 };
     for &i in pages {
+        if bg.replace_backdrop {
+            backdrop::replace(doc, i)?;
+        }
         let page = page_list(doc)[i].clone();
         let (w, h) = page.display_size(doc);
         let mut content = begin(MarkKind::Background, "Background", page.view_matrix(doc));
@@ -614,13 +624,17 @@ pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, repl
 }
 
 /// Remove marks of `kind` from `pages`; returns how many were removed. When no mark is left on
-/// top of a page, the q/Q wrapper goes too, restoring the original content list.
+/// top of a page, the q/Q wrapper goes too, restoring the original content list. Removing
+/// backgrounds also puts back a backdrop [`add_background`] replaced, unless it was edited since.
 pub fn remove_marks(doc: &mut Document, pages: &[usize], kind: MarkKind) -> Result<usize, EditError> {
     let all = page_list(doc);
     check(pages, all.len())?;
     let mut removed = 0;
     for &i in pages {
         let page = &all[i];
+        if kind == MarkKind::Background {
+            backdrop::restore(doc, page)?;
+        }
         let list = contents(doc, page)?;
         let before = list.len();
         let mut kept: Vec<Object> = list.into_iter().filter(|o| stream_tag(doc, o).as_deref() != Some(kind.tag())).collect();
@@ -644,6 +658,8 @@ pub fn marks_present(doc: &Document) -> Vec<MarkKind> {
     added::scan_markers(doc).marks
 }
 
+pub mod backdrop;
+pub use backdrop::{Backdrop, page_backdrop};
 pub mod objects;
 pub use objects::{EditableObject, MAX_MOVE_OBJECTS, ObjectKind, ObjectTarget, editable_objects, move_objects};
 
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 3432cd868e..0f81fb22de 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -63,7 +63,7 @@ pub use pdfcraft_forms::{
 };
 
 pub use pdfcraft_a11y as a11y;
-pub use pdfcraft_edit::{BlockStyle, PageImage, RangeStyle, TextBlock, TextLine, first_undrawable};
+pub use pdfcraft_edit::{Backdrop, BlockStyle, PageImage, RangeStyle, TextBlock, TextLine, first_undrawable};
 pub use pdfcraft_measure as measure;
 pub use pdfcraft_xfa::Report as XfaLayout;
 
@@ -499,6 +499,11 @@ impl Document {
         self.editor.as_ref().map(|e| optimize::audit_space(&e.cos, self.bytes.len() as u64)).unwrap_or_default()
     }
 
+    /// The backdrop `page` (0-based) paints itself, which hides a background (Add Background).
+    pub fn page_backdrop(&self, page: usize) -> Option<pdfcraft_edit::Backdrop> {
+        self.editor.as_ref().and_then(|e| pdfcraft_edit::page_backdrop(&e.cos, page).ok().flatten())
+    }
+
     /// Edit a PDF: the images `page` draws (0-based).
     pub fn page_images(&self, page: usize) -> Vec<pdfcraft_edit::PageImage> {
         self.editor.as_ref().and_then(|e| pdfcraft_edit::page_images(&e.cos, page).ok()).unwrap_or_default()
diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index 4a60c40a6e..ed2490737c 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -3,7 +3,7 @@
 //! preview of the current page. "Update" opens the same dialog in replace mode.
 
 use egui::{Align, Color32, CornerRadius, Layout, Rect, Stroke, pos2, vec2};
-use pdfcraft_engine::{Background, Edit, HeaderFooter, MarkKind, Watermark};
+use pdfcraft_engine::{Backdrop, Background, DocId, Edit, HeaderFooter, MarkKind, Watermark};
 
 use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, widgets};
@@ -72,6 +72,63 @@ impl PageRange {
     }
 }
 
+/// How many pages a frame the Background dialog checks for a backdrop of their own, so a long
+/// document never stalls the dialog.
+const BACKDROP_PAGES_PER_FRAME: usize = 24;
+
+/// Which pages paint their own backdrop (it hides a background), for the document and edit
+/// generation they were checked in. Filled a few pages a frame.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct BackdropCheck {
+    key: Option<(DocId, u64)>,
+    /// Per page: `None` until checked.
+    pages: Vec<Option<Option<Backdrop>>>,
+}
+
+/// What the check found among the pages a background goes on.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct BackdropCount {
+    /// Pages with a white backdrop that can be replaced.
+    pub fills: usize,
+    /// Pages covered by a picture (scans): the background stays hidden there.
+    pub images: usize,
+    /// Pages not checked yet.
+    pub pending: usize,
+}
+
+impl BackdropCheck {
+    /// Check up to [`BACKDROP_PAGES_PER_FRAME`] more of `pages` (0-based) and count them.
+    pub fn update(&mut self, doc: &pdfcraft_engine::Document, pages: &[usize]) -> BackdropCount {
+        let key = (doc.id, doc.edit_generation());
+        let count = doc.info.pages.len();
+        if self.key != Some(key) || self.pages.len() != count {
+            self.key = Some(key);
+            self.pages = vec![None; count];
+        }
+        let mut budget = BACKDROP_PAGES_PER_FRAME;
+        let mut n = BackdropCount::default();
+        for &p in pages {
+            let Some(slot) = self.pages.get_mut(p) else { continue };
+            if slot.is_none() && budget > 0 {
+                *slot = Some(doc.page_backdrop(p));
+                budget -= 1;
+            }
+            match slot {
+                None => n.pending += 1,
+                Some(Some(Backdrop::Fill)) => n.fills += 1,
+                Some(Some(Backdrop::Image)) => n.images += 1,
+                Some(None) => {}
+            }
+        }
+        n
+    }
+}
+
+/// "1 page" or "{n} pages", in a message.
+fn pages_phrase(n: usize, one: &str, many: &str) -> String {
+    if n == 1 { one.to_string() } else { crate::i18n::fmt(many, &[("n", &n.to_string())]) }
+}
+
 #[derive(Clone, Debug, PartialEq)]
 pub struct MarksDraft {
     pub hf: HeaderFooter,
@@ -90,6 +147,8 @@ pub struct MarksDraft {
     pub use_file: bool,
     pub file: Option<(String, std::sync::Arc<Vec<u8>>)>,
     pub file_page: usize,
+    /// Background: pages that paint their own backdrop.
+    pub backdrops: BackdropCheck,
 }
 
 impl Default for MarksDraft {
@@ -107,6 +166,7 @@ impl Default for MarksDraft {
             use_file: false,
             file: None,
             file_page: 1,
+            backdrops: BackdropCheck::default(),
         }
     }
 }
@@ -299,6 +359,9 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
                     d.bg.opacity = pct / 100.0;
                 }
             });
+            if let Some(doc) = app.session.get(id) {
+                backdrop_options(ui, t, d, doc, count);
+            }
         }
     }
     ui.add_space(8.0);
@@ -364,6 +427,13 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
             }
             MarkKind::Background => {
                 p.rect_filled(r, CornerRadius::ZERO, rgb32(bg.color).gamma_multiply(bg.opacity as f32));
+                // Schematic lines of text on top: the colour goes behind the content.
+                let (gap, inset) = (r.height() / 9.0, r.width() * 0.12);
+                for k in 1..8 {
+                    let y = r.top() + gap * k as f32;
+                    let end = if k % 3 == 0 { r.center().x } else { r.right() - inset };
+                    p.line_segment([pos2(r.left() + inset, y), pos2(end, y)], Stroke::new((gap * 0.3).clamp(1.0, 3.0), Color32::from_gray(90)));
+                }
             }
         });
         ui.vertical(|ui| {
@@ -477,6 +547,35 @@ fn file_source(ui: &mut egui::Ui, d: &mut MarksDraft, kind: MarkKind) -> bool {
     browse
 }
 
+/// Pages that paint their own backdrop would hide the background: offer to replace a white one,
+/// and say where a picture (a scan) will still hide it.
+fn backdrop_options(ui: &mut egui::Ui, t: &Tokens, d: &mut MarksDraft, doc: &pdfcraft_engine::Document, count: usize) {
+    let n = d.backdrops.update(doc, &d.range.pages(count));
+    if n.pending > 0 {
+        ui.label(egui::RichText::new(tl!("Checking pages…")).small().color(t.text_faint));
+        ui.ctx().request_repaint();
+    }
+    if n.fills > 0 {
+        ui.add_space(4.0);
+        let label = pages_phrase(
+            n.fills,
+            tl!("This page paints its own white backdrop, which would hide the background. Replace it"),
+            tl!("{n} pages paint their own white backdrop, which would hide the background. Replace it"),
+        );
+        ui.add(widgets::checkbox(&mut d.bg.replace_backdrop, &label));
+        ui.label(egui::RichText::new(tl!("Removing the background puts the page's own backdrop back.")).small().color(t.text_faint));
+    }
+    if n.images > 0 {
+        ui.add_space(4.0);
+        let text = pages_phrase(
+            n.images,
+            tl!("A picture covers this page (a scan?), so the background won't show there."),
+            tl!("A picture covers {n} pages (scans?), so the background won't show there."),
+        );
+        ui.label(egui::RichText::new(text).small().color(crate::content_ui::UNDRAWABLE));
+    }
+}
+
 /// The edit the dialog's OK makes.
 pub fn edit(d: &MarksDraft, kind: MarkKind, count: usize) -> Edit {
     let pages = d.range.pages(count);
diff --git a/crates/ui-egui/tests/ui_group/marks.rs b/crates/ui-egui/tests/ui_group/marks.rs
index 0a0e45b152..3a9864ea47 100644
--- a/crates/ui-egui/tests/ui_group/marks.rs
+++ b/crates/ui-egui/tests/ui_group/marks.rs
@@ -96,3 +96,70 @@ fn backgrounds_and_watermarks_from_a_file() {
     let s = h.state();
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), Some("Add background"));
 }
+
+/// Three pages: a white backdrop of its own (as browsers write), a page-sized picture (a scan)
+/// and bare paper.
+fn backdrop_fixture() -> Vec<u8> {
+    let stream = |data: &str| format!("<< /Length {} >> stream\n{data}\nendstream", data.len());
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R 5 0 R] /Count 3 /MediaBox [0 0 300 400] /Resources << /XObject << /Im0 9 0 R >> >> >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents 6 0 R >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents 7 0 R >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents 8 0 R >>".into(),
+        stream("q 1 1 1 rg 0 0 300 400 re f Q 0 g 20 20 50 50 re f"),
+        stream("q 300 0 0 400 0 0 cm /Im0 Do Q"),
+        stream("0 g 20 20 50 50 re f"),
+        "<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 1 >> stream\n\u{80}\nendstream"
+            .into(),
+    ];
+    let mut out = String::from("%PDF-1.7\n");
+    for (i, o) in objs.iter().enumerate() {
+        out.push_str(&format!("{} 0 obj {o} endobj\n", i + 1));
+    }
+    out.push_str("trailer << /Root 1 0 R >>\n%%EOF");
+    out.into_bytes()
+}
+
+#[test]
+fn the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scans() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, backdrop_fixture()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    let backdrop = |h: &Harness<'static, PdfCraftApp>, page| {
+        let s = h.state();
+        s.session.get(s.views[0].id).unwrap().page_backdrop(page)
+    };
+    assert_eq!(backdrop(&h, 0), Some(pdfcraft_engine::Backdrop::Fill));
+    h.state_mut().execute("edit.background");
+    h.run_steps(3);
+    let replace = "This page paints its own white backdrop, which would hide the background. Replace it";
+    h.get_by_label("A picture covers this page (a scan?), so the background won't show there.");
+    assert!(h.state().marks_draft.bg.replace_backdrop, "on by default");
+    // Left unticked, the backdrop stays and still hides the background.
+    h.get_by_label(replace).click();
+    h.run_steps(2);
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert_eq!(backdrop(&h, 0), Some(pdfcraft_engine::Backdrop::Fill));
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(2);
+    // Ticked, it is replaced; the scan is reported, not touched.
+    h.state_mut().execute("edit.background");
+    h.run_steps(3);
+    h.get_by_label(replace).click();
+    h.run_steps(2);
+    assert!(h.state().marks_draft.bg.replace_backdrop);
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert_eq!(backdrop(&h, 0), None);
+    assert_eq!(backdrop(&h, 1), Some(pdfcraft_engine::Backdrop::Image));
+    // Nothing left to replace: the offer is gone.
+    h.state_mut().execute("edit.background.update");
+    h.run_steps(3);
+    assert!(h.query_by_label(replace).is_none());
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index c3d319f94f..e6b3dee939 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2495,9 +2495,9 @@ tier = "P0"
 milestone = "M7"
 status = "shipped"
 commands = ["edit.background"]
-tools = ["doc_background"]
-evidence = ["crates/ui-egui/tests/ui_group/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/ui_group/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright"]
-notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page"
+tools = ["doc_background", "doc_backdrops"]
+evidence = ["crates/ui-egui/tests/ui_group/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/ui_group/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright", "crates/automation/tests/backdrop.rs::a_background_shows_on_a_page_that_paints_its_own_white_backdrop", "crates/ui-egui/tests/ui_group/marks.rs::the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scans", "crates/edit/src/backdrop_tests.rs::content_that_is_not_a_page_backdrop_is_left_alone"]
+notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove puts it back unless the content was edited since). Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space; the dialog preview is a schematic, not the page"
 
 [[feature]]
 id = "edit.background-update-remove"
@@ -2508,8 +2508,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.background.update", "edit.background.remove"]
 tools = ["doc_background", "doc_remove_marks"]
-evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove"]
-notes = ""
+evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/edit/src/backdrop_tests.rs::a_white_fill_backdrop_is_replaced_and_put_back_when_the_background_goes", "crates/edit/src/backdrop_tests.rs::a_backdrop_copy_edited_since_is_kept_when_the_background_goes"]
+notes = "Remove also restores a page backdrop Add replaced"
 
 [[feature]]
 id = "edit.decoration-profiles"

From b5d34d439f9ef1f2393c5102fe24edd88a1afda8 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Fri, 16 Oct 2026 11:14:10 +0200
Subject: [PATCH 013/270] fix(ui): translate the Add Background backdrop
 messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The six new dialog strings (the backdrop offer, its note, the scan
warning and "Checking pages…") were missing from every catalogue, which
the *_covers_ui_literals tests require. Languages with several plural
forms use the "label: {n}" pattern so any count reads correctly.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/i18n/ar.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/bg.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/cs.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/de.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/el.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/es.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/fr.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/hu.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/it.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/ja.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/kk.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/lt.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/pl.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/pt-br.tsv   | 6 ++++++
 crates/ui-egui/src/i18n/ru.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/sl.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/te.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/tr.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/uk.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/vi.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/zh-hans.tsv | 6 ++++++
 crates/ui-egui/src/i18n/zh-hant.tsv | 6 ++++++
 22 files changed, 132 insertions(+)

diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 5a0e6e9c96..abea3aae73 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -822,6 +822,12 @@
 	Applies to 1 page	يُطبَّق على صفحة واحدة
 	Applies to {n} pages	يُطبَّق على {n} صفحات
 	Replaces the existing one on those pages.	يستبدل الموجود على تلك الصفحات.
+	Checking pages…	جارٍ فحص الصفحات…
+	This page paints its own white backdrop, which would hide the background. Replace it	ترسم هذه الصفحة تعبئة بيضاء خاصة بها ستُخفي الخلفية. استبدالها
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	عدد الصفحات التي ترسم تعبئة بيضاء خاصة بها ستُخفي الخلفية: {n}. استبدالها
+	Removing the background puts the page's own backdrop back.	إزالة الخلفية تعيد التعبئة البيضاء الخاصة بالصفحة.
+	A picture covers this page (a scan?), so the background won't show there.	تغطي صورة هذه الصفحة (مسح ضوئي؟)، لذا لن تظهر الخلفية فيها.
+	A picture covers {n} pages (scans?), so the background won't show there.	عدد الصفحات التي تغطيها صور (مسح ضوئي؟): {n}؛ لن تظهر الخلفية فيها.
 	PDF or image	PDF أو صورة
 	No file chosen	لم يُختر ملف
 	Page number	رقم الصفحة
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 90791f4a86..e5f2eff8f4 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -496,6 +496,12 @@
 	Applies to 1 page	Прилага се към 1 страница
 	Applies to {n} pages	Прилага се към {n} страници
 	Replaces the existing one on those pages.	Заменя съществуващия на тези страници.
+	Checking pages…	Проверка на страниците…
+	This page paints its own white backdrop, which would hide the background. Replace it	Тази страница има собствено бяло запълване, което би скрило фона. Замяна
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Страници със собствено бяло запълване, което би скрило фона: {n}. Замяна
+	Removing the background puts the page's own backdrop back.	Премахването на фона връща собственото бяло запълване на страницата.
+	A picture covers this page (a scan?), so the background won't show there.	Изображение покрива тази страница (сканиране?), затова фонът няма да се вижда там.
+	A picture covers {n} pages (scans?), so the background won't show there.	Страници, покрити с изображения (сканирания?): {n}; фонът няма да се вижда там.
 	PDF or image	PDF или изображение
 	No file chosen	Не е избран файл
 	Page number	Номер на страница
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 4bbb9a5e77..a76c53166a 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -896,6 +896,12 @@ key	Space	Mezerník
 	Applies to 1 page	Týká se 1 stránky
 	Applies to {n} pages	Počet dotčených stránek: {n}
 	Replaces the existing one on those pages.	Nahradí stávající na těchto stránkách.
+	Checking pages…	Kontrola stránek…
+	This page paints its own white backdrop, which would hide the background. Replace it	Tato stránka má vlastní bílou výplň, která by zakryla pozadí. Nahradit ji
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Stránky s vlastní bílou výplní, která by zakryla pozadí: {n}. Nahradit ji
+	Removing the background puts the page's own backdrop back.	Odebráním pozadí se vrátí vlastní bílá výplň stránky.
+	A picture covers this page (a scan?), so the background won't show there.	Tuto stránku pokrývá obrázek (sken?), takže pozadí na ní nebude vidět.
+	A picture covers {n} pages (scans?), so the background won't show there.	Stránky pokryté obrázky (skeny?): {n}; pozadí na nich nebude vidět.
 	PDF or image	PDF nebo obrázek
 	No file chosen	Není vybrán žádný soubor
 	Page number	Číslo stránky
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 7965435257..9ec1649f0c 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -800,6 +800,12 @@
 	Applies to 1 page	Gilt für 1 Seite
 	Applies to {n} pages	Gilt für {n} Seiten
 	Replaces the existing one on those pages.	Ersetzt das Vorhandene auf diesen Seiten.
+	Checking pages…	Seiten werden geprüft…
+	This page paints its own white backdrop, which would hide the background. Replace it	Diese Seite hat eine eigene weiße Fläche, die den Hintergrund verdecken würde. Ersetzen
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} Seiten haben eine eigene weiße Fläche, die den Hintergrund verdecken würde. Ersetzen
+	Removing the background puts the page's own backdrop back.	Wird der Hintergrund entfernt, kehrt die eigene weiße Fläche der Seite zurück.
+	A picture covers this page (a scan?), so the background won't show there.	Ein Bild bedeckt diese Seite (ein Scan?), daher ist der Hintergrund dort nicht zu sehen.
+	A picture covers {n} pages (scans?), so the background won't show there.	Bilder bedecken {n} Seiten (Scans?), daher ist der Hintergrund dort nicht zu sehen.
 	PDF or image	PDF oder Bild
 	No file chosen	Keine Datei ausgewählt
 	Page number	Seitenzahl
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 57de6eef07..509adcb495 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -432,6 +432,12 @@
 	Applies to 1 page	Εφαρμόζεται σε 1 σελίδα
 	Applies to {n} pages	Εφαρμόζεται σε {n} σελίδες
 	Replaces the existing one on those pages.	Αντικαθιστά το υπάρχον στοιχείο στις συγκεκριμένες σελίδες.
+	Checking pages…	Έλεγχος σελίδων…
+	This page paints its own white backdrop, which would hide the background. Replace it	Αυτή η σελίδα έχει δική της λευκή γέμιση, που θα έκρυβε το φόντο. Αντικατάσταση
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} σελίδες έχουν δική τους λευκή γέμιση, που θα έκρυβε το φόντο. Αντικατάσταση
+	Removing the background puts the page's own backdrop back.	Η αφαίρεση του φόντου επαναφέρει τη λευκή γέμιση της σελίδας.
+	A picture covers this page (a scan?), so the background won't show there.	Μια εικόνα καλύπτει αυτή τη σελίδα (σάρωση;), οπότε το φόντο δεν θα φαίνεται εκεί.
+	A picture covers {n} pages (scans?), so the background won't show there.	Εικόνες καλύπτουν {n} σελίδες (σαρώσεις;), οπότε το φόντο δεν θα φαίνεται εκεί.
 	PDF or image	PDF ή εικόνα
 	No file chosen	Δεν έχει επιλεγεί αρχείο
 	Scale relative to target page	Κλίμακα ως προς τη σελίδα προορισμού
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index e4eb634468..b3cd598fcf 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -816,6 +816,12 @@
 	Applies to 1 page	Se aplica a 1 página
 	Applies to {n} pages	Se aplica a {n} páginas
 	Replaces the existing one on those pages.	Reemplaza al existente en esas páginas.
+	Checking pages…	Comprobando páginas…
+	This page paints its own white backdrop, which would hide the background. Replace it	Esta página tiene su propio relleno blanco, que ocultaría el fondo. Reemplazarlo
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} páginas tienen su propio relleno blanco, que ocultaría el fondo. Reemplazarlo
+	Removing the background puts the page's own backdrop back.	Al quitar el fondo, se restaura el relleno blanco propio de la página.
+	A picture covers this page (a scan?), so the background won't show there.	Una imagen cubre esta página (¿un escaneo?), así que el fondo no se verá ahí.
+	A picture covers {n} pages (scans?), so the background won't show there.	Hay imágenes que cubren {n} páginas (¿escaneos?), así que el fondo no se verá ahí.
 	PDF or image	PDF o imagen
 	No file chosen	Ningún archivo elegido
 	Page number	Número de página
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 62acea1da8..9a693fc49c 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -796,6 +796,12 @@
 	Applies to 1 page	S'applique à 1 page
 	Applies to {n} pages	S'applique à {n} pages
 	Replaces the existing one on those pages.	Remplace celui qui existe déjà sur ces pages.
+	Checking pages…	Vérification des pages…
+	This page paints its own white backdrop, which would hide the background. Replace it	Cette page a son propre remplissage blanc, qui masquerait l'arrière-plan. Le remplacer
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} pages ont leur propre remplissage blanc, qui masquerait l'arrière-plan. Le remplacer
+	Removing the background puts the page's own backdrop back.	Supprimer l'arrière-plan rétablit le remplissage blanc propre à la page.
+	A picture covers this page (a scan?), so the background won't show there.	Une image couvre cette page (une numérisation ?), l'arrière-plan n'y sera donc pas visible.
+	A picture covers {n} pages (scans?), so the background won't show there.	Des images couvrent {n} pages (des numérisations ?), l'arrière-plan n'y sera donc pas visible.
 	PDF or image	PDF ou image
 	No file chosen	Aucun fichier choisi
 	Page number	Numéro de page
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 2238e1ade5..3eaf795525 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -793,6 +793,12 @@
 	Applies to 1 page	1 oldalra vonatkozik
 	Applies to {n} pages	{n} oldalra vonatkozik
 	Replaces the existing one on those pages.	Lecseréli a meglévőt ezeken az oldalakon.
+	Checking pages…	Oldalak ellenőrzése…
+	This page paints its own white backdrop, which would hide the background. Replace it	Ennek az oldalnak saját fehér kitöltése van, amely eltakarná a hátteret. Csere
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} oldalnak saját fehér kitöltése van, amely eltakarná a hátteret. Csere
+	Removing the background puts the page's own backdrop back.	A háttér eltávolítása visszaállítja az oldal saját fehér kitöltését.
+	A picture covers this page (a scan?), so the background won't show there.	Egy kép fedi le ezt az oldalt (szkennelt?), így ott nem látszik a háttér.
+	A picture covers {n} pages (scans?), so the background won't show there.	Képek fednek le {n} oldalt (szkenneltek?), így ott nem látszik a háttér.
 	PDF or image	PDF vagy kép
 	No file chosen	Nincs fájl kiválasztva
 	Page number	Oldalszám
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 3fa2263a0b..4f52f86e71 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -819,6 +819,12 @@
 	Applies to 1 page	Si applica a 1 pagina
 	Applies to {n} pages	Si applica a {n} pagine
 	Replaces the existing one on those pages.	Sostituisce l'elemento esistente su quelle pagine.
+	Checking pages…	Verifica delle pagine…
+	This page paints its own white backdrop, which would hide the background. Replace it	Questa pagina ha un proprio riempimento bianco, che nasconderebbe lo sfondo. Sostituiscilo
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} pagine hanno un proprio riempimento bianco, che nasconderebbe lo sfondo. Sostituiscilo
+	Removing the background puts the page's own backdrop back.	Rimuovendo lo sfondo, il riempimento bianco della pagina viene ripristinato.
+	A picture covers this page (a scan?), so the background won't show there.	Un'immagine copre questa pagina (una scansione?), quindi lì lo sfondo non sarà visibile.
+	A picture covers {n} pages (scans?), so the background won't show there.	Delle immagini coprono {n} pagine (scansioni?), quindi lì lo sfondo non sarà visibile.
 	PDF or image	PDF o immagine
 	No file chosen	Nessun file scelto
 	Page number	Numero di pagina
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index ee9439e311..1abf8b00f3 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -823,6 +823,12 @@
 	Applies to 1 page	1 ページに適用
 	Applies to {n} pages	{n} ページに適用
 	Replaces the existing one on those pages.	対象ページの既存の項目を置き換えます。
+	Checking pages…	ページを確認しています…
+	This page paints its own white backdrop, which would hide the background. Replace it	このページには独自の白い塗りがあり、背景が隠れてしまいます。置き換える
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} ページに独自の白い塗りがあり、背景が隠れてしまいます。置き換える
+	Removing the background puts the page's own backdrop back.	背景を削除すると、ページ独自の白い塗りが元に戻ります。
+	A picture covers this page (a scan?), so the background won't show there.	このページは画像（スキャン？）で覆われているため、背景は表示されません。
+	A picture covers {n} pages (scans?), so the background won't show there.	{n} ページが画像（スキャン？）で覆われているため、そこでは背景は表示されません。
 	PDF or image	PDF または画像
 	No file chosen	ファイルが選択されていません
 	Page number	ページ番号
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 827165ae3a..3e5d693d52 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -778,6 +778,12 @@
 	Applies to 1 page	1 бетке қолданылады
 	Applies to {n} pages	{n} бетке қолданылады
 	Replaces the existing one on those pages.	Осы беттерде бар элементті ауыстырады.
+	Checking pages…	Беттер тексерілуде…
+	This page paints its own white backdrop, which would hide the background. Replace it	Бұл беттің өз ақ толтыруы бар, ол фонды жасырады. Ауыстыру
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} беттің өз ақ толтыруы бар, ол фонды жасырады. Ауыстыру
+	Removing the background puts the page's own backdrop back.	Фонды жою беттің өз ақ толтыруын қайтарады.
+	A picture covers this page (a scan?), so the background won't show there.	Бұл бетті сурет жауып тұр (сканер ме?), сондықтан онда фон көрінбейді.
+	A picture covers {n} pages (scans?), so the background won't show there.	{n} бетті суреттер жауып тұр (сканер ме?), сондықтан онда фон көрінбейді.
 	PDF or image	PDF немесе сурет
 	No file chosen	Файл таңдалмады
 	Page number	Бет нөмірі
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 56a785cd3e..09fd3a65f9 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -958,6 +958,12 @@
 	Replacement text	Pakaitinis tekstas
 	Replacement: pages of {name}	Pakaitinis dokumentas: {name} puslapiai
 	Replaces the existing one on those pages.	Tuose puslapiuose pakeičia esamą.
+	Checking pages…	Tikrinami puslapiai…
+	This page paints its own white backdrop, which would hide the background. Replace it	Šis puslapis turi savo baltą užpildą, kuris paslėptų foną. Pakeisti
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Puslapiai su savo baltu užpildu, kuris paslėptų foną: {n}. Pakeisti
+	Removing the background puts the page's own backdrop back.	Pašalinus foną, grąžinamas paties puslapio baltas užpildas.
+	A picture covers this page (a scan?), so the background won't show there.	Šį puslapį dengia paveikslėlis (nuskaitytas?), todėl fonas ten nesimatys.
+	A picture covers {n} pages (scans?), so the background won't show there.	Paveikslėliais padengti puslapiai (nuskaityti?): {n}; fonas ten nesimatys.
 	Report	Ataskaita
 	Report…	Ataskaita…
 	Requires user to enter a password for:	Naudotojas turi įvesti slaptažodį, kad galėtų:
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 3dbb247056..6d55eed026 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -814,6 +814,12 @@
 	Applies to 1 page	Dotyczy 1 strony
 	Applies to {n} pages	Liczba objętych stron: {n}
 	Replaces the existing one on those pages.	Zastępuje istniejący element na tych stronach.
+	Checking pages…	Sprawdzanie stron…
+	This page paints its own white backdrop, which would hide the background. Replace it	Ta strona ma własne białe wypełnienie, które zasłoniłoby tło. Zastąp
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Strony z własnym białym wypełnieniem, które zasłoniłoby tło: {n}. Zastąp
+	Removing the background puts the page's own backdrop back.	Usunięcie tła przywraca własne białe wypełnienie strony.
+	A picture covers this page (a scan?), so the background won't show there.	Tę stronę zakrywa obraz (skan?), więc tło nie będzie tam widoczne.
+	A picture covers {n} pages (scans?), so the background won't show there.	Strony zakryte obrazami (skany?): {n}; tło nie będzie tam widoczne.
 	PDF or image	PDF lub obraz
 	No file chosen	Nie wybrano pliku
 	Page number	Numer strony
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 8b3baa2d39..ca6f416885 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -451,6 +451,12 @@
 	Applies to 1 page	Aplica-se a 1 página
 	Applies to {n} pages	Aplica-se a {n} páginas
 	Replaces the existing one on those pages.	Substitui o existente nessas páginas.
+	Checking pages…	Verificando páginas…
+	This page paints its own white backdrop, which would hide the background. Replace it	Esta página tem um preenchimento branco próprio, que esconderia o plano de fundo. Substituí-lo
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} páginas têm um preenchimento branco próprio, que esconderia o plano de fundo. Substituí-lo
+	Removing the background puts the page's own backdrop back.	Remover o plano de fundo restaura o preenchimento branco da página.
+	A picture covers this page (a scan?), so the background won't show there.	Uma imagem cobre esta página (uma digitalização?), então o plano de fundo não aparecerá nela.
+	A picture covers {n} pages (scans?), so the background won't show there.	Imagens cobrem {n} páginas (digitalizações?), então o plano de fundo não aparecerá nelas.
 	PDF or image	PDF ou imagem
 	No file chosen	Nenhum arquivo escolhido
 	Page number	Número da página
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index d0f8fc239c..92f80a3fbe 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -816,6 +816,12 @@
 	Applies to 1 page	Применяется к 1 странице
 	Applies to {n} pages	Применяется к {n} страницам
 	Replaces the existing one on those pages.	Заменяет существующий на этих страницах.
+	Checking pages…	Проверка страниц…
+	This page paints its own white backdrop, which would hide the background. Replace it	На этой странице есть собственная белая заливка, которая скроет фон. Заменить
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Страницы с собственной белой заливкой, которая скроет фон: {n}. Заменить
+	Removing the background puts the page's own backdrop back.	При удалении фона собственная белая заливка страницы возвращается.
+	A picture covers this page (a scan?), so the background won't show there.	Эту страницу закрывает изображение (скан?), поэтому фон там не будет виден.
+	A picture covers {n} pages (scans?), so the background won't show there.	Страницы, закрытые изображениями (сканы?): {n}; фон там не будет виден.
 	PDF or image	PDF или изображение
 	No file chosen	Файл не выбран
 	Page number	Номер страницы
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 92d9c9a6e3..eb6b9678c4 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -1485,6 +1485,12 @@
 	Replacement text	Nadomestno besedilo
 	Replacement: pages of {name}	Zamenjava: strani datoteke {name}
 	Replaces the existing one on those pages.	Nadomesti obstoječe na teh straneh.
+	Checking pages…	Preverjanje strani…
+	This page paints its own white backdrop, which would hide the background. Replace it	Ta stran ima lastno belo polnilo, ki bi skrilo ozadje. Zamenjaj
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Strani z lastnim belim polnilom, ki bi skrilo ozadje: {n}. Zamenjaj
+	Removing the background puts the page's own backdrop back.	Odstranitev ozadja povrne lastno belo polnilo strani.
+	A picture covers this page (a scan?), so the background won't show there.	To stran prekriva slika (skeniranje?), zato ozadje tam ne bo vidno.
+	A picture covers {n} pages (scans?), so the background won't show there.	Strani, ki jih prekrivajo slike (skeniranja?): {n}; ozadje tam ne bo vidno.
 	Replacing images arrives on the web with image file pickers	Zamenjava slik bo v spletni različici na voljo z izbirniki slikovnih datotek
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Zamenjava slik na strani {p} bo v spletni različici na voljo z izbirniki slik ({i})
 	Reply	Odgovori
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 07b716eac1..9ec8e96bef 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -796,6 +796,12 @@ comment menu	Edit	సవరించు
 	Applies to 1 page	1 పేజీకి వర్తిస్తుంది
 	Applies to {n} pages	{n} పేజీలకు వర్తిస్తుంది
 	Replaces the existing one on those pages.	ఆ పేజీలలో ఇప్పటికే ఉన్నదాన్ని భర్తీ చేస్తుంది.
+	Checking pages…	పేజీలను తనిఖీ చేస్తోంది…
+	This page paints its own white backdrop, which would hide the background. Replace it	ఈ పేజీకి సొంత తెల్లని నింపు ఉంది, అది నేపథ్యాన్ని దాచేస్తుంది. భర్తీ చేయండి
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} పేజీలకు సొంత తెల్లని నింపు ఉంది, అది నేపథ్యాన్ని దాచేస్తుంది. భర్తీ చేయండి
+	Removing the background puts the page's own backdrop back.	నేపథ్యాన్ని తీసివేస్తే పేజీ సొంత తెల్లని నింపు తిరిగి వస్తుంది.
+	A picture covers this page (a scan?), so the background won't show there.	ఈ పేజీని ఒక చిత్రం కప్పుతోంది (స్కాన్?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
+	A picture covers {n} pages (scans?), so the background won't show there.	{n} పేజీలను చిత్రాలు కప్పుతున్నాయి (స్కాన్‌లు?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
 	PDF or image	PDF లేదా చిత్రం
 	No file chosen	ఫైల్ ఏదీ ఎంచుకోలేదు
 	Page number	పేజీ సంఖ్య
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index 30e19f2132..e500ba7c17 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -777,6 +777,12 @@
 	Applies to 1 page	1 sayfaya uygulanır
 	Applies to {n} pages	{n} sayfaya uygulanır
 	Replaces the existing one on those pages.	Bu sayfalardaki mevcut olanın yerini alır.
+	Checking pages…	Sayfalar denetleniyor…
+	This page paints its own white backdrop, which would hide the background. Replace it	Bu sayfanın arka planı gizleyecek kendi beyaz dolgusu var. Değiştir
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} sayfanın arka planı gizleyecek kendi beyaz dolgusu var. Değiştir
+	Removing the background puts the page's own backdrop back.	Arka planı kaldırmak, sayfanın kendi beyaz dolgusunu geri getirir.
+	A picture covers this page (a scan?), so the background won't show there.	Bu sayfayı bir resim kaplıyor (tarama mı?), bu yüzden arka plan orada görünmez.
+	A picture covers {n} pages (scans?), so the background won't show there.	{n} sayfayı resimler kaplıyor (tarama mı?), bu yüzden arka plan orada görünmez.
 	PDF or image	PDF veya resim
 	No file chosen	Dosya seçilmedi
 	Page number	Sayfa numarası
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index c60799ef1f..76bf5b0791 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -820,6 +820,12 @@
 	Applies to 1 page	Застосовується до 1 сторінки
 	Applies to {n} pages	Застосовується до {n} сторінок
 	Replaces the existing one on those pages.	Замінює наявний елемент на цих сторінках.
+	Checking pages…	Перевірка сторінок…
+	This page paints its own white backdrop, which would hide the background. Replace it	Ця сторінка має власну білу заливку, яка приховає тло. Замінити
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Сторінки з власною білою заливкою, яка приховає тло: {n}. Замінити
+	Removing the background puts the page's own backdrop back.	Вилучення тла повертає власну білу заливку сторінки.
+	A picture covers this page (a scan?), so the background won't show there.	Цю сторінку закриває зображення (скан?), тому тло там не буде видно.
+	A picture covers {n} pages (scans?), so the background won't show there.	Сторінки, закриті зображеннями (скани?): {n}; тло там не буде видно.
 	PDF or image	PDF або зображення
 	No file chosen	Файл не вибрано
 	Page number	Номер сторінки
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index b072755236..5aabd0eb4f 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -953,6 +953,12 @@ theme	Appearance	Giao diện
 	Replacement text	Văn bản được thay vào
 	Replacement: pages of {name}	Thay thế: các trang của {name}
 	Replaces the existing one on those pages.	Thay thế cái hiện có trên các trang đó.
+	Checking pages…	Đang kiểm tra các trang…
+	This page paints its own white backdrop, which would hide the background. Replace it	Trang này có lớp tô trắng riêng, sẽ che mất nền. Thay thế
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} trang có lớp tô trắng riêng, sẽ che mất nền. Thay thế
+	Removing the background puts the page's own backdrop back.	Gỡ nền sẽ khôi phục lớp tô trắng riêng của trang.
+	A picture covers this page (a scan?), so the background won't show there.	Một hình ảnh phủ kín trang này (bản quét?), nên nền sẽ không hiện ở đó.
+	A picture covers {n} pages (scans?), so the background won't show there.	Hình ảnh phủ kín {n} trang (bản quét?), nên nền sẽ không hiện ở đó.
 	Report	Báo cáo
 	Report…	Báo cáo…
 	Requires user to enter a password for:	Yêu cầu người dùng nhập mật khẩu cho:
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 2297d1269a..b3c2642e79 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -503,6 +503,12 @@
 	Applies to 1 page	应用于 1 页
 	Applies to {n} pages	应用于 {n} 页
 	Replaces the existing one on those pages.	替换这些页面上的现有内容。
+	Checking pages…	正在检查页面…
+	This page paints its own white backdrop, which would hide the background. Replace it	此页面有自己的白色填充，会遮住背景。替换它
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} 个页面有自己的白色填充，会遮住背景。替换它
+	Removing the background puts the page's own backdrop back.	移除背景后，页面自己的白色填充会恢复。
+	A picture covers this page (a scan?), so the background won't show there.	此页面被一张图片覆盖（扫描件？），因此那里不会显示背景。
+	A picture covers {n} pages (scans?), so the background won't show there.	{n} 个页面被图片覆盖（扫描件？），因此那里不会显示背景。
 	PDF or image	PDF 或图像
 	No file chosen	未选择文件
 	Page number	页码
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 2ddb33dd6d..611c6cf5ef 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -455,6 +455,12 @@
 	Applies to 1 page	套用於 1 頁
 	Applies to {n} pages	套用於 {n} 頁
 	Replaces the existing one on those pages.	替換這些頁面上的現有內容。
+	Checking pages…	正在檢查頁面…
+	This page paints its own white backdrop, which would hide the background. Replace it	此頁面有自己的白色填色，會遮住背景。取代它
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} 個頁面有自己的白色填色，會遮住背景。取代它
+	Removing the background puts the page's own backdrop back.	移除背景後，頁面自己的白色填色會恢復。
+	A picture covers this page (a scan?), so the background won't show there.	此頁面被一張圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
+	A picture covers {n} pages (scans?), so the background won't show there.	{n} 個頁面被圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
 	PDF or image	PDF 或圖片
 	No file chosen	未選擇檔案
 	Page number	頁碼

From 93df949e3ef1c6f70868d3f60ee2f657a758a0c2 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Fri, 16 Oct 2026 11:40:07 +0200
Subject: [PATCH 014/270] fix(assets): refresh the catalogue hashes for the
 backdrop translations

The 22 interface catalogues are registered assets; adding the Add
Background strings changed their SHA-256. Provenance is unchanged
(contributor-original translations).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ATTRIBUTION.toml | 44 ++++++++++++++++++++++----------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index be9e2c448e..be2e770d56 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -7,7 +7,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Greek UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "cefa955aa92790d6773cb1d1e15e19019b3165a00528d57d6617362e1d1988ab"
+sha256 = "dd8a8b41a1a6de5d2f9f540d0c499366ccaa1ebfe62bb259f202dd4be03fc234"
 
 # ATTRIBUTION.toml: one entry per asset (AGENTS.md §1). The source of truth for provenance and licences.
 # ATTRIBUTION.md is generated from this file: `cargo xtask assets --write`. Checked by `cargo xtask assets` (part of `xtask ci`).
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "dbfebf4e9b2e9ac31ecf72202c2098173e72ebfaf90e9fee8f0563a6734fe31f"
+sha256 = "392fa715e7a058a6d6f872a9381260e9e1598ef45b616edc71bc6b311d9c4a34"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "0b0dafa3806a6b3508684f64e1f07b435113f8efd0e59201d12250c63c1d9547"
+sha256 = "343b669decabca1e05a651b410b34427f2a28bb2dd22240a877bbb57a94d87af"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "898a5240fa59cac42ef6b99cb60bcfca0094ac27370e1c8d020bd27936b56517"
+sha256 = "e56bb7c7ebe676b5cb606f0bff4102ca036a532a2c6afbcc74e8a221b2ae3382"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b4745c94797575529cd0e78c18c71fa2c0dfddfbf19b9c40b41dc2057c6f6543"
+sha256 = "9e3085c3a3d0c6114df4bd73d380d8efc4bb05ba07ad0285b4c54abd9a901b69"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2acb3f6522d6d1f744343f474fe4c51ebec610a888a7fa83fc9422228e6fa3c1"
+sha256 = "8a450837808cd319c82e39b4833623b64c3e50009beffd732d00b8eb88d32fbc"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "1b739478a4f186a49900cce84edbe136206a53b46340322df4caf77bb3fb5b12"
+sha256 = "9c6c34ec7f372b3d3db2c88435b497eb4bbf2032859c1bfc3cfb12c47c3b36b6"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "da3b71608ff7fe6e230b076207cee96ac01f66e068ca1be83af1ad56ac9c60eb"
+sha256 = "9d890f88003febb885e076df172872cfff76cde77cf22b1af57c570229dc4316"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "989d2e5f57cf22c21a85951835ca9fbd05e314da67eb4c17332df1f03679fa00"
+sha256 = "617bf25bb48c93a0578e5832f54420fc47b3a97ad31bf9ffd57556a1bdb4048b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/it.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Italian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "5e84916e3ad8670216360695689fe8fd624365a29886f66a3c655ba126892f5b"
+sha256 = "b90ef8f3a4b71e2aca3bc98f8420b25fbc6f86220b75f0c5f47b731551e506f8"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pl.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Polish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "988bcf2e0322a46c0464ff7b91ab5d90193b0ea7f454812d12595eb843de6fc7"
+sha256 = "77069128e2d00b03cedf460915fc00a0cc00880e3b1aecf6de769b06c218f71b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "084f4ea06f31c632ad90b0e87f66240ce5b5dc012ac7770987d44918ee66f452"
+sha256 = "2ee89f763e825609beb78b5f05f3a035cff4f01c81a0fb80dcefbbf209d19f98"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "973cd90ec34c8a973d146a0e2c73c1d632e17357c3d87ccf10c59e64d12c1587"
+sha256 = "19844f166956ac49e6c4c09b57e2024e0d73c5c3e14ee8df994a1799bef9b648"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -162,7 +162,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "485f85d4053c9661ddda2ed9394a0644c77b489feb598d02f12ef209e11f2ee3"
+sha256 = "5b31891a0775d5e7a9cfb14a2f767b2fa17c9d948ce92b43cd371846a3d69322"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/kk.tsv"
@@ -173,7 +173,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Kazakh UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "24524864022ab2abeff68b5979519eee4e92134d0c4053d40c741bc7f01c249c"
+sha256 = "e7b587ecf87095a1317bf37830ca60e75a16a0285dfa14e0361ddfd04b44800b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -184,7 +184,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "bc6d123bdb34d5d7c22717fed1a86ff20e7e493acc1e155e61e61e2dc74459aa"
+sha256 = "9413104f8543e8a03dccb014d62bd40a77645de5b279c55b3266c02e907afb89"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -195,7 +195,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "82678dbe730f56062037ea78de165b2c016b3fa670fb1cbfc7cd713eca900bac"
+sha256 = "f1490c97273e57b256e234a8a53766318f75f888a05144727efc226c7d67f62d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ar.tsv"
@@ -206,7 +206,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Arabic UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "304d661b27cdb5246f6b2974b4b5e78667f0928cda3588440be3d8f35f254679"
+sha256 = "2216666f2d355aed70b4c60e09bfe07d902036bbad52aee1e287e5f50a887903"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/tr.tsv"
@@ -217,7 +217,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Turkish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "05e2b7d5401166d362ba055120fba9a1645d6ec324997cf670e19fafcb0c54cf"
+sha256 = "436777718e77c79ca54a16a629d725e7b480ad9fad5f25f7c249b446208797e4"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/lt.tsv"
@@ -228,7 +228,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Lithuanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "17c8579e0e9d1524ffbeb87e7b30c14562dbaac64400826ee786cecfe31648fa"
+sha256 = "d66b81e59728b669ed1a35e4773d0ef75b25f7143109e9a5fc7dd29e6a52ee25"
 
 
 [[asset]]
@@ -3352,7 +3352,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Vietnamese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2d1c4b4276d02512a4e20101be95a1671de5c4f5cdfd661887af5ebab0db06a6"
+sha256 = "a2dde60a333e8c75d8f07190149d28d3f210c0c8662e0493b4e67dd34789e453"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/sl.tsv"
@@ -3363,7 +3363,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Slovene UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8f8a259264cda06eb6d9a9bf91dc7d873a8561213a9a9e7acbd32623bef40be0"
+sha256 = "73563d2d36a685ef23ed517eb635a654b1a5900abe7471db17b40af62b4cd223"
 
 [[asset]]
 

From 22ec11cd28c1df31c5755c724c3cc4fdcdbc8e6f Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Sat, 17 Oct 2026 09:57:47 +0800
Subject: [PATCH 015/270] Keep lines with footnote references in paragraph
 reading order (#2929)

---
 crates/render/src/text.rs | 177 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 168 insertions(+), 9 deletions(-)

diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index b767e28314..064a68d093 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -945,6 +945,32 @@ struct SegExtra {
     more: Vec<Run>,
 }
 
+/// Whether `(script_bbox, script_h)` is a superscript or subscript on `(host_bbox, host_h)`.
+fn is_script_on(host_bbox: &[f32; 4], host_h: f32, script_bbox: &[f32; 4], script_h: f32) -> bool {
+    let host_cy = (host_bbox[1] + host_bbox[3]) / 2.0;
+    let script_cy = (script_bbox[1] + script_bbox[3]) / 2.0;
+    let script_w = script_bbox[2] - script_bbox[0];
+    let host_w = host_bbox[2] - host_bbox[0];
+    let smaller = script_h >= host_h * 0.45 && script_w < host_h * 3.0 && (script_h < host_h * 0.9 || (script_h <= host_h && host_w > script_w));
+    if !smaller {
+        return false;
+    }
+    if script_cy < host_cy {
+        // Superscript: raised above the host baseline, with its bottom inside the host line.
+        host_cy - script_cy >= host_h * 0.12
+            && host_cy - script_cy < host_h * 0.7
+            && host_bbox[3] - script_bbox[3] >= host_h * 0.15
+            && script_bbox[3] > host_bbox[1] + host_h * 0.25
+    } else {
+        // Subscript: lowered below the host baseline, with its centre still inside the host line.
+        script_cy - host_cy >= host_h * 0.12
+            && script_cy - host_cy < host_h * 0.5
+            && script_bbox[3] > host_bbox[3]
+            && host_bbox[3] > script_bbox[1] + script_h * 0.5
+            && script_bbox[1] >= host_bbox[1] - script_h * 0.2
+    }
+}
+
 impl Seg {
     fn new(first: Run, bbox: [f32; 4], h: f32) -> Self {
         Seg { first, extra: None, bbox, h }
@@ -958,9 +984,25 @@ impl Seg {
         std::iter::once(self.first).chain(self.extra.iter().flat_map(|e| e.more.iter().copied()))
     }
 
+    /// Extend `self`'s box and height with `(bbox, h)`. A smaller script (superscript or
+    /// subscript) widens the line horizontally without pulling its vertical baseline band up or
+    /// down; when a line begins with a script and continues with taller body text, the body text's
+    /// vertical band becomes the line's.
+    fn extend_box(&mut self, bbox: &[f32; 4], h: f32) {
+        if h > self.h * 1.15 || is_script_on(bbox, h, &self.bbox, self.h) {
+            self.bbox[1] = bbox[1];
+            self.bbox[3] = bbox[3];
+        } else if !(self.h > h * 1.15 || is_script_on(&self.bbox, self.h, bbox, h)) {
+            self.bbox[1] = self.bbox[1].min(bbox[1]);
+            self.bbox[3] = self.bbox[3].max(bbox[3]);
+        }
+        self.bbox[0] = self.bbox[0].min(bbox[0]);
+        self.bbox[2] = self.bbox[2].max(bbox[2]);
+        self.h = self.h.max(h);
+    }
+
     fn merge(&mut self, other: Seg) {
-        union(&mut self.bbox, &other.bbox);
-        self.h = self.h.max(other.h);
+        self.extend_box(&other.bbox, other.h);
         let extra = self.extra.get_or_insert_with(Default::default);
         extra.more.push(other.first);
         if let Some(o) = other.extra {
@@ -1177,8 +1219,10 @@ fn collide(glyphs: &[&TextGlyph], height: &dyn Fn(usize) -> f32, h: f32, sc: &mu
             }
             budget -= 1;
             let (ra, rb) = (union_find(&mut sc.parent, ri), union_find(&mut sc.parent, rj));
+            let hj = height(j);
+            let script = is_script_on(&glyphs[i].rect, hi, &glyphs[j].rect, hj) || is_script_on(&glyphs[j].rect, hj, &glyphs[i].rect, hi);
             let overlap = x1.min(glyphs[j].rect[2]) - x0(j);
-            if ra != rb && overlap > RUN_COLLISION * hi.min(height(j)) {
+            if ra != rb && !script && overlap > RUN_COLLISION * hi.min(hj) {
                 sc.parent[ra] = rb;
                 collided = true;
             }
@@ -1341,11 +1385,16 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
     let mut furthest_progress = 0.0;
     for i in 0..n {
         let g = glyphs[i].rect;
+        let hi = height(i);
         let cont = segs.last().is_some_and(|s| {
             let Some(p) = s.first.end.checked_sub(1) else { return false };
-            let ph = height(p).min(height(i));
+            let ph = height(p).min(hi);
+            let sh = s.h.min(hi);
             let gap = g[0] - glyphs[p].rect[2];
-            (cy(i) - cy(p)).abs() < ph * 0.5 && gap < ph * 3.0 && g[0] > glyphs[p].rect[0] - ph * 2.0
+            let same_line = ((cy(i) - cy(p)).abs() < ph * 0.5 && gap < ph * 3.0)
+                || ((cy(i) - s.cy()).abs() < sh * 0.3 && (s.h / hi - 1.0).abs() < 0.35 && gap < sh * 3.0);
+            let on_seg = gap < s.h * 1.2 && (is_script_on(&s.bbox, s.h, &g, hi) || is_script_on(&g, hi, &s.bbox, s.h));
+            (same_line || on_seg) && g[0] > glyphs[p].rect[0] - sh * 2.0
         });
         let reset = cont && segs.last().is_some_and(|s| restarts_run(&glyphs, s.first.start, i, furthest_progress));
         if cont
@@ -1353,11 +1402,10 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
             && let Some(s) = segs.last_mut()
         {
             s.first.end = i + 1;
-            union(&mut s.bbox, &g);
-            s.h = s.h.max(height(i));
+            s.extend_box(&g, hi);
             furthest_progress = furthest_progress.max((g[0] - run_start_x).abs()).max((g[2] - run_start_x).abs());
         } else {
-            segs.push(Seg::new(Run { start: i, end: i + 1 }, g, height(i)));
+            segs.push(Seg::new(Run { start: i, end: i + 1 }, g, hi));
             run_start_x = g[0];
             furthest_progress = 0.0;
         }
@@ -1406,7 +1454,8 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
         kept_runs
     };
     segs.truncate(retained);
-    // Merge same-baseline segments that nearly touch.
+    // Merge same-baseline segments that nearly touch, then attach any remaining superscript or
+    // subscript segments to the closest host line segment they sit on.
     let mut merged = true;
     while merged {
         merged = false;
@@ -1427,6 +1476,28 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
                 }
             }
         }
+        if !merged {
+            for b in 0..segs.len() {
+                let sb = &segs[b];
+                let best_host = (0..segs.len())
+                    .filter(|&a| {
+                        if a == b {
+                            return false;
+                        }
+                        let sa = &segs[a];
+                        let gap = (sb.bbox[0] - sa.bbox[2]).max(sa.bbox[0] - sb.bbox[2]);
+                        sa.bbox[2] - sa.bbox[0] > sb.bbox[2] - sb.bbox[0] && gap < sa.h * 1.2 && is_script_on(&sa.bbox, sa.h, &sb.bbox, sb.h)
+                    })
+                    .min_by(|&a1, &a2| (segs[a1].cy() - sb.cy()).abs().total_cmp(&(segs[a2].cy() - sb.cy()).abs()));
+                if let Some(a) = best_host {
+                    let sb = segs.remove(b);
+                    let a = if b < a { a - 1 } else { a };
+                    segs[a].merge(sb);
+                    merged = true;
+                    break;
+                }
+            }
+        }
     }
 
     // 2. Blocks.
@@ -2646,4 +2717,92 @@ mod tests {
         assert_eq!(ocr_layer_text(4, false), expected, "symbolic, no /ToUnicode");
         assert_eq!(ocr_layer_text(32, true), expected, "nonsymbolic, /ToUnicode for ASCII only");
     }
+
+    /// Issue #2929: a footnote reference (superscript) on a line stays in that line instead of
+    /// splitting out as a raised segment that steals the block's tail and pushes the host line
+    /// after the paragraph.
+    #[test]
+    fn paragraph_selection_includes_lines_with_footnote_references() {
+        for inline in [true, false] {
+            let ops = if inline {
+                "BT /F1 12 Tf 1 0 0 1 40 300 Tm (First line of the paragraph) Tj \
+                 1 0 0 1 40 285 Tm (Second line with a note) Tj \
+                 /F1 8 Tf 5.5 Ts (1) Tj 0 Ts \
+                 /F1 12 Tf ( and more text) Tj \
+                 1 0 0 1 40 270 Tm (Third line of the paragraph) Tj \
+                 /F1 7 Tf 1 0 0 1 40 104 Tm (1) Tj \
+                 /F1 10 Tf 1 0 0 1 47 100 Tm (Footnote at the bottom) Tj ET"
+            } else {
+                // Superscripts drawn in a separate pass after the body text.
+                "BT /F1 12 Tf 1 0 0 1 40 300 Tm (First line of the paragraph) Tj \
+                 1 0 0 1 40 285 Tm (Second line with a note) Tj \
+                 1 0 0 1 173 285 Tm (and more text) Tj \
+                 1 0 0 1 40 270 Tm (Third line of the paragraph) Tj \
+                 /F1 10 Tf 1 0 0 1 47 100 Tm (Footnote at the bottom) Tj \
+                 /F1 8 Tf 1 0 0 1 165 290.5 Tm (1) Tj \
+                 /F1 7 Tf 1 0 0 1 40 104 Tm (1) Tj ET"
+            };
+            let text = page_glyphs(ops);
+            let start = text.nearest(40.0, 95.0).unwrap();
+            let end = text.nearest(185.0, 128.0).unwrap();
+            assert_eq!(
+                text.text_of(start..end + 1),
+                "First line of the paragraph\nSecond line with a note1 and more text\nThird line of the paragraph",
+                "inline={inline}"
+            );
+            assert_eq!(text.line_rects(start..end + 1).len(), 3, "three selected lines, inline={inline}");
+            assert_eq!(
+                text.plain_text(),
+                "First line of the paragraph\nSecond line with a note1 and more text\nThird line of the paragraph\n1 Footnote at the bottom",
+                "inline={inline}"
+            );
+        }
+
+        // Superscript on the first line, multi-character bracketed reference `[12]` on the second
+        // line, and subscript on the third line (both inline and out-of-order).
+        for inline in [true, false] {
+            let ops = if inline {
+                "BT /F1 12 Tf 1 0 0 1 40 300 Tm (Opening claim) Tj \
+                 /F1 8 Tf 5.5 Ts (1) Tj 0 Ts \
+                 /F1 12 Tf ( in the first line) Tj \
+                 1 0 0 1 40 285 Tm (Middle citation) Tj \
+                 /F1 8 Tf 5.5 Ts ([12]) Tj 0 Ts \
+                 /F1 12 Tf ( continues here) Tj \
+                 1 0 0 1 40 270 Tm (Formula H) Tj \
+                 /F1 8 Tf -3 Ts (2) Tj 0 Ts \
+                 /F1 12 Tf (O in the third line) Tj ET"
+            } else {
+                "BT /F1 12 Tf 1 0 0 1 40 300 Tm (Opening claim) Tj \
+                 1 0 0 1 125 300 Tm (in the first line) Tj \
+                 1 0 0 1 40 285 Tm (Middle citation) Tj \
+                 1 0 0 1 135 285 Tm (continues here) Tj \
+                 1 0 0 1 40 270 Tm (Formula H) Tj \
+                 1 0 0 1 101 270 Tm (O in the third line) Tj \
+                 /F1 8 Tf 1 0 0 1 117 305.5 Tm (1) Tj \
+                 1 0 0 1 117 290.5 Tm ([12]) Tj \
+                 1 0 0 1 96.5 267 Tm (2) Tj ET"
+            };
+            let text = page_glyphs(ops);
+            assert_eq!(
+                text.plain_text(),
+                "Opening claim1 in the first line\nMiddle citation[12] continues here\nFormula H2O in the third line",
+                "inline={inline}"
+            );
+            assert_eq!(text.line_rects(0..text.glyphs.len()).len(), 3, "inline={inline}");
+        }
+
+        // Justified wide gap (18pt = 1.5 * h) after an inline superscript stays on the same line,
+        // and an out-of-order superscript kerned slightly over punctuation does not break the host
+        // word via overprint collision.
+        let justified = page_glyphs(
+            "BT /F1 12 Tf 1 0 0 1 40 300 Tm (Justified clause.) Tj \
+             /F1 8 Tf 5.5 Ts (1) Tj 0 Ts \
+             /F1 12 Tf 1 0 0 1 151 300 Tm (Next sentence on the same line) Tj \
+             1 0 0 1 40 285 Tm (Kerned clause.) Tj \
+             1 0 0 1 130 285 Tm (continues cleanly) Tj \
+             /F1 8 Tf 1 0 0 1 118 290.5 Tm (2) Tj ET",
+        );
+        assert_eq!(justified.plain_text(), "Justified clause.1 Next sentence on the same line\nKerned clause.2 continues cleanly");
+        assert_eq!(justified.line_rects(0..justified.glyphs.len()).len(), 2);
+    }
 }

From 0b63f5a4ba6ef9b40703528953715cddc9e021d7 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Sat, 17 Oct 2026 05:43:46 +0200
Subject: [PATCH 016/270] fix(edit): check page backdrops with one page-tree
 walk per batch

Review of #2815: `page_of` built every page to return one, and the Add
Background dialog checked 24 pages a frame that way, so a frame cost
24 page-tree walks (93 ms at 5,000 pages, 385 ms at 20,000).

- `page_backdrops(doc, pages)` walks the tree once for a batch; the
  dialog checks one batch a frame and `doc_backdrops` one batch in all.
  A page past the end answers None without hiding the others (the
  viewer's page count can disagree with the page tree's).
- `scan` and `replace` take the page; `add_background` no longer walks
  the tree twice more per page to replace a backdrop.
- Tests: 4,000 pages checked in one batch under a generous bound (17.6 s
  with the old lookup), batch order and missing pages, and a background
  over several pages sharing streams, replaced and restored.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/src/lib.rs      |  7 ++--
 crates/edit/src/backdrop.rs       | 52 ++++++++++++-----------
 crates/edit/src/backdrop_tests.rs | 68 +++++++++++++++++++++++++++++++
 crates/edit/src/lib.rs            |  8 ++--
 crates/engine/src/lib.rs          |  9 ++++
 crates/ui-egui/src/marks_ui.rs    | 24 ++++++++---
 6 files changed, 131 insertions(+), 37 deletions(-)

diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 564dd8e882..ba4bf7ced8 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -1182,9 +1182,10 @@ impl Automation {
         };
         let doc = self.doc(a)?;
         let found: Vec<Value> = pages
-            .into_iter()
-            .filter_map(|p| {
-                let kind = match doc.page_backdrop(p)? {
+            .iter()
+            .zip(doc.page_backdrops(&pages))
+            .filter_map(|(p, found)| {
+                let kind = match found? {
                     pdfcraft_engine::Backdrop::Fill => "fill",
                     pdfcraft_engine::Backdrop::Image => "image",
                 };
diff --git a/crates/edit/src/backdrop.rs b/crates/edit/src/backdrop.rs
index d15652f82b..967a8f9121 100644
--- a/crates/edit/src/backdrop.rs
+++ b/crates/edit/src/backdrop.rs
@@ -25,7 +25,8 @@ const SCAN_BYTES: usize = 64 * 1024;
 const SCAN_OPS: usize = 4096;
 /// How far (in points) a backdrop may fall short of the crop box and still count as covering it.
 const COVER_EPS: f64 = 1.0;
-/// Components at least this close to white (per channel) count as white.
+/// Components at least this close to white (per channel) count as white: a near-white fill
+/// (`0.99 g`) is a backdrop too, and replacing it changes the page by at most 2%.
 const WHITE: f64 = 0.98;
 
 /// What paints a page's backdrop.
@@ -57,15 +58,26 @@ struct State {
     opaque: bool,
 }
 
-/// The backdrop `page` (0-based) paints, if any.
+/// The backdrop `page` (0-based) paints, if any. Finding the page walks the page tree, so to
+/// check many pages use [`page_backdrops`], which walks it once.
 pub fn page_backdrop(doc: &Document, page: usize) -> Result<Option<Backdrop>, EditError> {
-    Ok(scan(doc, page)?.map(|(b, _)| b))
+    let all = pdfcraft_model::pages(doc);
+    let p = all.get(page).ok_or(EditError::NoSuchPage(page))?;
+    Ok(scan(doc, p).map(|(b, _)| b))
+}
+
+/// The backdrop each of `pages` (0-based) paints, in the same order, walking the page tree once.
+/// A page past the end has none, and doesn't hide what the others paint: a page count taken
+/// elsewhere (the viewer's) can disagree with the page tree's on a malformed document.
+pub fn page_backdrops(doc: &Document, pages: &[usize]) -> Vec<Option<Backdrop>> {
+    let all = pdfcraft_model::pages(doc);
+    pages.iter().map(|&p| all.get(p).and_then(|page| scan(doc, page)).map(|(b, _)| b)).collect()
 }
 
 /// Replace `page`'s white backdrop fill, if it has one (see the module doc). Returns whether it
-/// did. A picture backdrop is left alone.
-pub(crate) fn replace(doc: &mut Document, page: usize) -> Result<bool, EditError> {
-    let Some((Backdrop::Fill, Some(found))) = scan(doc, page)? else { return Ok(false) };
+/// did; when it did, `page` no longer matches the document. A picture backdrop is left alone.
+pub(crate) fn replace(doc: &mut Document, page: &pdfcraft_model::Page) -> Result<bool, EditError> {
+    let Some((Backdrop::Fill, Some(found))) = scan(doc, page) else { return Ok(false) };
     let edited = found.pieces.splice([(found.op.clone(), b"n".to_vec())]);
     let piece = found.pieces.piece_of(found.op.start);
     let (Some(&(slot, original)), Some(bytes)) = (found.refs.get(piece), edited.get(piece)) else { return Ok(false) };
@@ -80,11 +92,10 @@ pub(crate) fn replace(doc: &mut Document, page: usize) -> Result<bool, EditError
     let mut dict = Dict::new();
     dict.set(b"PCBackdrop".to_vec(), Object::Dict(note));
     let copy = doc.add(Object::Stream(Stream::flate(dict, bytes)));
-    let p = page_of(doc, page)?;
-    let mut list = crate::contents(doc, &p)?;
+    let mut list = crate::contents(doc, page)?;
     let Some(entry) = list.get_mut(slot) else { return Ok(false) };
     *entry = Object::Ref(copy);
-    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+    doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
     Ok(true)
 }
 
@@ -124,20 +135,13 @@ fn unchanged_copy_of(doc: &Document, entry: &Object) -> Option<ObjRef> {
     (copy.decoded().ok()? == expect).then_some(*original)
 }
 
-fn page_of(doc: &Document, page: usize) -> Result<pdfcraft_model::Page, EditError> {
-    pdfcraft_model::pages(doc).into_iter().nth(page).ok_or(EditError::NoSuchPage(page))
-}
-
 /// Find the backdrop, and for a fill, where it is.
-fn scan(doc: &Document, page: usize) -> Result<Option<(Backdrop, Option<Found>)>, EditError> {
-    let p = page_of(doc, page)?;
+fn scan(doc: &Document, p: &pdfcraft_model::Page) -> Option<(Backdrop, Option<Found>)> {
     let crop = p.crop(doc);
-    let list: Vec<Object> = match p.dict.get(b"Contents") {
-        None => return Ok(None),
-        Some(c) => match &*doc.resolve(c) {
-            Object::Array(a) => a.clone(),
-            _ => vec![c.clone()],
-        },
+    let c = p.dict.get(b"Contents")?;
+    let list: Vec<Object> = match &*doc.resolve(c) {
+        Object::Array(a) => a.clone(),
+        _ => vec![c.clone()],
     };
     // The page's own content: untagged streams (marks and the q/Q wrapper carry /PCMark). Read
     // only as far as a backdrop could be.
@@ -148,7 +152,7 @@ fn scan(doc: &Document, page: usize) -> Result<Option<(Backdrop, Option<Found>)>
         if total >= SCAN_BYTES {
             break;
         }
-        let Object::Ref(r) = o else { return Ok(None) };
+        let Object::Ref(r) = o else { return None };
         let obj = doc.get(*r);
         let Object::Stream(s) = &*obj else { continue };
         if s.dict.get(b"PCMark").is_some() {
@@ -164,10 +168,10 @@ fn scan(doc: &Document, page: usize) -> Result<Option<(Backdrop, Option<Found>)>
     let parsed = pdfcraft_content::parse(head);
     let res = resources(doc, &p.dict);
     let found = walk(doc, &res, crop, &parsed.ops);
-    Ok(found.map(|(b, op)| match (b, op) {
+    found.map(|(b, op)| match (b, op) {
         (Backdrop::Fill, Some(op)) => (b, Some(Found { refs, pieces, op })),
         _ => (b, None),
-    }))
+    })
 }
 
 fn resources(doc: &Document, page: &Dict) -> Dict {
diff --git a/crates/edit/src/backdrop_tests.rs b/crates/edit/src/backdrop_tests.rs
index 88f058b4f5..5dc1d80e41 100644
--- a/crates/edit/src/backdrop_tests.rs
+++ b/crates/edit/src/backdrop_tests.rs
@@ -231,3 +231,71 @@ fn pages_without_content_or_with_odd_contents_have_no_backdrop() {
     assert_eq!(page_backdrop(&doc, 1).unwrap(), None);
     assert!(matches!(page_backdrop(&doc, 7), Err(EditError::NoSuchPage(7))));
 }
+
+/// `pages` 300 × 200 pages in a flat tree; even pages paint a white backdrop, odd ones don't.
+fn many_pages(pages: usize) -> Document {
+    let kids: Vec<String> = (0..pages).map(|i| format!("{} 0 R", i + 5)).collect();
+    let mut objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        format!("<< /Type /Pages /Kids [{}] /Count {pages} /MediaBox [0 0 300 200] >>", kids.join(" ")),
+        stream("", &format!("1 g 0 0 300 200 re f 0 g {TEXT}")),
+        stream("", TEXT),
+    ];
+    objs.extend((0..pages).map(|i| format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R >>", 3 + i % 2)));
+    build(&objs)
+}
+
+#[test]
+fn checking_many_pages_walks_the_page_tree_once() {
+    // The Add Background dialog checks every page of a long document. Looking each page up on
+    // its own walked the whole tree per page, so checking them all grew with the square of the
+    // page count (minutes at 20,000 pages); one walk keeps it in proportion.
+    const PAGES: usize = 4000;
+    let doc = many_pages(PAGES);
+    let all: Vec<usize> = (0..PAGES).collect();
+    let start = std::time::Instant::now();
+    let found = page_backdrops(&doc, &all);
+    let took = start.elapsed();
+    assert_eq!(found.len(), PAGES);
+    for (i, f) in found.iter().enumerate() {
+        assert_eq!(*f, (i % 2 == 0).then_some(Backdrop::Fill), "page {i}");
+    }
+    assert!(took < std::time::Duration::from_secs(5), "checking {PAGES} pages took {took:?}");
+}
+
+#[test]
+fn a_batch_answers_in_the_order_asked_and_a_missing_page_hides_nothing() {
+    let doc = many_pages(5);
+    assert_eq!(page_backdrops(&doc, &[3, 0, 0]), [None, Some(Backdrop::Fill), Some(Backdrop::Fill)]);
+    assert_eq!(page_backdrops(&doc, &[]), []);
+    // The viewer can count more pages than the page tree holds: the others still answer.
+    assert_eq!(page_backdrops(&doc, &[2, 5, usize::MAX]), [Some(Backdrop::Fill), None, None]);
+    assert_eq!(page_backdrop(&doc, 4).unwrap(), Some(Backdrop::Fill));
+    assert!(matches!(page_backdrop(&doc, 5), Err(EditError::NoSuchPage(5))));
+}
+
+#[test]
+fn a_background_over_many_pages_replaces_each_backdrop_and_removing_restores_them() {
+    // Pages share their content streams, so each replaced page gets its own copy and the rest
+    // are checked against the document as it is after the earlier ones.
+    let mut doc = many_pages(4);
+    let all = [0, 1, 2, 3];
+    let before: Vec<Object> = pdfcraft_model::pages(&doc).iter().filter_map(|p| p.dict.get(b"Contents").cloned()).collect();
+    add_background(&mut doc, &all, &red(), true).unwrap();
+    assert_eq!(page_backdrops(&doc, &all), [None; 4]);
+    // Update: the backdrops are gone already, so nothing is copied again.
+    add_background(&mut doc, &all, &red(), true).unwrap();
+    assert_eq!(page_backdrops(&doc, &all), [None; 4]);
+    remove_marks(&mut doc, &all, MarkKind::Background).unwrap();
+    let after: Vec<Object> = pdfcraft_model::pages(&doc).iter().filter_map(|p| p.dict.get(b"Contents").cloned()).collect();
+    let refs = |list: &[Object]| -> Vec<Vec<Object>> {
+        list.iter()
+            .map(|c| match &*doc.resolve(c) {
+                Object::Array(a) => a.clone(),
+                _ => vec![c.clone()],
+            })
+            .collect()
+    };
+    assert_eq!(refs(&after), refs(&before), "every page points at its original stream again");
+    assert_eq!(page_backdrops(&doc, &all), [Some(Backdrop::Fill), None, Some(Backdrop::Fill), None]);
+}
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index a8ab1d51b5..802a258eb7 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -599,10 +599,10 @@ pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, repl
     }
     let opacity = if bg.opacity.is_finite() { bg.opacity.clamp(0.0, 1.0) } else { 1.0 };
     for &i in pages {
-        if bg.replace_backdrop {
-            backdrop::replace(doc, i)?;
+        let mut page = page_list(doc)[i].clone();
+        if bg.replace_backdrop && backdrop::replace(doc, &page)? {
+            page = page_list(doc)[i].clone();
         }
-        let page = page_list(doc)[i].clone();
         let (w, h) = page.display_size(doc);
         let mut content = begin(MarkKind::Background, "Background", page.view_matrix(doc));
         match &bg.source {
@@ -659,7 +659,7 @@ pub fn marks_present(doc: &Document) -> Vec<MarkKind> {
 }
 
 pub mod backdrop;
-pub use backdrop::{Backdrop, page_backdrop};
+pub use backdrop::{Backdrop, page_backdrop, page_backdrops};
 pub mod objects;
 pub use objects::{EditableObject, MAX_MOVE_OBJECTS, ObjectKind, ObjectTarget, editable_objects, move_objects};
 
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 0f81fb22de..0967f56524 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -504,6 +504,15 @@ impl Document {
         self.editor.as_ref().and_then(|e| pdfcraft_edit::page_backdrop(&e.cos, page).ok().flatten())
     }
 
+    /// [`Self::page_backdrop`] for each of `pages`, in order, walking the page tree once: the
+    /// way to check many pages. A page out of range has none.
+    pub fn page_backdrops(&self, pages: &[usize]) -> Vec<Option<pdfcraft_edit::Backdrop>> {
+        match &self.editor {
+            Some(e) => pdfcraft_edit::page_backdrops(&e.cos, pages),
+            None => vec![None; pages.len()],
+        }
+    }
+
     /// Edit a PDF: the images `page` draws (0-based).
     pub fn page_images(&self, page: usize) -> Vec<pdfcraft_edit::PageImage> {
         self.editor.as_ref().and_then(|e| pdfcraft_edit::page_images(&e.cos, page).ok()).unwrap_or_default()
diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index ed2490737c..c838f7861e 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -105,14 +105,26 @@ impl BackdropCheck {
             self.key = Some(key);
             self.pages = vec![None; count];
         }
-        let mut budget = BACKDROP_PAGES_PER_FRAME;
+        // One batch a frame: finding a page walks the page tree, so the batch shares one walk.
+        let mut batch = Vec::with_capacity(BACKDROP_PAGES_PER_FRAME);
+        for &p in pages {
+            if batch.len() >= BACKDROP_PAGES_PER_FRAME {
+                break;
+            }
+            if matches!(self.pages.get(p), Some(None)) && !batch.contains(&p) {
+                batch.push(p);
+            }
+        }
+        if !batch.is_empty() {
+            for (p, found) in batch.iter().zip(doc.page_backdrops(&batch)) {
+                if let Some(slot) = self.pages.get_mut(*p) {
+                    *slot = Some(found);
+                }
+            }
+        }
         let mut n = BackdropCount::default();
         for &p in pages {
-            let Some(slot) = self.pages.get_mut(p) else { continue };
-            if slot.is_none() && budget > 0 {
-                *slot = Some(doc.page_backdrop(p));
-                budget -= 1;
-            }
+            let Some(slot) = self.pages.get(p) else { continue };
             match slot {
                 None => n.pending += 1,
                 Some(Some(Backdrop::Fill)) => n.fills += 1,

From 341e006b950dd38ecaf3f54d58e0cf18fd0d735f Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Sat, 17 Oct 2026 20:53:54 +0800
Subject: [PATCH 017/270] fix(render): batch out-of-order script merges and pin
 leading-script extend_box (#2929)

---
 crates/render/src/text.rs | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index 064a68d093..b2a2d914c5 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -1477,7 +1477,8 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
             }
         }
         if !merged {
-            for b in 0..segs.len() {
+            let mut b = 0;
+            while b < segs.len() {
                 let sb = &segs[b];
                 let best_host = (0..segs.len())
                     .filter(|&a| {
@@ -1494,7 +1495,8 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
                     let a = if b < a { a - 1 } else { a };
                     segs[a].merge(sb);
                     merged = true;
-                    break;
+                } else {
+                    b += 1;
                 }
             }
         }
@@ -2804,5 +2806,17 @@ mod tests {
         );
         assert_eq!(justified.plain_text(), "Justified clause.1 Next sentence on the same line\nKerned clause.2 continues cleanly");
         assert_eq!(justified.line_rects(0..justified.glyphs.len()).len(), 2);
+
+        // A line that begins with a raised superscript marker and continues with taller body text
+        // adopts the body text's vertical band (Seg::extend_box first branch) so a later
+        // out-of-order superscript on that line still measures against the body baseline.
+        let leading_script = page_glyphs(
+            "BT /F1 8 Tf 1 0 0 1 40 300 Tm 6 Ts (1) Tj 0 Ts \
+             /F1 12 Tf ( See the appendix) Tj \
+             1 0 0 1 146 300 Tm (for details) Tj \
+             /F1 8 Tf 1 0 0 1 139 303.6 Tm (2) Tj ET",
+        );
+        assert_eq!(leading_script.plain_text(), "1 See the appendix2 for details");
+        assert_eq!(leading_script.line_rects(0..leading_script.glyphs.len()).len(), 1);
     }
 }

From 22064736cd7bd9a7163a60089e19bd27dced36fa Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Sun, 18 Oct 2026 11:00:07 +0800
Subject: [PATCH 018/270] M2: pin leading superscript line geometry regression
 (#2929)

---
 ROADMAP.md                |  2 ++
 crates/render/src/text.rs | 27 ++++++++++++++++++++++++++-
 docs/roadmap.md           |  2 +-
 3 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index c895ed2c3d..9501136aab 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -160,6 +160,8 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 | 8 | 1.0 polish: performance, right-to-left, missing languages, keyboard-only (M14) | 55–95 |
 
 ## Progress log
+
+- **2026-10-18 (M2, #2929):** Pin leading-superscript segment height and baseline separately from the selection highlight, which includes the raised marker. Regression assertions distinguish the body band from a union pulled upward by the marker; estimates unchanged.
 - **2026-10-15 (M6, AcroForm XML text):** Plain AcroForm XML imports retain all direct text around comments and processing instructions, including CDATA and character references. Synthetic regressions verify exact values and unknown catalog data after incremental and full save/reopen. Nested-element and XFA interpretation are unchanged. Estimates unchanged.
 - **2026-10-15 (M6, #1917 refresh):** Integrated upstream `99941daa` while retaining the XML/XFDF attribute whitespace correction and all upstream progress. Only independent documentation conflicts required resolution; focused production and test files are unchanged from the previously green CI head. Estimates unchanged.
 - **2026-10-15 (M1, #2267 refresh):** Integrated upstream `99941daa` while retaining the raw-deflate fallback correction and all upstream progress. Only independent documentation conflicts required resolution; focused production and test files are unchanged from the previously green CI head. Estimates unchanged.
diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index b2a2d914c5..11bdd0c590 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -2817,6 +2817,31 @@ mod tests {
              /F1 8 Tf 1 0 0 1 139 303.6 Tm (2) Tj ET",
         );
         assert_eq!(leading_script.plain_text(), "1 See the appendix2 for details");
-        assert_eq!(leading_script.line_rects(0..leading_script.glyphs.len()).len(), 1);
+        let rects = leading_script.line_rects(0..leading_script.glyphs.len());
+        assert_eq!(rects.len(), 1);
+        let marker = leading_script.glyphs.first().unwrap().rect;
+        let body = leading_script.glyphs.iter().find(|g| g.text == "S").unwrap().rect;
+        let last = leading_script.glyphs.last().unwrap().rect;
+        assert!(marker[1] < body[1] && marker[3] < body[3], "marker must be raised above the body");
+        let close = |actual: f32, expected: f32| assert!((actual - expected).abs() < 0.001, "{actual} != {expected}");
+        // Highlight rectangles cover the actual glyphs, including the raised marker. They do
+        // not expose the segment's baseline band used for line grouping.
+        for (actual, expected) in rects[0].into_iter().zip([marker[0], marker[1], last[2], body[3]]) {
+            close(actual, expected);
+        }
+        close(rects[0][3] - rects[0][1], 14.8);
+        close(body[3] - 0.2 * 12.0, 100.0); // 300 pt PDF baseline on a 400 pt page.
+
+        // Pin that internal band too: replacing the first extend_box condition with `false`
+        // must fail here even when plain text and highlight rectangles remain unchanged.
+        let mut segment = Seg::new(Run { start: 0, end: 1 }, marker, marker[3] - marker[1]);
+        segment.extend_box(&body, body[3] - body[1]);
+        for (actual, expected) in segment.bbox.into_iter().zip([marker[0], body[1], body[2], body[3]]) {
+            close(actual, expected);
+        }
+        close(segment.h, 12.0);
+        close(segment.bbox[3] - segment.bbox[1], 12.0);
+        close(segment.bbox[3] - 0.2 * segment.h, 100.0);
+        close(segment.cy(), (body[1] + body[3]) / 2.0);
     }
 }
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 2c65496b6e..8bbf6e7b07 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -101,7 +101,7 @@ total matches the parity estimate.
 |---|---|---|---|---|---|
 | M0 | Skeleton: workspace, xtask gates, CI | 15–30 | 98% | 1–2 | GitHub workflow, `deny.toml` (licence audit of every dependency), parity checklist (826 features, `xtask parity`) done. Missing: remaining crate stubs, testkit/oracle crates |
 | M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 80% | 20–40 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. An unchanged incremental save of a classic table writes a zero-length cross-reference subsection instead of a section with no subsections (#1339). A full rewrite keeps unknown trailer entries, including objects reachable only from them (#1338). Fuzzing runs nightly (`xtask fuzz`). Raw-deflate fallback preserves decoding-limit errors, including through tolerant COS stream decoding. Refreshed against upstream `99941daa` (2026-10-15). Missing: ≥ 250 tests, own image codecs |
-| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized. |
+| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized.  Leading-superscript regression coverage checks the body segment height and baseline separately from glyph-union highlights (#2929). |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. The renderer keeps its one-point crop-size floor in physical points after UserUnit scaling, with regression coverage for crop origins, rotations and f32 reciprocal rounding. Existing unit policy and nearly-zero fallback are retained. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. |

From eca16e6bd50f6261e9af557809eb842d199a56fe Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Sun, 18 Oct 2026 16:24:14 +0200
Subject: [PATCH 019/270] fix(edit): backdrop copies keep the stream dictionary
 and every slot

Review of #2815 (CodeRabbit):

- A content stream whose bytes live in an external file (`/F`) draws
  those, not its inline bytes, so it is never taken for a backdrop.
- The copy keeps the original stream dictionary, unknown entries
  included, less `Length` and `DL` (Flate re-encodes it); it had started
  from an empty dictionary.
- Every `/Contents` slot that lists the original stream gets the copy: a
  page listing the same stream twice painted the white fill again over
  the background.
- The Background dialog starts with replacing on each time it opens.
  Update restores backdrops before re-applying, so a replaced page shows
  no fill and no checkbox, and a choice left off from an earlier dialog
  hid the background again unseen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/edit/src/backdrop.rs            | 29 +++++++++++---
 crates/edit/src/backdrop_tests.rs      | 52 ++++++++++++++++++++++++++
 crates/ui-egui/src/commands.rs         |  1 +
 crates/ui-egui/src/lib.rs              |  3 ++
 crates/ui-egui/src/marks_ui.rs         | 12 ++++++
 crates/ui-egui/tests/ui_group/marks.rs | 16 +++++---
 6 files changed, 102 insertions(+), 11 deletions(-)

diff --git a/crates/edit/src/backdrop.rs b/crates/edit/src/backdrop.rs
index 967a8f9121..86924b8cb7 100644
--- a/crates/edit/src/backdrop.rs
+++ b/crates/edit/src/backdrop.rs
@@ -80,7 +80,7 @@ pub(crate) fn replace(doc: &mut Document, page: &pdfcraft_model::Page) -> Result
     let Some((Backdrop::Fill, Some(found))) = scan(doc, page) else { return Ok(false) };
     let edited = found.pieces.splice([(found.op.clone(), b"n".to_vec())]);
     let piece = found.pieces.piece_of(found.op.start);
-    let (Some(&(slot, original)), Some(bytes)) = (found.refs.get(piece), edited.get(piece)) else { return Ok(false) };
+    let (Some(&(_, original)), Some(bytes)) = (found.refs.get(piece), edited.get(piece)) else { return Ok(false) };
     // Where the operator sits in that piece: the joined offset less the pieces before it.
     let before: usize = (0..piece).filter_map(|i| edited.get(i)).map(|p| p.len() + 1).sum();
     let at = found.op.start.saturating_sub(before);
@@ -89,14 +89,27 @@ pub(crate) fn replace(doc: &mut Document, page: &pdfcraft_model::Page) -> Result
     note.set(b"Original".to_vec(), Object::Ref(original));
     note.set(b"At".to_vec(), Object::Int(i64::try_from(at).unwrap_or(i64::MAX)));
     note.set(b"Len".to_vec(), Object::Int(i64::try_from(len).unwrap_or(i64::MAX)));
-    let mut dict = Dict::new();
+    // The copy keeps the original's dictionary (unknown entries included) less what describes
+    // the old encoding; `scan` refused streams whose bytes live in an external file (`/F`).
+    let Object::Stream(source) = &*doc.get(original) else { return Ok(false) };
+    let mut dict = source.dict.clone();
+    for key in [&b"Length"[..], b"DL", b"PCBackdrop"] {
+        dict.remove(key);
+    }
     dict.set(b"PCBackdrop".to_vec(), Object::Dict(note));
     let copy = doc.add(Object::Stream(Stream::flate(dict, bytes)));
+    // Every slot that draws the original: a page may list the same stream twice, and a second
+    // copy of the fill would cover the background again.
     let mut list = crate::contents(doc, page)?;
-    let Some(entry) = list.get_mut(slot) else { return Ok(false) };
-    *entry = Object::Ref(copy);
-    doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
-    Ok(true)
+    let mut replaced = false;
+    for entry in list.iter_mut().filter(|o| matches!(o, Object::Ref(r) if *r == original)) {
+        *entry = Object::Ref(copy);
+        replaced = true;
+    }
+    if replaced {
+        doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+    }
+    Ok(replaced)
 }
 
 /// Put back the original content streams [`replace`] copied on `page`, where the copy is still
@@ -158,6 +171,10 @@ fn scan(doc: &Document, p: &pdfcraft_model::Page) -> Option<(Backdrop, Option<Fo
         if s.dict.get(b"PCMark").is_some() {
             continue;
         }
+        // Bytes in an external file (`/F`) replace the stream's own: what it draws is unknown here.
+        if s.dict.get(b"F").is_some() {
+            return None;
+        }
         let bytes = s.decoded().unwrap_or_default();
         total = total.saturating_add(bytes.len()).saturating_add(1);
         refs.push((slot, *r));
diff --git a/crates/edit/src/backdrop_tests.rs b/crates/edit/src/backdrop_tests.rs
index 5dc1d80e41..1c0744b59c 100644
--- a/crates/edit/src/backdrop_tests.rs
+++ b/crates/edit/src/backdrop_tests.rs
@@ -299,3 +299,55 @@ fn a_background_over_many_pages_replaces_each_backdrop_and_removing_restores_the
     assert_eq!(refs(&after), refs(&before), "every page points at its original stream again");
     assert_eq!(page_backdrops(&doc, &all), [Some(Backdrop::Fill), None, Some(Backdrop::Fill), None]);
 }
+
+#[test]
+fn a_content_stream_whose_bytes_live_in_an_external_file_is_left_alone() {
+    let objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents [4 0 R] >>".into(),
+        stream("/F (content.bin)", &format!("1 g 0 0 300 200 re f {TEXT}")),
+    ];
+    let mut doc = build(&objs);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), None, "the inline bytes are not what the page draws");
+    let before = streams(&doc);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    assert_eq!(streams(&doc)[1..], before[..]);
+}
+
+#[test]
+fn the_backdrop_copy_keeps_the_original_dictionary_less_its_old_encoding() {
+    let objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents [4 0 R] >>".into(),
+        stream("/Vendor (keep me) /DL 9999", &format!("1 g 0 0 300 200 re f {TEXT}")),
+    ];
+    let mut doc = build(&objs);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    let doc = reopen(&doc);
+    let p = &pdfcraft_model::pages(&doc)[0];
+    let Some(Object::Array(list)) = p.dict.get(b"Contents").map(|c| (*doc.resolve(c)).clone()) else { panic!("contents") };
+    let Object::Stream(copy) = &*doc.resolve(&list[1]) else { panic!("a stream") };
+    assert!(copy.dict.get(b"Vendor").is_some(), "unknown entries survive");
+    assert!(copy.dict.get(b"DL").is_none(), "the old decoded length no longer holds");
+    assert!(copy.dict.get(b"PCBackdrop").is_some());
+    assert_eq!(String::from_utf8_lossy(&copy.decoded().unwrap()), format!("1 g 0 0 300 200 re n {TEXT}"));
+}
+
+#[test]
+fn a_stream_listed_twice_is_replaced_in_both_slots_and_restored_in_both() {
+    let mut doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents [4 0 R 4 0 R] >>".into(),
+        stream("", &format!("q 1 g 0 0 300 200 re f Q {TEXT}")),
+    ]);
+    let original = streams(&doc);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    let s = streams(&doc);
+    assert_eq!(s.len(), 3, "{s:?}");
+    assert!(s[1..].iter().all(|c| c.contains("re n") && !c.contains("re f")), "no slot still paints the white fill: {s:?}");
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&doc), original);
+}
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 832ce7cfbd..d32aedeef9 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -371,6 +371,7 @@ impl PdfCraftApp {
                     K::Background
                 };
                 self.marks_draft.replace = id.ends_with(".update");
+                self.marks_draft.opened(kind);
                 self.dialog = Some(Dialog::Marks(kind));
             }
             "edit.bates" => {
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 725bcad4b0..3e817d2717 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -2557,6 +2557,9 @@ impl PdfCraftApp {
                     }
                     "none" => None,
                     _ => Some(Dialog::About),
+                };
+                if let Some(Dialog::Marks(kind)) = self.dialog {
+                    self.marks_draft.opened(kind);
                 }
             }
             ("tools", _) => self.all_tools_expanded = value != "collapsed",
diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index c838f7861e..a555b437e2 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -136,6 +136,18 @@ impl BackdropCheck {
     }
 }
 
+impl MarksDraft {
+    /// The dialog for `kind` is opening. Other settings carry over from last time, but replacing
+    /// a page's own backdrop starts on: Update restores backdrops before it re-applies, so a
+    /// page whose backdrop was replaced shows none and the checkbox stays hidden, and a choice
+    /// left off from an earlier dialog would hide the background again unseen.
+    pub fn opened(&mut self, kind: MarkKind) {
+        if kind == MarkKind::Background {
+            self.bg.replace_backdrop = true;
+        }
+    }
+}
+
 /// "1 page" or "{n} pages", in a message.
 fn pages_phrase(n: usize, one: &str, many: &str) -> String {
     if n == 1 { one.to_string() } else { crate::i18n::fmt(many, &[("n", &n.to_string())]) }
diff --git a/crates/ui-egui/tests/ui_group/marks.rs b/crates/ui-egui/tests/ui_group/marks.rs
index 3a9864ea47..20b8a41a19 100644
--- a/crates/ui-egui/tests/ui_group/marks.rs
+++ b/crates/ui-egui/tests/ui_group/marks.rs
@@ -148,18 +148,24 @@ fn the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scan
     assert_eq!(backdrop(&h, 0), Some(pdfcraft_engine::Backdrop::Fill));
     assert!(h.state_mut().execute("edit.undo"));
     h.run_steps(2);
-    // Ticked, it is replaced; the scan is reported, not touched.
+    // Reopened, the choice starts on again; ticked, the backdrop is replaced and the scan is
+    // reported, not touched.
     h.state_mut().execute("edit.background");
     h.run_steps(3);
-    h.get_by_label(replace).click();
-    h.run_steps(2);
-    assert!(h.state().marks_draft.bg.replace_backdrop);
+    h.get_by_label(replace);
+    assert!(h.state().marks_draft.bg.replace_backdrop, "on again when the dialog opens");
     h.get_by_label("OK").click();
     h.run_steps(3);
     assert_eq!(backdrop(&h, 0), None);
     assert_eq!(backdrop(&h, 1), Some(pdfcraft_engine::Backdrop::Image));
-    // Nothing left to replace: the offer is gone.
+    // Nothing left to replace: the offer is gone. A choice left off from an earlier dialog
+    // doesn't carry into Update, which restores the backdrop first and would otherwise keep it
+    // with no checkbox shown.
+    h.state_mut().marks_draft.bg.replace_backdrop = false;
     h.state_mut().execute("edit.background.update");
     h.run_steps(3);
     assert!(h.query_by_label(replace).is_none());
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert_eq!(backdrop(&h, 0), None, "Update keeps the backdrop replaced");
 }

From 2512b49f803ed74d50932076b8ba8ffcc7fd2e2e Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Mon, 19 Oct 2026 04:59:52 +0800
Subject: [PATCH 020/270] test(render): derive leading-superscript selection
 range via Text::nearest (#2960)

---
 crates/render/src/text.rs | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index 7f1cd3aea6..e4b883c351 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -2966,11 +2966,17 @@ mod tests {
              /F1 8 Tf 1 0 0 1 139 303.6 Tm (2) Tj ET",
         );
         assert_eq!(leading_script.plain_text(), "1 See the appendix2 for details");
-        let rects = leading_script.line_rects(0..leading_script.glyphs.len());
-        assert_eq!(rects.len(), 1);
         let marker = leading_script.glyphs.first().unwrap().rect;
         let body = leading_script.glyphs.iter().find(|g| g.text == "S").unwrap().rect;
         let last = leading_script.glyphs.last().unwrap().rect;
+        let center = |r: [f32; 4]| ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+        let (start_x, start_y) = center(marker);
+        let (end_x, end_y) = center(last);
+        let start = leading_script.nearest(start_x, start_y).unwrap();
+        let end = leading_script.nearest(end_x, end_y).unwrap();
+        assert_eq!(leading_script.text_of(start..end + 1), "1 See the appendix2 for details");
+        let rects = leading_script.line_rects(start..end + 1);
+        assert_eq!(rects.len(), 1);
         assert!(marker[1] < body[1] && marker[3] < body[3], "marker must be raised above the body");
         let close = |actual: f32, expected: f32| assert!((actual - expected).abs() < 0.001, "{actual} != {expected}");
         // Highlight rectangles cover the actual glyphs, including the raised marker. They do

From 198f551fa7d48c137578c291ada21b02f5837843 Mon Sep 17 00:00:00 2001
From: srt8hellcat2-ui <srt8hellcat2@gmail.com>
Date: Sun, 18 Oct 2026 19:57:26 -0400
Subject: [PATCH 021/270] docs: correct two-paged PR publication status

---
 docs/roadmap.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/roadmap.md b/docs/roadmap.md
index cde798d466..444d7b0633 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -113,7 +113,7 @@ total matches the parity estimate.
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. The renderer keeps its one-point crop-size floor in physical points after UserUnit scaling, with regression coverage for crop origins, rotations and f32 reciprocal rounding. Existing unit policy and nearly-zero fallback are retained. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
-| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. #3149: page-list changes discard render demand based on old geometry; actual raster dimensions are checked against the GPU limit before upload. Synthetic crash and continued-rendering regressions cover the replacement path. #1354 local candidate: --two-paged overrides follow named PDFs through background opens and password retries, preserve defaults and respect single-tab reuse. Native regressions, visual inspection, strict scoped Clippy and scoped WASM compilation pass; three existing Unix-socket tests require an unrestricted runtime. No push or GitHub merge. |
+| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. #3149: page-list changes discard render demand based on old geometry; actual raster dimensions are checked against the GPU limit before upload. Synthetic crash and continued-rendering regressions cover the replacement path. #1354 local candidate: --two-paged overrides follow named PDFs through background opens and password retries, preserve defaults and respect single-tab reuse. Native regressions, visual inspection, strict scoped Clippy and scoped WASM compilation pass; three existing Unix-socket tests require an unrestricted runtime. The PR branch is pushed but not merged into upstream. |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. Wrapped revision buttons stay above Binding in Document Properties (#2739); a synthetic UI test checks layout and saved revision content. |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Later native-open replies stay queued while a modal or picker owns the foreground; regressions cover recipient ownership, completion/cancellation and one-shot wakes. |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. #1980: exact quit modifiers preserve Ctrl+Alt+Q email input; Ctrl+Q/Cmd+Q asks before discarding unsaved documents. |

From ec34fc2c2d8b87cdfe9b7063a57a74eb6c507f73 Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Mon, 19 Oct 2026 12:54:45 +0800
Subject: [PATCH 022/270] fix(ui): pin session clock in prepare button-label
 test to prevent ModDate second-boundary flake

---
 crates/ui-egui/src/dialogs.rs   | 1 +
 crates/ui-egui/tests/prepare.rs | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index 981db214b2..9f5d18dc3a 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -1387,6 +1387,7 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
         app.props_draft = None;
         app.view_draft = None;
         app.bulk_field_props = None;
+        app.field_props = None;
     } else {
         app.dialog = Some(next);
     }
diff --git a/crates/ui-egui/tests/prepare.rs b/crates/ui-egui/tests/prepare.rs
index d63df5232c..3e9d80c0ae 100644
--- a/crates/ui-egui/tests/prepare.rs
+++ b/crates/ui-egui/tests/prepare.rs
@@ -254,6 +254,8 @@ fn options_tab_sets_the_check_box_style() {
 fn button_label_is_editable_without_renaming_the_field() {
     use pdfcraft_engine::{Edit, NewField};
     let mut h = harness();
+    // Saves stamp /ModDate from the clock; pinned, two saves compare equal across a second.
+    h.state_mut().session = std::mem::take(&mut h.state_mut().session).with_clock(|| 1_700_000_000);
     h.state_mut().apply_edit(Edit::AddField {
         page: 0,
         rect: [40.0, 300.0, 190.0, 330.0],

From 5b3b87430b493b7dc94bffdb13183bfd751ddc5e Mon Sep 17 00:00:00 2001
From: Philip <philip@philiptam.uk>
Date: Mon, 19 Oct 2026 16:41:46 +0100
Subject: [PATCH 023/270] M2: review of #1567: read each installed font file
 once and share it

CodeRabbit: the fallback cache was keyed by (script, weight) and every key read
and kept its own copy of the file, so PingFang.ttc (tens of megabytes, a
candidate of several scripts and both weights) could be held up to four times.
The bytes now come from a process-wide cache keyed by path, remembering files
that cannot be used too; the per-script cache keeps a handle and a face index.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/render/src/system_font.rs | 47 ++++++++++++++++++++++++++++----
 1 file changed, 42 insertions(+), 5 deletions(-)

diff --git a/crates/render/src/system_font.rs b/crates/render/src/system_font.rs
index d2c98bb7cd..0d9d158a35 100644
--- a/crates/render/src/system_font.rs
+++ b/crates/render/src/system_font.rs
@@ -86,13 +86,30 @@ pub(crate) fn fallback(query: &FallbackFontQuery) -> Option<(FontData, u32)> {
 }
 
 fn read(candidate: &Candidate, probe: char, bold: bool) -> Option<(Arc<Vec<u8>>, u32)> {
-    let meta = std::fs::metadata(&candidate.path).ok()?;
-    if !meta.is_file() || meta.len() > MAX_BYTES {
+    let bytes = file_bytes(&candidate.path)?;
+    let index = pick_face(&bytes, probe, candidate.region, bold)?;
+    Some((bytes, index))
+}
+
+/// The bytes of an installed font file, read once for the whole process and shared: a collection
+/// such as `PingFang.ttc` is tens of megabytes and is the candidate of several scripts and both
+/// weights, so the per-script cache keeps only a handle and a face index. A file that cannot be
+/// used is remembered too, so it is not tried again for every script.
+fn file_bytes(path: &Path) -> Option<Arc<Vec<u8>>> {
+    /// The bytes of each file tried, or `None` for one that cannot be used.
+    type Files = HashMap<PathBuf, Option<Arc<Vec<u8>>>>;
+    static FILES: Mutex<Option<Files>> = Mutex::new(None);
+    let mut files = FILES.lock().unwrap_or_else(PoisonError::into_inner);
+    files.get_or_insert_with(HashMap::new).entry(path.to_path_buf()).or_insert_with(|| read_file(path, MAX_BYTES).map(Arc::new)).clone()
+}
+
+/// A regular file of at most `max` bytes, or `None`: a font path is untrusted input.
+fn read_file(path: &Path, max: u64) -> Option<Vec<u8>> {
+    let meta = std::fs::metadata(path).ok()?;
+    if !meta.is_file() || meta.len() > max {
         return None;
     }
-    let bytes = std::fs::read(&candidate.path).ok()?;
-    let index = pick_face(&bytes, probe, candidate.region, bold)?;
-    Some((Arc::new(bytes), index))
+    std::fs::read(path).ok()
 }
 
 /// The best face of the file that parses and maps `probe`: the region's face when the file has
@@ -199,6 +216,26 @@ mod tests {
         assert!(read(&dir, '\u{7269}', false).is_none());
     }
 
+    /// The files are bounded by `max`: a larger one is not read.
+    #[test]
+    fn a_file_over_the_cap_is_not_read() {
+        let inter = Path::new(concat!(env!("CARGO_MANIFEST_DIR"), "/../../assets/fonts/Inter-Regular.ttf"));
+        assert!(read_file(inter, MAX_BYTES).is_some());
+        assert!(read_file(inter, 1024).is_none());
+    }
+
+    /// Two faces drawn from one installed file (two scripts, or regular and bold) hold the same
+    /// bytes, not a copy each; a file that can't be used is remembered as unusable.
+    #[test]
+    fn one_installed_file_is_read_once_and_shared() {
+        let inter = Path::new(concat!(env!("CARGO_MANIFEST_DIR"), "/../../assets/fonts/Inter-Regular.ttf"));
+        let first = file_bytes(inter).expect("readable");
+        let second = file_bytes(inter).expect("readable");
+        assert!(Arc::ptr_eq(&first, &second), "one allocation for the file");
+        let missing = Path::new("definitely/not/here.ttc");
+        assert!(file_bytes(missing).is_none() && file_bytes(missing).is_none());
+    }
+
     #[test]
     fn a_latin_face_is_rejected_for_every_script() {
         let inter = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");

From 102ceecf663fa7a506bbed8e4c38236ee574cc13 Mon Sep 17 00:00:00 2001
From: Philip <philip@philiptam.uk>
Date: Mon, 19 Oct 2026 18:22:03 +0100
Subject: [PATCH 024/270] M2: review of #1567: find PingFang in the macOS font
 assets

CodeRabbit: on recent macOS the PingFang collection is not in
/System/Library/Fonts but in the downloaded font assets
(/System/Library/AssetsV2/com_apple_MobileAsset_Font*/<id>.asset/AssetData), so
the fixed path missed it, and the PingFang test returned early without checking
anything on such a machine. The macOS candidates now include the AssetData
folders of those assets (listed once, at most 512 per kind), and a test
searches the assets independently and requires the candidate list to contain
what it finds.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/render/src/system_font.rs | 73 ++++++++++++++++++++++++++++++--
 1 file changed, 69 insertions(+), 4 deletions(-)

diff --git a/crates/render/src/system_font.rs b/crates/render/src/system_font.rs
index 0d9d158a35..40543cf46e 100644
--- a/crates/render/src/system_font.rs
+++ b/crates/render/src/system_font.rs
@@ -11,7 +11,7 @@
 
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
-use std::sync::{Arc, Mutex, PoisonError};
+use std::sync::{Arc, Mutex, OnceLock, PoisonError};
 
 use hayro::hayro_interpret::font::{FallbackFontQuery, FontData};
 use hayro::hayro_interpret::hayro_cmap::CidFamily;
@@ -23,6 +23,8 @@ use skrifa::string::StringId;
 const MAX_BYTES: u64 = 96 << 20;
 /// Faces tried in a collection (`.ttc`).
 const MAX_FACES: u32 = 32;
+/// Downloaded font assets looked at per kind on macOS.
+const MAX_ASSETS: usize = 512;
 
 /// The writing system a character collection is for.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
@@ -163,7 +165,11 @@ fn candidates(script: Script) -> Vec<Candidate> {
             Script::TraditionalChinese => &["PingFang.ttc", "STHeiti Light.ttc", "Hiragino Sans GB.ttc"],
             Script::Korean => &["AppleSDGothicNeo.ttc", "AppleGothic.ttf", "PingFang.ttc"],
         };
-        names.iter().map(|f| Path::new("/System/Library/Fonts").join(f)).collect()
+        // The system folder first, then the downloaded font assets: on recent macOS a face such as
+        // PingFang lives in `/System/Library/AssetsV2/com_apple_MobileAsset_Font*/<id>.asset/AssetData`.
+        let mut dirs = vec![PathBuf::from("/System/Library/Fonts")];
+        dirs.extend(macos_font_asset_dirs().iter().cloned());
+        names.iter().flat_map(|f| dirs.iter().map(move |d| d.join(f))).collect()
     } else {
         let names: &[&str] = match script {
             Script::Korean => {
@@ -193,6 +199,28 @@ fn candidates(script: Script) -> Vec<Candidate> {
     files.into_iter().map(|path| Candidate { path, region }).collect()
 }
 
+/// The `AssetData` folders of the downloaded font assets of macOS, found once. The ids in their
+/// names change with each asset version, so they are listed rather than named; at most
+/// [`MAX_ASSETS`] are looked at.
+fn macos_font_asset_dirs() -> &'static [PathBuf] {
+    static DIRS: OnceLock<Vec<PathBuf>> = OnceLock::new();
+    DIRS.get_or_init(|| {
+        let root = Path::new("/System/Library/AssetsV2");
+        let Ok(kinds) = std::fs::read_dir(root) else { return Vec::new() };
+        let mut dirs = Vec::new();
+        for kind in kinds.flatten().filter(|k| k.file_name().to_string_lossy().starts_with("com_apple_MobileAsset_Font")) {
+            let Ok(assets) = std::fs::read_dir(kind.path()) else { continue };
+            for asset in assets.flatten().take(MAX_ASSETS) {
+                let data = asset.path().join("AssetData");
+                if data.is_dir() {
+                    dirs.push(data);
+                }
+            }
+        }
+        dirs
+    })
+}
+
 fn windows_fonts() -> PathBuf {
     let dir = std::env::var_os("WINDIR").or_else(|| std::env::var_os("SystemRoot")).map_or_else(|| PathBuf::from(r"C:\Windows"), PathBuf::from);
     dir.join("Fonts")
@@ -273,8 +301,15 @@ mod tests {
     #[cfg(target_os = "macos")]
     #[test]
     fn macos_picks_the_regional_pingfang_face() {
-        let path = Path::new("/System/Library/Fonts/PingFang.ttc");
-        let Ok(bytes) = std::fs::read(path) else { return };
+        // Found where this macOS keeps it: the system folder, or the downloaded font assets.
+        let path = candidates(Script::TraditionalChinese)
+            .into_iter()
+            .map(|c| c.path)
+            .find(|p| p.file_name().is_some_and(|n| n == "PingFang.ttc") && p.is_file());
+        let Some(bytes) = path.and_then(|p| std::fs::read(p).ok()) else {
+            eprintln!("PingFang is not installed here: skipped");
+            return;
+        };
         for (script, region) in [(Script::TraditionalChinese, "TC"), (Script::SimplifiedChinese, "SC")] {
             let index = pick_face(&bytes, script.probe(), &[region], false).expect("PingFang covers it");
             let font = skrifa::FontRef::from_index(&bytes, index).unwrap();
@@ -282,4 +317,34 @@ mod tests {
             assert!(family.contains(region), "{script:?} got {family:?}");
         }
     }
+    /// A face that this macOS keeps only in its downloaded font assets (PingFang, on recent
+    /// versions) is among the candidates. The assets are searched here on their own, not by the
+    /// code under test; where there are none, nothing is checked.
+    #[cfg(target_os = "macos")]
+    #[test]
+    fn macos_candidates_include_a_pingfang_that_lives_in_the_font_assets() {
+        fn find(dir: &Path, name: &str, depth: u32) -> Option<PathBuf> {
+            for entry in std::fs::read_dir(dir).ok()?.flatten() {
+                let path = entry.path();
+                if path.file_name().is_some_and(|n| n == name) && path.is_file() {
+                    return Some(path);
+                }
+                if depth > 0
+                    && path.is_dir()
+                    && !path.is_symlink()
+                    && let Some(found) = find(&path, name, depth - 1)
+                {
+                    return Some(found);
+                }
+            }
+            None
+        }
+        let Some(asset) = find(Path::new("/System/Library/AssetsV2"), "PingFang.ttc", 3) else {
+            eprintln!("no PingFang in the font assets here: skipped");
+            return;
+        };
+        for script in [Script::SimplifiedChinese, Script::TraditionalChinese] {
+            assert!(candidates(script).iter().any(|c| c.path == asset), "{script:?}: {} is not a candidate", asset.display());
+        }
+    }
 }

From 57a16aea171f5e015a4de17d9c47f1e5fb22a646 Mon Sep 17 00:00:00 2001
From: Philip <philip@philiptam.uk>
Date: Wed, 21 Oct 2026 20:17:27 +0100
Subject: [PATCH 025/270] M2: review of #1567: draw installed CJK fonts on
 screen only
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

FredApps: AGENTS.md §1.4 allows reading an installed font at runtime only as
the interface's last fallback and says nothing from it may enter a PDF or
package, while the renderer fallback also served exports and printing.

RenderConfig gains system_fonts, off by default. The engine sets it only on the
pool that draws the viewer (display_config); exports, printing, OCR and the
automation tools render with the document's own configuration, so nothing drawn
with an installed font is saved or printed. Tests: the render of a non-embedded
CNS1, GB1 and Korea1 font is blank without the flag and drawn with it; the
viewer's pool draws such a page and an export of it does not (it fails if the
flag is on everywhere). No Adobe-named font can be a candidate.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 ROADMAP.md                       |  2 +-
 crates/engine/src/lib.rs         | 26 +++++++++++------
 crates/engine/src/tests.rs       | 49 ++++++++++++++++++++++++++++++++
 crates/render/src/raster.rs      | 28 ++++++++++++++----
 crates/render/src/system_font.rs |  8 ++++--
 5 files changed, 95 insertions(+), 18 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 38f5ff3e5f..bc916e033c 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -214,7 +214,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-15 (M14, gap 24):** `misc.localization` and `misc.installers` move from planned to partial. Localization: 22 catalogs ship, but Chinese shows tofu in releases, Telugu has no release font and Arabic is not mirrored. Installers: macOS and Windows releases are signed, Linux packages are not. The Acrobat menu diff itself remains open. Estimates unchanged.
 - **2026-10-13 (G14, Vietnamese localization):** Added Vietnamese (`vi`, Tiếng Việt) as an interface and date language with a 2,591-entry catalog (`plural_none`) covering 100% of the current localizable key union (plus `theme`/`Appearance`). Locale tags `vi` / `vi-VN` / `vi_VN.UTF-8` resolve; calendar months use numeric `Tháng 1`…`12` / `tháng 1`…`12`. Native-speaker community review recorded. The twelve-language localization mean moves from ≈59% to ≈68%; weighted readiness ≈49% → ≈50%. Status stays `partial`: engine/OS details, document contents, filenames, CLI/MCP and external help stay outside the catalog by design.
 
-- **2026-10-12 (M2, installed CJK fonts):** A CID font of an Adobe CJK collection (Japan1, GB1, CNS1, Korea1) that a PDF doesn't embed, such as the Kozuka Gothic of an Acrobat text box or the SongtiTC of a Pages export, drew nothing unless craft-fonts had a Japanese face. After craft-fonts, it now draws with a face already installed on the machine (PingFang, Heiti, Microsoft JhengHei / YaHei, Malgun and the like; read at runtime, never bundled; Noto CJK and Source Han excluded; `PDFCRAFT_SYSTEM_FONTS=0` turns it off). The face of a collection with several regions (PingFang SC, TC) is chosen by region. Checked on macOS with a synthetic Traditional Chinese, Simplified Chinese and Korean page; the Windows and Linux font lists are untested, and a machine with none of the listed faces still draws nothing.
+- **2026-10-12 (M2, installed CJK fonts):** A CID font of an Adobe CJK collection (Japan1, GB1, CNS1, Korea1) that a PDF doesn't embed, such as the Kozuka Gothic of an Acrobat text box or the SongtiTC of a Pages export, drew nothing unless craft-fonts had a Japanese face. After craft-fonts, it now draws with a face already installed on the machine (PingFang, Heiti, Microsoft JhengHei / YaHei, Malgun and the like; read at runtime, never bundled, and used only for the on-screen viewer, never for exports, printing or OCR; Noto CJK and Source Han excluded; `PDFCRAFT_SYSTEM_FONTS=0` turns it off). The face of a collection with several regions (PingFang SC, TC) is chosen by region. Checked on macOS with a synthetic Traditional Chinese, Simplified Chinese and Korean page; the Windows and Linux font lists are untested, and a machine with none of the listed faces still draws nothing.
 - **2026-10-13 (M3, typed zoom):** The right rail's zoom percentage is an editable field: type 150, 150% or 62.5 % and press Enter, Escape discards, and nonsense keeps the current zoom. The control channel's zoom option shares its parser, which now refuses zero, negative and non-finite values.
 - **2026-10-13 (M4, indirect page rotation):** Rotation queries and edits resolve indirect integer values on pages and their page-tree ancestors. Turning a page already at 270° by 90° now saves it at 0°, including when its rotation is inherited. Synthetic full/incremental save-and-reopen tests cover nested inheritance, sibling preservation, negative/large angles and invalid-value fallback. Estimates unchanged.
 - **2026-10-14 (M1, Flate fallback):** Raw deflate whose first bytes resemble a zlib header no longer loses a decoding-limit error during fallback. Strict and tolerant filter regressions and a COS stream regression cover refusal at the caller limit and successful decoding within it. No parity status or estimate changes.
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 8f39248abd..d1b94f157b 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -1009,11 +1009,19 @@ fn set_default_layer_state(cos: &mut pdfcraft_cos::Document, layers: &[Layer]) {
     cos.set(root_ref, Object::Dict(root));
 }
 
+/// The configuration of the pool that draws the viewer: the document's own, plus installed CJK
+/// fonts for fonts a PDF does not embed (`RenderConfig::system_fonts`). Exports, printing, OCR and
+/// the automation tools render with the document's configuration itself, so nothing drawn with an
+/// installed font is saved or printed (AGENTS.md §1.2, §1.4).
+fn display_config(config: &RenderConfig) -> RenderConfig {
+    RenderConfig { system_fonts: true, ..config.clone() }
+}
+
 /// Render `doc` with the layer visibility in its `info.layers`.
 fn use_layer_choices(doc: &mut Document) {
     let overrides: Vec<(i32, i32, bool)> = doc.info.layers.iter().map(|l| (l.id.0 as i32, l.id.1 as i32, l.visible)).collect();
     doc.config.layers = Arc::new(overrides);
-    doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+    doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), display_config(&doc.config));
 }
 
 /// Apply a set-layer-visibility action to `layers`, one change at a time, so a toggle flips the
@@ -3580,7 +3588,7 @@ impl Session {
         let sig_cache = Arc::new(pdfcraft_sign::DigestCache::default());
         let signatures = editor.as_ref().map(|e| signatures_of(&e.cos, &bytes, trust, &sig_cache)).unwrap_or_default();
         let display = display_bytes(editor.as_mut(), &bytes);
-        let renderer = RenderPool::new(display.clone(), render_threads(), config.clone());
+        let renderer = RenderPool::new(display.clone(), render_threads(), display_config(&config));
         let (form, adopted) = editor
             .as_ref()
             .map(|e| {
@@ -3962,7 +3970,7 @@ impl Session {
         let signatures = if doc.signatures.is_empty() { Vec::new() } else { signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache) };
         doc.display = display_bytes(Some(editor), &bytes);
         doc.signatures = Arc::new(signatures);
-        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), display_config(&doc.config));
         doc.bytes = bytes;
         Ok(())
     }
@@ -4007,7 +4015,7 @@ impl Session {
         let signatures = if doc.signatures.is_empty() { Vec::new() } else { signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache) };
         doc.display = display_bytes(Some(editor), &bytes);
         doc.signatures = Arc::new(signatures);
-        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), display_config(&doc.config));
         doc.bytes = bytes;
         doc.fonts_stale = true;
         Ok(())
@@ -4032,7 +4040,7 @@ impl Session {
     /// After a refresh failed: draw the display bytes it left (the original, once released),
     /// so the page still shows a document.
     fn show_released(doc: &mut Document) {
-        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), display_config(&doc.config));
     }
 
     /// Rebuild working bytes, inspection and renderer from the current edit state.
@@ -4082,7 +4090,7 @@ impl Session {
         let signatures = signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache);
         doc.display = display_bytes(Some(editor), &bytes);
         doc.signatures = Arc::new(signatures);
-        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), display_config(&doc.config));
         doc.bytes = bytes;
         Ok(())
     }
@@ -4795,7 +4803,7 @@ impl Session {
             return false;
         }
         doc.config.hide_comments = hide;
-        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), display_config(&doc.config));
         doc.generation += 1;
         true
     }
@@ -4808,7 +4816,7 @@ impl Session {
             return false;
         }
         doc.config.reading_colors = colors;
-        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), display_config(&doc.config));
         doc.generation += 1;
         true
     }
@@ -4844,7 +4852,7 @@ impl Session {
             let signatures = if doc.signatures.is_empty() { Vec::new() } else { signatures_of(&editor.cos, &doc.bytes, &doc.trust, &doc.sig_cache) };
             doc.display = display_bytes(Some(editor), &doc.bytes);
             doc.signatures = Arc::new(signatures);
-            doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+            doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), display_config(&doc.config));
         }
     }
 
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index f125c41dac..5e6ef3b301 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -385,6 +385,55 @@ fn edits_update_view_data_and_mark_dirty() {
     assert_eq!(page_texts(&s, id), ["Page 1", "Page 3"], "renderer refreshed");
 }
 
+/// A font of an Adobe CJK collection that a PDF does not embed is drawn with an installed face on
+/// the viewer's pool only. An export of the same page, which can be saved, has nothing drawn with
+/// an installed font (AGENTS.md §1.2, §1.4). Skipped where no such face is installed.
+#[test]
+fn installed_cjk_fonts_draw_in_the_viewer_but_not_in_an_export() {
+    let content = "BT /F1 40 Tf 5 15 Td <7E419AD45B57> Tj ET";
+    let pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 60] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /MSung-Light /Encoding /UniCNS-UCS2-H /DescendantFonts [6 0 R] >> endobj
+6 0 obj << /Type /Font /Subtype /CIDFontType0 /BaseFont /MSung-Light /CIDSystemInfo << /Registry (Adobe) /Ordering (CNS1) /Supplement 2 >> /FontDescriptor 7 0 R /DW 1000 >> endobj
+7 0 obj << /Type /FontDescriptor /FontName /MSung-Light /Flags 6 /FontBBox [0 -141 1000 859] /ItalicAngle 0 /Ascent 859 /Descent -141 /CapHeight 700 /StemV 80 >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    );
+    let mut s = Session::new();
+    let id = s.open("cns1.pdf", None, Arc::new(pdf.into_bytes()), None).unwrap();
+    let doc = s.get(id).unwrap();
+    doc.renderer.set_queue(vec![pdfcraft_render::RenderRequest {
+        page: 0,
+        kind: pdfcraft_render::RequestKind::Pixels,
+        scale: 1.0,
+        ..Default::default()
+    }]);
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
+    let viewer = loop {
+        if let Some(page) = doc.renderer.try_recv() {
+            assert!(page.error.is_none(), "{:?}", page.error);
+            break page;
+        }
+        assert!(std::time::Instant::now() < deadline, "page render did not finish");
+        std::thread::yield_now();
+    };
+    let inked = |rgba: &[u8]| rgba.as_chunks::<4>().0.iter().filter(|c| c[0] < 128).count();
+    if inked(&viewer.rgba) < 300 {
+        eprintln!("no installed Traditional Chinese face (or PDFCRAFT_SYSTEM_FONTS=0): skipped");
+        return;
+    }
+    let png = export::Exporter::new(doc).png(0, 72.0).unwrap();
+    let exported = image::load_from_memory(&png).unwrap().into_rgba8();
+    assert!(inked(exported.as_raw()) < 50, "an export draws nothing with an installed font ({} dark pixels)", inked(exported.as_raw()));
+}
+
 #[test]
 fn metadata_edit_keeps_the_renderer_without_changing_page_content() {
     let (mut s, id) = session_with(1);
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 2ef4870fe0..01aa89d69f 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -65,15 +65,23 @@ pub struct RenderConfig {
     /// View ▸ Reading colours: solid text and line-art paints are remapped for readability and
     /// the page clears to the setting's background. Display only; the document never changes.
     pub reading_colors: ReadingColors,
+    /// Draw a CID font of an Adobe CJK collection that the PDF does not embed with one face already
+    /// installed on this machine (see `system_font`). Off by default and on only for the pool that
+    /// draws the viewer: exports, printing and OCR render without it, so nothing drawn with an
+    /// installed font is saved or printed (AGENTS.md §1.2, §1.4).
+    pub system_fonts: bool,
 }
 
 impl RenderConfig {
     fn settings(&self) -> InterpreterSettings {
         let standard = InterpreterSettings::default().font_resolver;
+        let system_fonts = self.system_fonts;
         InterpreterSettings {
             ocg_overrides: self.layers.clone(),
             hide_comments: self.hide_comments,
-            font_resolver: Arc::new(move |query| japanese_fallback(query).or_else(|| system_fallback(query)).or_else(|| standard(query))),
+            font_resolver: Arc::new(move |query| {
+                japanese_fallback(query).or_else(|| system_fonts.then(|| system_fallback(query)).flatten()).or_else(|| standard(query))
+            }),
             ..InterpreterSettings::default()
         }
     }
@@ -6751,12 +6759,20 @@ trailer << /Root 1 0 R >>
 %%EOF",
                 content.len()
             );
-            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{base_font}: {:?}", p.error);
-            let inked = p.rgba.as_chunks::<4>().0.iter().filter(|c| c[0] < 128).count();
+            let pdf = Arc::new(pdf.into_bytes());
+            let ink = |config: RenderConfig| {
+                let mut r = PageRenderer::new(pdf.clone(), config);
+                let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+                assert!(p.error.is_none(), "{base_font}: {:?}", p.error);
+                p.rgba.as_chunks::<4>().0.iter().filter(|c| c[0] < 128).count()
+            };
             // Two to four glyphs at 40 pt cover several hundred dark pixels; a blank run has none.
-            assert!(inked > 300, "{base_font}: the text is drawn ({inked} dark pixels)");
+            let shown = ink(RenderConfig { system_fonts: true, ..RenderConfig::default() });
+            assert!(shown > 300, "{base_font}: the text is drawn ({shown} dark pixels)");
+            // Off by default: exports, printing and OCR render without an installed font, so
+            // nothing drawn with one can be saved (AGENTS.md §1.2, §1.4).
+            let saved = ink(RenderConfig::default());
+            assert!(saved < 50, "{base_font}: not drawn without system_fonts ({saved} dark pixels)");
         }
     }
 
diff --git a/crates/render/src/system_font.rs b/crates/render/src/system_font.rs
index 40543cf46e..5e6391f0d2 100644
--- a/crates/render/src/system_font.rs
+++ b/crates/render/src/system_font.rs
@@ -5,7 +5,8 @@
 //! `MSung-Light` without embedding the font. hayro maps those CIDs to Unicode itself, but it needs
 //! a face to draw them with; without one the text is blank. The craft-fonts Japanese faces come
 //! first (see `japanese_fallback` in `raster.rs`); this module is the last resort: one face
-//! already installed on this machine. It is read at runtime and never embedded or shipped
+//! already installed on this machine, used for the viewer only (`RenderConfig::system_fonts`, off
+//! for exports, printing and OCR). It is read at runtime and never embedded or shipped
 //! (AGENTS.md §1.4), Noto CJK and Source Han are left out on purpose (§1.1), and
 //! `PDFCRAFT_SYSTEM_FONTS=0` turns it off, as for the interface font.
 
@@ -282,7 +283,10 @@ mod tests {
                 assert!(c.path.is_absolute(), "{}", c.path.display());
                 assert!(c.path.extension().is_some_and(|e| e == "ttf" || e == "ttc"), "{}", c.path.display());
                 let name = c.path.to_string_lossy().to_lowercase();
-                assert!(!["notosanscjk", "notoserifcjk", "sourcehan", "source-han"].iter().any(|b| name.contains(b)), "{name}");
+                assert!(
+                    !["notosanscjk", "notoserifcjk", "sourcehan", "source-han", "adobe", "kozuka", "minion"].iter().any(|b| name.contains(b)),
+                    "{name}"
+                );
             }
         }
     }

From e42c21a3c833df30ba1144e33cf8f18e4a68f1f6 Mon Sep 17 00:00:00 2001
From: Philip <philip@philiptam.uk>
Date: Wed, 21 Oct 2026 20:17:27 +0100
Subject: [PATCH 026/270] =?UTF-8?q?docs:=20AGENTS.md=20=C2=A71.4=20?=
 =?UTF-8?q?=E2=80=94=20the=20viewer=20may=20draw=20non-embedded=20CJK=20fo?=
 =?UTF-8?q?nts=20with=20an=20installed=20face?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Proposed for the maintainers to accept or drop (separate commit): the page
viewer, on screen only, may use one installed face for a CID font of an Adobe
CJK collection that a PDF does not embed. Exports, printing, OCR and the
automation tools never use it; nothing drawn with it is saved or printed; no
Noto CJK, Source Han or Adobe family is a candidate.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 AGENTS.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/AGENTS.md b/AGENTS.md
index 0665ad1d3b..1cb3e1c34a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -71,6 +71,7 @@ Anything else is forbidden, including assets whose licence you cannot prove from
 - Font assets shared by the Crafting Apps, including every Japanese font, live in [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), not here. **Never commit a font file to this repository**; adding a font means adding it to craft-fonts. (The Latin UI fonts already in `assets/fonts/` — Inter, JetBrains Mono, Dancing Script — stay.) Team members: the shared rules are in [craftrules `standards/fonts.md`](https://github.com/storytold/craftrules/blob/main/standards/fonts.md) (internal).
 - craft-fonts is an **optional build input**, never a Cargo dependency: `CRAFT_FONTS_DIR=<checkout> cargo build` makes `crates/fonts/build.rs` embed its fonts as `pdfcraft_fonts::CRAFT_FONTS`. Without it PdfCraft builds, tests and runs, but has no Japanese face (Japanese UI text shows replacement boxes, and writing Japanese into a PDF returns a clear error). Release builds always set it (`.github/workflows/release.yml`), and `ATTRIBUTION.toml` lists it as a `[[build_input]]`.
 - The desktop app may read one font **already installed on the user's machine** at runtime, as the last interface fallback for characters no embedded face has (`crates/ui-egui/src/system_fonts.rs`). That font is never embedded, shipped, committed or copied, and never appears in published screenshots (`PDFCRAFT_SYSTEM_FONTS=0`, which `cargo xtask screenshots` sets). It is not a way around §1.2: nothing from it may enter a PDF, a package or the repository.
+- The page viewer may also draw a CID font of an Adobe CJK collection (Japan1, GB1, CNS1, Korea1) that a PDF does **not embed** with one face already installed on the machine (`crates/render/src/system_font.rs`), **on screen only**. `RenderConfig::system_fonts` is off by default and is set only for the pool that draws the viewer (`display_config` in `crates/engine/src/lib.rs`), so exports, printing, OCR and the automation tools never use it. Like the interface font it is read at runtime and never embedded, shipped, committed or copied; Noto CJK and Source Han are never candidates (§1.1), nor is any Adobe family; and `PDFCRAFT_SYSTEM_FONTS=0` turns it off. It is not a way around §1.2 either: nothing drawn with it may be saved or printed.
 
 ### 1.5 Procedure for adding or changing an asset
 

From 48955694765b65363ffd513122e9d5f7fabd0ef9 Mon Sep 17 00:00:00 2001
From: Philip <philip@philiptam.uk>
Date: Wed, 21 Oct 2026 21:45:28 +0100
Subject: [PATCH 027/270] M2: review of #1567: the viewer-wiring test no longer
 skips when the wiring is lost

CodeRabbit: the engine test skipped when the viewer's render was blank, so a
viewer pool that lost the installed-font fallback would have skipped instead of
failing. Whether this machine has a face that can draw the page is now asked of
a renderer with RenderConfig::system_fonts switched on by hand, and the viewer's
render must then draw it. Without the fallback on the viewer's pool the test
fails.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/engine/src/tests.rs | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 5e6ef3b301..867afc8a07 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -425,10 +425,16 @@ trailer << /Root 1 0 R >>
         std::thread::yield_now();
     };
     let inked = |rgba: &[u8]| rgba.as_chunks::<4>().0.iter().filter(|c| c[0] < 128).count();
-    if inked(&viewer.rgba) < 300 {
+    // Whether this machine has a face that can draw the page at all, asked of a renderer with the
+    // fallback switched on by hand, so a viewer pool that lost it fails below instead of skipping.
+    let probe = pdfcraft_render::PageRenderer::new(doc.display.clone(), pdfcraft_render::RenderConfig { system_fonts: true, ..Default::default() })
+        .render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+    assert!(probe.error.is_none(), "{:?}", probe.error);
+    if inked(&probe.rgba) < 300 {
         eprintln!("no installed Traditional Chinese face (or PDFCRAFT_SYSTEM_FONTS=0): skipped");
         return;
     }
+    assert!(inked(&viewer.rgba) > 300, "the viewer's pool draws it with the installed face ({} dark pixels)", inked(&viewer.rgba));
     let png = export::Exporter::new(doc).png(0, 72.0).unwrap();
     let exported = image::load_from_memory(&png).unwrap().into_rgba8();
     assert!(inked(exported.as_raw()) < 50, "an export draws nothing with an installed font ({} dark pixels)", inked(exported.as_raw()));

From c05f00c67a148b66235c61f05dbdbf8773b48b25 Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Thu, 22 Oct 2026 16:07:14 +0800
Subject: [PATCH 028/270] fix(engine): generate Protect keys and salts with
 getrandom (#4000)

---
 Cargo.lock                 |  1 +
 crates/engine/Cargo.toml   |  4 +++
 crates/engine/src/lib.rs   | 27 +++++++-------
 crates/engine/src/tests.rs | 72 ++++++++++++++++++++++++++++++++++++++
 4 files changed, 91 insertions(+), 13 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a950149243..caa23b2662 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4109,6 +4109,7 @@ version = "0.11.0"
 dependencies = [
  "chrono",
  "craft-docpath",
+ "getrandom 0.4.3",
  "icu_properties",
  "idna",
  "image",
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index f5e35088b5..6dae6adf0a 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -51,6 +51,10 @@ unicode-segmentation = "1.13"
 # Already in the graph through lopdf; used only for the local UTC offset ("today"). The workspace
 # entry is std-only; this target adds `clock` for `chrono::Local::now`.
 chrono = { workspace = true, features = ["clock"] }
+getrandom = "0.4"
+
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+getrandom = { version = "0.4", features = ["wasm_js"] }
 
 [dev-dependencies]
 pdfcraft-testkit = { workspace = true }
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index e20cbc596e..e61d5fef36 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -2349,6 +2349,7 @@ struct EditCtx {
     today: (i64, u32, u32),
     seed: u64,
     count: u64,
+    rng: fn(&mut [u8]) -> Result<(), getrandom::Error>,
     /// Fields the edit renamed to keep imported names separate (old → new), for the repair
     /// log and the undo label.
     renamed_fields: Vec<(String, String)>,
@@ -2377,23 +2378,20 @@ impl EditCtx {
             today: (1970, 1, 1),
             seed,
             count: 0,
+            rng: getrandom::fill,
             renamed_fields: Vec::new(),
         }
     }
 
-    /// 32 bytes of entropy for new encryption keys and salts. `RandomState` is seeded by the
-    /// operating system, so no extra dependency is needed.
-    fn entropy(&mut self) -> [u8; 32] {
-        use std::hash::{BuildHasher, Hasher};
+    /// 32 bytes of entropy for new encryption keys, salts and generated owner passwords from the
+    /// platform CSPRNG. Fails closed when secure randomness is unavailable.
+    fn entropy(&mut self) -> Result<[u8; 32], EditError> {
         let mut out = [0u8; 32];
-        for (i, chunk) in out.chunks_mut(8).enumerate() {
-            let mut h = std::collections::hash_map::RandomState::new().build_hasher();
-            h.write_u64(self.seed ^ i as u64);
-            h.write_u64(self.count);
-            self.count += 1;
-            chunk.copy_from_slice(&h.finish().to_le_bytes());
+        (self.rng)(&mut out).map_err(|e| EditError::Protection(format!("no secure randomness available: {e}")))?;
+        if out == [0u8; 32] {
+            return Err(EditError::Protection("no secure randomness available".into()));
         }
-        out
+        Ok(out)
     }
 
     /// A fresh `/NM`: a random-looking UUID (version 4 layout) from a splitmix64 stream.
@@ -2806,10 +2804,13 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
         }
         Edit::Protect(p) => {
             p.validate()?;
-            let seed = cx.entropy();
+            let seed = cx.entropy()?;
             // Without a permissions password nothing is restricted, so the owner password is a
             // random one nobody needs.
-            let random_owner: String = cx.entropy().iter().map(|b| format!("{b:02x}")).collect();
+            let random_owner = match p.permissions_password {
+                Some(_) => String::new(),
+                None => cx.entropy()?.iter().map(|b| format!("{b:02x}")).collect(),
+            };
             let params = pdfcraft_cos::NewEncryption {
                 algorithm: p.algorithm,
                 user_password: p.open_password.as_deref().unwrap_or(""),
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 0df176226a..6895f188f3 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1884,6 +1884,78 @@ fn passwords_that_encryption_would_make_empty_or_equal_are_refused() {
     }
 }
 
+#[test]
+fn fresh_sessions_protecting_identical_documents_produce_different_salts() {
+    let raw = Arc::new(fixture(1));
+    let encrypt_bytes = |saved: Arc<Vec<u8>>, key: &[u8]| -> Vec<u8> {
+        let doc = pdfcraft_cos::Document::open_with_password(saved, Some("secret")).unwrap();
+        let enc = doc.trailer().get(b"Encrypt").map(|o| doc.resolve(o)).unwrap();
+        enc.as_dict().unwrap().get(key).map(|o| doc.resolve(o)).unwrap().as_string().unwrap().bytes.clone()
+    };
+    let protect_once = |p: Protection| -> Arc<Vec<u8>> {
+        let mut s = Session::new();
+        let id = s.open("same.pdf", None, raw.clone(), None).unwrap();
+        s.apply(id, Edit::Protect(p)).unwrap();
+        s.save_bytes(id).unwrap()
+    };
+    let a = protect_once(protection(Some("secret"), None));
+    let b = protect_once(protection(Some("secret"), None));
+    let (u_a, u_b) = (encrypt_bytes(a.clone(), b"U"), encrypt_bytes(b.clone(), b"U"));
+    let (o_a, o_b) = (encrypt_bytes(a.clone(), b"O"), encrypt_bytes(b.clone(), b"O"));
+    let (ue_a, ue_b) = (encrypt_bytes(a.clone(), b"UE"), encrypt_bytes(b.clone(), b"UE"));
+    let (oe_a, oe_b) = (encrypt_bytes(a, b"OE"), encrypt_bytes(b, b"OE"));
+    assert_eq!((u_a.len(), u_b.len(), o_a.len(), o_b.len()), (48, 48, 48, 48));
+    assert_ne!(&u_a[32..48], &u_b[32..48], "user validation and key salts must differ across fresh sessions");
+    assert_ne!(&o_a[32..48], &o_b[32..48], "owner validation and key salts must differ across fresh sessions");
+    assert_ne!(ue_a, ue_b, "wrapped user file keys must differ across fresh sessions");
+    assert_ne!(oe_a, oe_b, "wrapped owner file keys must differ across fresh sessions");
+
+    // Generated owner passwords in R4 (AES-128) must also come from CSPRNG entropy, even when the
+    // document already carries a fixed /ID and only an open password is set.
+    let mut with_id = pdfcraft_cos::Document::open(raw).unwrap();
+    let fixed_id = pdfcraft_cos::Object::String(pdfcraft_cos::PdfString { bytes: b"0123456789abcdef".to_vec(), hex: true });
+    with_id.trailer_mut().set(b"ID".to_vec(), pdfcraft_cos::Object::Array(vec![fixed_id.clone(), fixed_id]));
+    let raw_with_id = Arc::new(pdfcraft_cos::write_full(&with_id, &Default::default()).unwrap());
+    let protect_r4 = || -> Vec<u8> {
+        let mut s = Session::new();
+        let id = s.open("same.pdf", None, raw_with_id.clone(), None).unwrap();
+        let p = Protection { algorithm: pdfcraft_cos::Algorithm::Aes128, ..protection(Some("secret"), None) };
+        s.apply(id, Edit::Protect(p)).unwrap();
+        encrypt_bytes(s.save_bytes(id).unwrap(), b"O")
+    };
+    assert_ne!(protect_r4(), protect_r4(), "generated owner passwords must differ across fresh sessions");
+}
+
+#[test]
+fn protect_fails_closed_when_randomness_is_unavailable() {
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    static CALLS: AtomicUsize = AtomicUsize::new(0);
+    fn fail_rng(_: &mut [u8]) -> Result<(), getrandom::Error> {
+        Err(getrandom::Error::UNSUPPORTED)
+    }
+    fn zero_rng(out: &mut [u8]) -> Result<(), getrandom::Error> {
+        out.fill(0);
+        Ok(())
+    }
+    fn fail_second_rng(out: &mut [u8]) -> Result<(), getrandom::Error> {
+        if CALLS.fetch_add(1, Ordering::SeqCst) == 0 {
+            out.fill(0xA5);
+            Ok(())
+        } else {
+            Err(getrandom::Error::UNSUPPORTED)
+        }
+    }
+    CALLS.store(0, Ordering::SeqCst);
+    for rng in [fail_rng, zero_rng, fail_second_rng] {
+        let mut doc = pdfcraft_cos::Document::open(Arc::new(fixture(1))).unwrap();
+        let mut cx = EditCtx::new(None, 0);
+        cx.rng = rng;
+        let err = run_edit(&mut doc, &Edit::Protect(protection(Some("secret"), None)), &mut cx);
+        assert!(matches!(err, Err(EditError::Protection(_))), "Protect must fail closed when CSPRNG fails: {err:?}");
+        assert!(doc.output_handler().is_none(), "document must stay unprotected when CSPRNG fails");
+    }
+}
+
 /// A one-page form: a text field and a check box (with appearance states).
 fn form_fixture() -> Vec<u8> {
     let objs = [

From 2842eeaa713889b2fb306e72990050549ee1a5dd Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 13:38:28 +1100
Subject: [PATCH 029/270] fix(ui): Ctrl+Z in an open paragraph undoes the
 document, not stale text

Ctrl+Z is left to a focused text field, so in the paragraph editor it
went to the box's own Undo history. That history still held the
paragraph's text from before the last formatting change, so Ctrl+Z put
it back into a box laid out for the page after the change, a layout
the page never had, and the document kept the change. The box shared
its id across paragraphs too, so it could put back another paragraph's
text.

The history of the paragraph editor and the added-text box now starts
at what the page has. Undo and Redo keep the keys only while the box
holds typing the page doesn't have; then they reach the document. An
open box is applied (as clicking away applies it) and closed before an
Undo or Redo step, so it never shows a state the document has left;
text it can't apply keeps it open and stops the step.
---
 crates/ui-egui/src/commands.rs     |  5 ++-
 crates/ui-egui/src/content_ui.rs   | 23 +++++++++++--
 crates/ui-egui/src/edit_text_ui.rs | 29 +++++++++++++++-
 crates/ui-egui/src/editing.rs      | 54 +++++++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 55 ++++++++++++++++++++++++++++++
 5 files changed, 161 insertions(+), 5 deletions(-)

diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 92bc0b360e..ee19c168eb 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -726,7 +726,10 @@ impl PdfCraftApp {
             if matches!(spec.id, "view.previous_view" | "view.next_view") && !self.command_enabled(spec) {
                 continue;
             }
-            if typing && !spec.in_text {
+            // A box typed into on the page (a paragraph being edited, added text) keeps Undo and
+            // Redo only while it holds typing the page doesn't have; then they reach the document.
+            let page_box = matches!(spec.id, "edit.undo" | "edit.redo") && self.page_box_focused(ctx) && !self.page_typing_unapplied();
+            if typing && !spec.in_text && !page_box {
                 continue;
             }
             let Some(key) = Key::from_name(s.key) else { continue };
diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 674210529e..892e94ed67 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -66,8 +66,18 @@ pub struct TextDraft {
     /// Display space.
     pub rect: [f64; 4],
     pub text: String,
+    /// The box's formatting; its `text` is what the page has (empty for new text).
     pub style: AddedText,
     pub focus: bool,
+    /// The text the box's own Undo history starts from ([`crate::edit_text_ui::forget_typing_before`]).
+    pub typing_from: Option<String>,
+}
+
+impl TextDraft {
+    /// Typing the page doesn't have yet: Undo takes it back in the box before touching the document.
+    pub(crate) fn has_unapplied_typing(&self) -> bool {
+        self.text != self.style.text
+    }
 }
 
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -394,7 +404,7 @@ pub(crate) fn page_input(
             let page_width = info.pages.get(page).map_or(f64::INFINITY, |p| p.width as f64);
             let rect = [at[0], at[1] - style.size * 1.2, (at[0] + 200.0).min(page_width), at[1]];
             style.rect = rect;
-            cv.draft = Some(TextDraft { page, index: None, rect, text: String::new(), style, focus: true });
+            cv.draft = Some(TextDraft { page, index: None, rect, text: String::new(), style, focus: true, typing_from: None });
             consumed = true;
             if typed.is_some() {
                 view.pending_edit = typed;
@@ -432,7 +442,7 @@ pub(crate) fn page_input(
         if let Some(edit) = cv.finish_draft(added) {
             view.pending_edit = Some(edit);
         }
-        cv.draft = Some(TextDraft { page, index: Some(i), rect: t.rect, text: t.text.clone(), style: t.clone(), focus: true });
+        cv.draft = Some(TextDraft { page, index: Some(i), rect: t.rect, text: t.text.clone(), style: t.clone(), focus: true, typing_from: None });
         cv.selected = Some((page, i));
         consumed = true;
         return consumed;
@@ -560,6 +570,8 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
             // The box is white in every theme, so the caret must not follow the theme (pale in dark mode) (#655).
             ui.visuals_mut().text_cursor.stroke.color = crate::edit_text_ui::caret_color_on(Color32::WHITE);
             let [cr, cg, cb] = t.style.color.map(|v| (v.clamp(0.0, 1.0) * 255.0) as u8);
+            let input = input_id();
+            crate::edit_text_ui::forget_typing_before(ui.ctx(), input, &mut t.typing_from, &t.style.text);
             ui.horizontal_top(|ui| {
                 ui.spacing_mut().item_spacing.x = 4.0;
                 let resp = ui.add(
@@ -570,7 +582,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                         .background_color(if background_ready { Color32::TRANSPARENT } else { Color32::WHITE })
                         .text_color(Color32::from_rgb(cr, cg, cb))
                         .hint_text(tl!("Type text"))
-                        .id_salt("added-text-edit"),
+                        .id(input),
                 );
                 if t.focus {
                     resp.request_focus();
@@ -633,6 +645,11 @@ fn finish(cv: &mut ContentView, d: TextDraft, added: &[Added]) -> Option<Edit> {
     }
 }
 
+/// The added-text box's text field.
+pub(crate) fn input_id() -> egui::Id {
+    egui::Id::new("added-text-input")
+}
+
 /// How to use the tools, under the Add content list.
 pub(crate) fn hint(ui: &mut egui::Ui, t: &Tokens) {
     ui.label(
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index 3a1ab04367..f2c5c55151 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -256,6 +256,29 @@ pub struct LineEditor {
     /// horizontal scale (%), and what they were.
     pub extras: Extras,
     extras0: Extras,
+    /// The text the box's own Undo history starts from; see [`forget_typing_before`].
+    typing_from: Option<String>,
+}
+
+/// The paragraph editor's text box.
+pub(crate) fn input_id() -> egui::Id {
+    egui::Id::new("edit-text-line-input")
+}
+
+/// The page text box `id` keeps its own Undo history, across every paragraph or box it has shown
+/// (they share the id). Once the page has `text` (the box opened on it, or formatting applied it),
+/// that history is cleared: Undo in the box takes back only what was typed since, and then reaches
+/// the document. Kept, it put back text from another paragraph, or the whole paragraph as it was
+/// before a format change, into a box showing the page as it is now.
+pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, from: &mut Option<String>, text: &str) {
+    if from.as_deref() == Some(text) {
+        return;
+    }
+    if let Some(mut state) = egui::TextEdit::load_state(ctx, id) {
+        state.clear_undoer();
+        egui::TextEdit::store_state(ctx, id, state);
+    }
+    *from = Some(text.to_owned());
 }
 
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -1199,6 +1222,7 @@ fn open_editor(
         family_chosen: false,
         extras: Extras::default(),
         extras0: Extras::default(),
+        typing_from: None,
     });
 }
 
@@ -1668,8 +1692,10 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                     let galley = editor_galley(ui, &snapshot, text.as_str(), scale, wrap_width);
                     if snapshot.changes_with(text.as_str()) { galley } else { unseen(galley) }
                 };
+                let input = input_id();
+                forget_typing_before(ui.ctx(), input, &mut ed.typing_from, &ed.original);
                 let output = egui::TextEdit::multiline(&mut ed.text)
-                    .id(egui::Id::new("edit-text-line-input"))
+                    .id(input)
                     .font(font.clone())
                     .margin(egui::Margin::ZERO)
                     .layouter(&mut layouter)
@@ -1801,6 +1827,7 @@ mod tests {
             family_chosen: false,
             extras: Extras::default(),
             extras0: Extras::default(),
+            typing_from: None,
         };
         (app, ed)
     }
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 5b821b6381..c10094b208 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -229,6 +229,9 @@ impl PdfCraftApp {
 
     fn history_step(&mut self, undo: bool) {
         let Some((i, id)) = self.active_ids() else { return };
+        if !self.close_text_editors(i, id) {
+            return;
+        }
         let result = if undo { self.session.undo(id) } else { self.session.redo(id) };
         match result {
             Ok(label) => {
@@ -247,6 +250,57 @@ impl PdfCraftApp {
         }
     }
 
+    /// Before Undo or Redo: a paragraph or added text box open on the page shows the document as
+    /// it is before the step, so it is applied as clicking away applies it, then closed. Left
+    /// open, it kept showing what the step took away, and wrote from it when it was next applied.
+    /// What was typed is then the step Undo takes back. False (nothing is undone, and the box
+    /// stays open) while it holds text the standard fonts can't draw, or text that couldn't be
+    /// applied: it is shown, never lost.
+    pub(crate) fn close_text_editors(&mut self, i: usize, id: pdfcraft_engine::DocId) -> bool {
+        let Some(view) = self.views.get_mut(i) else { return true };
+        if let Some(c) = view.content.blocked() {
+            view.content.hold_blocked();
+            self.notify(crate::content_ui::undrawable_message(c));
+            return false;
+        }
+        if let Some(ed) = view.line_editor.take()
+            && let Some(edit) = crate::edit_text_ui::finished_edit(ed.clone())
+            && !self.apply_edit(edit)
+        {
+            if let Some(view) = self.views.get_mut(i) {
+                view.line_editor = Some(ed);
+            }
+            return false;
+        }
+        let added = self.session.get(id).map(|d| d.added().to_vec()).unwrap_or_default();
+        let Some(view) = self.views.get_mut(i) else { return true };
+        let draft = view.content.draft.clone();
+        if let Some(edit) = view.content.finish_draft(&added)
+            && !self.apply_edit(edit)
+        {
+            if let Some(view) = self.views.get_mut(i) {
+                view.content.draft = draft;
+            }
+            return false;
+        }
+        true
+    }
+
+    /// Whether the keyboard is in a box typed into on the page: a paragraph being edited, or added
+    /// text.
+    pub(crate) fn page_box_focused(&self, ctx: &egui::Context) -> bool {
+        let focused = ctx.memory(|m| m.focused());
+        focused == Some(crate::edit_text_ui::input_id()) || focused == Some(crate::content_ui::input_id())
+    }
+
+    /// Typing in a box on the page (a paragraph being edited, added text) that the page doesn't
+    /// have yet: Undo and Redo keys take it back in the box first.
+    pub(crate) fn page_typing_unapplied(&self) -> bool {
+        self.active.and_then(|i| self.views.get(i)).is_some_and(|v| {
+            v.line_editor.as_ref().is_some_and(|ed| ed.has_unsaved_text()) || v.content.draft.as_ref().is_some_and(|d| d.has_unapplied_typing())
+        })
+    }
+
     /// Apply any edit a view queued this frame (organize toolbar, keys).
     /// Returns false when a field refused the typing queued for it (its editor is open again).
     pub(crate) fn process_pending_edits(&mut self) -> bool {
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 71ba9ccdac..f9228c1f05 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -5980,3 +5980,58 @@ fn mode_tabs_keep_the_hand_over_a_paragraph_scrolled_under_them() {
     click_at(&mut h, convert);
     assert_eq!(h.state().mode, pdfcraft_ui_egui::Mode::Convert, "the tab takes the click, not the paragraph's editor");
 }
+
+/// The paragraph opened for typing, as a person opens it: a click on its text.
+fn open_paragraph(h: &mut Harness<'static, PdfCraftApp>) {
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let at = egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height());
+    click_at(h, at);
+    assert!(h.state().views[0].line_editor.is_some(), "the paragraph opens for typing");
+}
+
+/// Ctrl+Z after a formatting change, with the paragraph still open: the change is undone and
+/// the editor closes. The box's own Undo used to take the key, putting back the text it had
+/// before the change into a box laid out for the page after it, and the document kept the change.
+#[test]
+fn undo_with_the_paragraph_open_undoes_the_formatting() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    {
+        let s = h.state();
+        let doc = s.session.get(s.views[0].id).unwrap();
+        assert_eq!(doc.can_undo(), Some("Edit text"));
+        assert_eq!(doc.text_blocks(0)[0].base_font, "Helvetica-Bold");
+        assert!(s.views[0].line_editor.is_some(), "still editing");
+    }
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!(doc.can_undo(), None, "the formatting is undone");
+    assert_eq!(doc.text_blocks(0)[0].base_font, "Helvetica");
+    assert!(s.views[0].line_editor.is_none(), "the editor closed with the step it showed");
+}
+
+/// Undo while typing takes back the typing in the box first; the document is left alone.
+#[test]
+fn undo_while_typing_takes_back_the_typing_first() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    assert_ne!(h.state().views[0].line_editor.as_ref().unwrap().text, original);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    let s = h.state();
+    let ed = s.views[0].line_editor.as_ref().expect("still typing");
+    assert_eq!(ed.text, original, "the typing is taken back");
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), None, "the document is untouched");
+}

From cac63cf3dbd3449274fd8ad9689cf7778c8c5ef9 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:05:23 +1100
Subject: [PATCH 030/270] fix(ui): Redo after Undo in a page text box puts the
 typing back

With typing undone in a paragraph or added text box, its text matches
the page again, so Undo and Redo went to the document. Redo then closed
the box and redid a document change (or nothing), instead of putting the
typing back as the box's own Redo did before. And Shift+Cmd+Z is also
Cmd+Z to the Undo shortcut, so even a Redo the box kept was taken as a
document Undo.

Redo stays with the box while its own history has typing to put back
(the test egui makes when it handles the key), and Shift+Cmd+Z is never
a document Undo.
---
 crates/ui-egui/src/commands.rs     | 10 ++++++++--
 crates/ui-egui/src/editing.rs      | 21 ++++++++++++++++++++
 crates/ui-egui/tests/it/content.rs | 30 +++++++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 31 ++++++++++++++++++++++++++++++
 4 files changed, 90 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index ee19c168eb..fb4d6f1b6f 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -727,8 +727,14 @@ impl PdfCraftApp {
                 continue;
             }
             // A box typed into on the page (a paragraph being edited, added text) keeps Undo and
-            // Redo only while it holds typing the page doesn't have; then they reach the document.
-            let page_box = matches!(spec.id, "edit.undo" | "edit.redo") && self.page_box_focused(ctx) && !self.page_typing_unapplied();
+            // Redo only while it holds typing the page doesn't have, or Redo has typing to put
+            // back; then they reach the document. ⌘⇧Z is also ⌘Z to the Undo shortcut, so a
+            // Redo the box keeps is never taken as Undo.
+            let page_box = matches!(spec.id, "edit.undo" | "edit.redo")
+                && self.page_box_focused(ctx)
+                && !self.page_typing_unapplied()
+                && !(spec.id == "edit.redo" && self.page_box_can_redo(ctx))
+                && !(spec.id == "edit.undo" && ctx.input(|i| i.modifiers.shift));
             if typing && !spec.in_text && !page_box {
                 continue;
             }
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index c10094b208..39e0fd1adf 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -293,6 +293,27 @@ impl PdfCraftApp {
         focused == Some(crate::edit_text_ui::input_id()) || focused == Some(crate::content_ui::input_id())
     }
 
+    /// Whether the focused box on the page has typing its own Redo would put back: after Undo in
+    /// the box restores what the page has, Redo still belongs to the box, not the document. The
+    /// same test egui makes when it handles the key.
+    pub(crate) fn page_box_can_redo(&self, ctx: &egui::Context) -> bool {
+        let Some(view) = self.active.and_then(|i| self.views.get(i)) else { return false };
+        let focused = ctx.memory(|m| m.focused());
+        let (id, text) = if focused == Some(crate::edit_text_ui::input_id())
+            && let Some(ed) = &view.line_editor
+        {
+            (crate::edit_text_ui::input_id(), &ed.text)
+        } else if focused == Some(crate::content_ui::input_id())
+            && let Some(d) = &view.content.draft
+        {
+            (crate::content_ui::input_id(), &d.text)
+        } else {
+            return false;
+        };
+        egui::TextEdit::load_state(ctx, id)
+            .is_some_and(|state| state.cursor.char_range().is_some_and(|range| state.undoer().has_redo(&(range, text.clone()))))
+    }
+
     /// Typing in a box on the page (a paragraph being edited, added text) that the page doesn't
     /// have yet: Undo and Redo keys take it back in the box first.
     pub(crate) fn page_typing_unapplied(&self) -> bool {
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 515e3e04f1..fa0c01367a 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -861,3 +861,33 @@ fn a_resized_added_picture_shows_only_at_its_new_size() {
     let pixels = h.render().unwrap();
     assert!(red(&pixels, kept) > 100 && red(&pixels, gone) == 0, "the page raster has the picture at its new size");
 }
+
+/// The same in an added text box: Redo after Undo puts the typing back in the box, and the
+/// document's own Redo stays waiting.
+#[test]
+fn redo_after_undoing_typing_in_added_text_puts_it_back() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    let bold = pdfcraft_engine::AddedText { bold: true, ..text };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::UpdateContent { page: 0, index: 0, content: pdfcraft_engine::AddedContent::Text(bold) }));
+    assert!(h.state_mut().execute("edit.undo"));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"));
+    h.key_press_modifiers(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "Redo puts the typing back");
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!(doc.can_redo(), Some("Edit content"), "the document's Redo still waits");
+}
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index f9228c1f05..49e882893d 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6035,3 +6035,34 @@ fn undo_while_typing_takes_back_the_typing_first() {
     assert_eq!(ed.text, original, "the typing is taken back");
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), None, "the document is untouched");
 }
+
+/// Redo after Undo in the box puts the typing back, in the box: it doesn't reach the document,
+/// whose own Redo (a formatting change waiting here) must stay waiting.
+#[test]
+fn redo_after_undoing_typing_puts_the_typing_back() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    // Undo the bold (closing the editor), so the document has it to redo.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), Some("Edit text"));
+    open_paragraph(&mut h);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    let typed = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_ne!(h.state().views[0].line_editor.as_ref().unwrap().text, typed, "the typing is taken back");
+    h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
+    h.run_steps(3);
+    let s = h.state();
+    let ed = s.views[0].line_editor.as_ref().expect("still typing");
+    assert_eq!(ed.text, typed, "Redo puts the typing back");
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
+}

From 188341c66730ccf99082e03544688c371a316bb6 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:55:09 +1100
Subject: [PATCH 031/270] test(ui): the Redo test checks Undo restores the
 exact paragraph text

---
 crates/ui-egui/tests/it/editing.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 49e882893d..4bb74f82cd 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6051,13 +6051,14 @@ fn redo_after_undoing_typing_puts_the_typing_back() {
     h.run_steps(4);
     assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), Some("Edit text"));
     open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
     h.key_press_modifiers(Modifiers::COMMAND, Key::End);
     h.event(egui::Event::Text(" more".into()));
     h.run_steps(2);
     let typed = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
     h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
     h.run_steps(3);
-    assert_ne!(h.state().views[0].line_editor.as_ref().unwrap().text, typed, "the typing is taken back");
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the typing is taken back");
     h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
     h.run_steps(3);
     let s = h.state();

From 6c8fd74ca1c3b1b8c14e02631000990e9c641ac3 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 16:14:01 +1100
Subject: [PATCH 032/270] fix(ui): an unchanged added-text box closes without
 an edit

Finishing a box trimmed its text before comparing it with the item, so
an unchanged box whose text was saved with trailing spaces finished as
an edit. Before an Undo or Redo step that edit was applied, clearing
the document's Redo. A box matching its item is now no edit.
---
 crates/ui-egui/src/content_ui.rs   |  4 ++++
 crates/ui-egui/tests/it/content.rs | 26 ++++++++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 892e94ed67..788ba49600 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -639,6 +639,10 @@ fn finish(cv: &mut ContentView, d: TextDraft, added: &[Added]) -> Option<Edit> {
         Some(i) => {
             let (_, a) = on_page(added, d.page).into_iter().find(|(k, _)| *k == i)?;
             let AddedContent::Text(old) = &a.content else { return None };
+            // Unchanged is no edit, even for text saved with trailing spaces the trim would drop.
+            if *old == (AddedText { text: d.text.clone(), rect: d.rect, ..d.style.clone() }) {
+                return None;
+            }
             let updated = AddedText { text, rect: d.rect, ..d.style };
             (*old != updated).then_some(Edit::UpdateContent { page: d.page, index: i, content: AddedContent::Text(updated) })
         }
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index fa0c01367a..c24501dab3 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -891,3 +891,29 @@ fn redo_after_undoing_typing_in_added_text_puts_it_back() {
     let doc = s.session.get(s.views[0].id).unwrap();
     assert_eq!(doc.can_redo(), Some("Edit content"), "the document's Redo still waits");
 }
+
+/// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
+/// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
+/// that Redo first.
+#[test]
+fn redo_with_an_unchanged_box_open_redoes_the_document() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed ".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    let pdfcraft_engine::AddedContent::Text(saved) = added(&h)[0].content.clone() else { panic!() };
+    assert_eq!(saved.text, "Reviewed ", "the trailing space is kept");
+    let bold = pdfcraft_engine::AddedText { bold: true, ..saved };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::UpdateContent { page: 0, index: 0, content: pdfcraft_engine::AddedContent::Text(bold) }));
+    assert!(h.state_mut().execute("edit.undo"));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT, egui::Key::Z);
+    h.run_steps(4);
+    let pdfcraft_engine::AddedContent::Text(now) = &added(&h)[0].content else { panic!() };
+    assert!(now.bold, "the waiting Redo was redone");
+    assert!(h.state().views[0].content.draft.is_none(), "the box closed with the step");
+}

From 54e2895ae6a3b3a9572c1c4e4778232bba80a14e Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 10:38:46 +1100
Subject: [PATCH 033/270] fix(ui): the added-text editor keeps the box's
 alignment

Opening a centred or right-aligned Add text box drew its text at the left
edge, a layout the box never had, and Ctrl+Z inside the box (which goes to
the text, not the document) left it showing that way. The editor now lays
the text out with the box's alignment. Justified text is still shown
left-aligned while editing (TextEdit can't justify).
---
 crates/ui-egui/src/content_ui.rs   |  8 ++++++++
 crates/ui-egui/tests/it/content.rs | 22 ++++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 674210529e..f8db4c8ca5 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -560,6 +560,13 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
             // The box is white in every theme, so the caret must not follow the theme (pale in dark mode) (#655).
             ui.visuals_mut().text_cursor.stroke.color = crate::edit_text_ui::caret_color_on(Color32::WHITE);
             let [cr, cg, cb] = t.style.color.map(|v| (v.clamp(0.0, 1.0) * 255.0) as u8);
+            // Laid out as the page draws it, so opening the box doesn't show it realigned.
+            // shortcut: justified text is shown left-aligned here (TextEdit can't justify), until the editor gets its own layouter.
+            let halign = match t.style.align {
+                pdfcraft_engine::TextAlign::Center => egui::Align::Center,
+                pdfcraft_engine::TextAlign::Right => egui::Align::Max,
+                pdfcraft_engine::TextAlign::Left | pdfcraft_engine::TextAlign::Justify => egui::Align::Min,
+            };
             ui.horizontal_top(|ui| {
                 ui.spacing_mut().item_spacing.x = 4.0;
                 let resp = ui.add(
@@ -567,6 +574,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                         .font(font)
                         .desired_width(r.width().max(60.0))
                         .desired_rows(1)
+                        .horizontal_align(halign)
                         .background_color(if background_ready { Color32::TRANSPARENT } else { Color32::WHITE })
                         .text_color(Color32::from_rgb(cr, cg, cb))
                         .hint_text(tl!("Type text"))
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 515e3e04f1..de06d44b15 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -715,6 +715,28 @@ fn format_text_panel_sets_alignment_and_lists_planned_controls_disabled() {
 }
 
 /// Where a mode bar tab is, by its label.
+/// Opening right-aligned added text to edit it shows it right-aligned, as the page does, not at
+/// the box's left edge, where it never was.
+#[test]
+fn the_text_editor_keeps_the_boxs_alignment() {
+    let _gpu = gpu();
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Hi".into(), align: pdfcraft_engine::TextAlign::Right, ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 200.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.run_steps(3);
+    let r = item_on_screen(&h, rect);
+    let pixels = h.render().unwrap();
+    let left = ink(&pixels, egui::Rect::from_min_max(r.min, pos2(r.center().x, r.max.y)));
+    let right = ink(&pixels, egui::Rect::from_min_max(pos2(r.center().x, r.min.y), r.max));
+    assert!(left == 0 && right > 20, "the text is drawn at the right ({left} dark pixels left, {right} right)");
+}
+
 fn mode_tab(h: &Harness<'static, PdfCraftApp>, label: &str) -> egui::Rect {
     h.get_all_by_role_and_label(egui::accesskit::Role::Button, label).map(|n| n.rect()).find(|r| r.bottom() < 120.0).expect("a mode tab")
 }

From dcf33ed1c85e8804d76d21d04222bb4424f27878 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 13:38:28 +1100
Subject: [PATCH 034/270] fix(ui): Ctrl+Z in an open paragraph undoes the
 document, not stale text

Ctrl+Z is left to a focused text field, so in the paragraph editor it
went to the box's own Undo history. That history still held the
paragraph's text from before the last formatting change, so Ctrl+Z put
it back into a box laid out for the page after the change, a layout
the page never had, and the document kept the change. The box shared
its id across paragraphs too, so it could put back another paragraph's
text.

The history of the paragraph editor and the added-text box now starts
at what the page has. Undo and Redo keep the keys only while the box
holds typing the page doesn't have; then they reach the document. An
open box is applied (as clicking away applies it) and closed before an
Undo or Redo step, so it never shows a state the document has left;
text it can't apply keeps it open and stops the step.
---
 crates/ui-egui/src/commands.rs     |  5 ++-
 crates/ui-egui/src/content_ui.rs   | 23 +++++++++++--
 crates/ui-egui/src/edit_text_ui.rs | 29 +++++++++++++++-
 crates/ui-egui/src/editing.rs      | 54 +++++++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 55 ++++++++++++++++++++++++++++++
 5 files changed, 161 insertions(+), 5 deletions(-)

diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 92bc0b360e..ee19c168eb 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -726,7 +726,10 @@ impl PdfCraftApp {
             if matches!(spec.id, "view.previous_view" | "view.next_view") && !self.command_enabled(spec) {
                 continue;
             }
-            if typing && !spec.in_text {
+            // A box typed into on the page (a paragraph being edited, added text) keeps Undo and
+            // Redo only while it holds typing the page doesn't have; then they reach the document.
+            let page_box = matches!(spec.id, "edit.undo" | "edit.redo") && self.page_box_focused(ctx) && !self.page_typing_unapplied();
+            if typing && !spec.in_text && !page_box {
                 continue;
             }
             let Some(key) = Key::from_name(s.key) else { continue };
diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index f8db4c8ca5..c99c2cd787 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -66,8 +66,18 @@ pub struct TextDraft {
     /// Display space.
     pub rect: [f64; 4],
     pub text: String,
+    /// The box's formatting; its `text` is what the page has (empty for new text).
     pub style: AddedText,
     pub focus: bool,
+    /// The text the box's own Undo history starts from ([`crate::edit_text_ui::forget_typing_before`]).
+    pub typing_from: Option<String>,
+}
+
+impl TextDraft {
+    /// Typing the page doesn't have yet: Undo takes it back in the box before touching the document.
+    pub(crate) fn has_unapplied_typing(&self) -> bool {
+        self.text != self.style.text
+    }
 }
 
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -394,7 +404,7 @@ pub(crate) fn page_input(
             let page_width = info.pages.get(page).map_or(f64::INFINITY, |p| p.width as f64);
             let rect = [at[0], at[1] - style.size * 1.2, (at[0] + 200.0).min(page_width), at[1]];
             style.rect = rect;
-            cv.draft = Some(TextDraft { page, index: None, rect, text: String::new(), style, focus: true });
+            cv.draft = Some(TextDraft { page, index: None, rect, text: String::new(), style, focus: true, typing_from: None });
             consumed = true;
             if typed.is_some() {
                 view.pending_edit = typed;
@@ -432,7 +442,7 @@ pub(crate) fn page_input(
         if let Some(edit) = cv.finish_draft(added) {
             view.pending_edit = Some(edit);
         }
-        cv.draft = Some(TextDraft { page, index: Some(i), rect: t.rect, text: t.text.clone(), style: t.clone(), focus: true });
+        cv.draft = Some(TextDraft { page, index: Some(i), rect: t.rect, text: t.text.clone(), style: t.clone(), focus: true, typing_from: None });
         cv.selected = Some((page, i));
         consumed = true;
         return consumed;
@@ -567,6 +577,8 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                 pdfcraft_engine::TextAlign::Right => egui::Align::Max,
                 pdfcraft_engine::TextAlign::Left | pdfcraft_engine::TextAlign::Justify => egui::Align::Min,
             };
+            let input = input_id();
+            crate::edit_text_ui::forget_typing_before(ui.ctx(), input, &mut t.typing_from, &t.style.text);
             ui.horizontal_top(|ui| {
                 ui.spacing_mut().item_spacing.x = 4.0;
                 let resp = ui.add(
@@ -578,7 +590,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                         .background_color(if background_ready { Color32::TRANSPARENT } else { Color32::WHITE })
                         .text_color(Color32::from_rgb(cr, cg, cb))
                         .hint_text(tl!("Type text"))
-                        .id_salt("added-text-edit"),
+                        .id(input),
                 );
                 if t.focus {
                     resp.request_focus();
@@ -641,6 +653,11 @@ fn finish(cv: &mut ContentView, d: TextDraft, added: &[Added]) -> Option<Edit> {
     }
 }
 
+/// The added-text box's text field.
+pub(crate) fn input_id() -> egui::Id {
+    egui::Id::new("added-text-input")
+}
+
 /// How to use the tools, under the Add content list.
 pub(crate) fn hint(ui: &mut egui::Ui, t: &Tokens) {
     ui.label(
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index 3a1ab04367..f2c5c55151 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -256,6 +256,29 @@ pub struct LineEditor {
     /// horizontal scale (%), and what they were.
     pub extras: Extras,
     extras0: Extras,
+    /// The text the box's own Undo history starts from; see [`forget_typing_before`].
+    typing_from: Option<String>,
+}
+
+/// The paragraph editor's text box.
+pub(crate) fn input_id() -> egui::Id {
+    egui::Id::new("edit-text-line-input")
+}
+
+/// The page text box `id` keeps its own Undo history, across every paragraph or box it has shown
+/// (they share the id). Once the page has `text` (the box opened on it, or formatting applied it),
+/// that history is cleared: Undo in the box takes back only what was typed since, and then reaches
+/// the document. Kept, it put back text from another paragraph, or the whole paragraph as it was
+/// before a format change, into a box showing the page as it is now.
+pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, from: &mut Option<String>, text: &str) {
+    if from.as_deref() == Some(text) {
+        return;
+    }
+    if let Some(mut state) = egui::TextEdit::load_state(ctx, id) {
+        state.clear_undoer();
+        egui::TextEdit::store_state(ctx, id, state);
+    }
+    *from = Some(text.to_owned());
 }
 
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -1199,6 +1222,7 @@ fn open_editor(
         family_chosen: false,
         extras: Extras::default(),
         extras0: Extras::default(),
+        typing_from: None,
     });
 }
 
@@ -1668,8 +1692,10 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                     let galley = editor_galley(ui, &snapshot, text.as_str(), scale, wrap_width);
                     if snapshot.changes_with(text.as_str()) { galley } else { unseen(galley) }
                 };
+                let input = input_id();
+                forget_typing_before(ui.ctx(), input, &mut ed.typing_from, &ed.original);
                 let output = egui::TextEdit::multiline(&mut ed.text)
-                    .id(egui::Id::new("edit-text-line-input"))
+                    .id(input)
                     .font(font.clone())
                     .margin(egui::Margin::ZERO)
                     .layouter(&mut layouter)
@@ -1801,6 +1827,7 @@ mod tests {
             family_chosen: false,
             extras: Extras::default(),
             extras0: Extras::default(),
+            typing_from: None,
         };
         (app, ed)
     }
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 2fdc2e9d02..6f16837242 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -229,6 +229,9 @@ impl PdfCraftApp {
 
     fn history_step(&mut self, undo: bool) {
         let Some((i, id)) = self.active_ids() else { return };
+        if !self.close_text_editors(i, id) {
+            return;
+        }
         let result = if undo { self.session.undo(id) } else { self.session.redo(id) };
         match result {
             Ok(label) => {
@@ -247,6 +250,57 @@ impl PdfCraftApp {
         }
     }
 
+    /// Before Undo or Redo: a paragraph or added text box open on the page shows the document as
+    /// it is before the step, so it is applied as clicking away applies it, then closed. Left
+    /// open, it kept showing what the step took away, and wrote from it when it was next applied.
+    /// What was typed is then the step Undo takes back. False (nothing is undone, and the box
+    /// stays open) while it holds text the standard fonts can't draw, or text that couldn't be
+    /// applied: it is shown, never lost.
+    pub(crate) fn close_text_editors(&mut self, i: usize, id: pdfcraft_engine::DocId) -> bool {
+        let Some(view) = self.views.get_mut(i) else { return true };
+        if let Some(c) = view.content.blocked() {
+            view.content.hold_blocked();
+            self.notify(crate::content_ui::undrawable_message(c));
+            return false;
+        }
+        if let Some(ed) = view.line_editor.take()
+            && let Some(edit) = crate::edit_text_ui::finished_edit(ed.clone())
+            && !self.apply_edit(edit)
+        {
+            if let Some(view) = self.views.get_mut(i) {
+                view.line_editor = Some(ed);
+            }
+            return false;
+        }
+        let added = self.session.get(id).map(|d| d.added().to_vec()).unwrap_or_default();
+        let Some(view) = self.views.get_mut(i) else { return true };
+        let draft = view.content.draft.clone();
+        if let Some(edit) = view.content.finish_draft(&added)
+            && !self.apply_edit(edit)
+        {
+            if let Some(view) = self.views.get_mut(i) {
+                view.content.draft = draft;
+            }
+            return false;
+        }
+        true
+    }
+
+    /// Whether the keyboard is in a box typed into on the page: a paragraph being edited, or added
+    /// text.
+    pub(crate) fn page_box_focused(&self, ctx: &egui::Context) -> bool {
+        let focused = ctx.memory(|m| m.focused());
+        focused == Some(crate::edit_text_ui::input_id()) || focused == Some(crate::content_ui::input_id())
+    }
+
+    /// Typing in a box on the page (a paragraph being edited, added text) that the page doesn't
+    /// have yet: Undo and Redo keys take it back in the box first.
+    pub(crate) fn page_typing_unapplied(&self) -> bool {
+        self.active.and_then(|i| self.views.get(i)).is_some_and(|v| {
+            v.line_editor.as_ref().is_some_and(|ed| ed.has_unsaved_text()) || v.content.draft.as_ref().is_some_and(|d| d.has_unapplied_typing())
+        })
+    }
+
     /// Apply any edit a view queued this frame (organize toolbar, keys).
     /// Returns false when a field refused the typing queued for it (its editor is open again).
     pub(crate) fn process_pending_edits(&mut self) -> bool {
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 73464d33e7..2fcf67dc42 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6019,3 +6019,58 @@ fn mode_tabs_keep_the_hand_over_a_paragraph_scrolled_under_them() {
     click_at(&mut h, convert);
     assert_eq!(h.state().mode, pdfcraft_ui_egui::Mode::Convert, "the tab takes the click, not the paragraph's editor");
 }
+
+/// The paragraph opened for typing, as a person opens it: a click on its text.
+fn open_paragraph(h: &mut Harness<'static, PdfCraftApp>) {
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let at = egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height());
+    click_at(h, at);
+    assert!(h.state().views[0].line_editor.is_some(), "the paragraph opens for typing");
+}
+
+/// Ctrl+Z after a formatting change, with the paragraph still open: the change is undone and
+/// the editor closes. The box's own Undo used to take the key, putting back the text it had
+/// before the change into a box laid out for the page after it, and the document kept the change.
+#[test]
+fn undo_with_the_paragraph_open_undoes_the_formatting() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    {
+        let s = h.state();
+        let doc = s.session.get(s.views[0].id).unwrap();
+        assert_eq!(doc.can_undo(), Some("Edit text"));
+        assert_eq!(doc.text_blocks(0)[0].base_font, "Helvetica-Bold");
+        assert!(s.views[0].line_editor.is_some(), "still editing");
+    }
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!(doc.can_undo(), None, "the formatting is undone");
+    assert_eq!(doc.text_blocks(0)[0].base_font, "Helvetica");
+    assert!(s.views[0].line_editor.is_none(), "the editor closed with the step it showed");
+}
+
+/// Undo while typing takes back the typing in the box first; the document is left alone.
+#[test]
+fn undo_while_typing_takes_back_the_typing_first() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    assert_ne!(h.state().views[0].line_editor.as_ref().unwrap().text, original);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    let s = h.state();
+    let ed = s.views[0].line_editor.as_ref().expect("still typing");
+    assert_eq!(ed.text, original, "the typing is taken back");
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), None, "the document is untouched");
+}

From 5c1c3462eb429deab889b9552b2b35821d950004 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 13:40:02 +1100
Subject: [PATCH 035/270] M7: align the selected lines of a paragraph or text
 box on their own

Format text's alignment always re-aligned the whole paragraph or added
text box, and clicking it closed an added text box, losing the
selection, so one line couldn't be aligned. With text selected,
alignment now applies to the lines (text between line breaks) the
selection touches; with only the caret, to the whole box as before.

- Added text stores each line's alignment in its /PCAdded parameters
  (/Aligns, null where a line follows /Align). A justified line's last
  row is not stretched.
- An edited paragraph sends its rows' alignments with each rewrite
  while it is open (BlockStyle::aligns), in both the single-style and
  the styled-region rewrite.
- Both editors draw each line by its own alignment, and the alignment
  buttons show the selected line's. An added text box stays open while
  Format text is used, its style applied at once; clicks are judged by
  where they were pressed, so a touch or pen tap on the panel doesn't
  close either editor.
- Automation: `aligns` on page_add_text, content_update and text_edit.
---
 crates/automation/src/content.rs         |  51 +++++++--
 crates/automation/src/lib.rs             |  11 +-
 crates/automation/src/tools.rs           |   3 +
 crates/automation/tests/it/automation.rs |  23 ++++
 crates/edit/src/added.rs                 | 136 +++++++++++++++--------
 crates/edit/src/added/arabic_tests.rs    |   4 +-
 crates/edit/src/lib.rs                   |   1 +
 crates/edit/src/paragraph_align.rs       | 135 ++++++++++++++++++++++
 crates/edit/src/tests.rs                 |  71 ++++++++++++
 crates/edit/src/text.rs                  |  44 +++++---
 crates/edit/src/text_regions.rs          |  15 ++-
 crates/engine/src/lib.rs                 |   1 +
 crates/engine/src/tests.rs               |   2 +
 crates/ui-egui/src/content_ui.rs         | 117 +++++++++++++++----
 crates/ui-egui/src/edit_text_ui.rs       |  39 ++++++-
 crates/ui-egui/src/format_text_ui.rs     |  60 +++++++++-
 crates/ui-egui/src/panels.rs             |  62 +++++++++--
 crates/ui-egui/tests/it/content.rs       |  32 ++++++
 crates/ui-egui/tests/it/editing.rs       |  53 +++++++++
 parity/acrobat-features.toml             |   4 +-
 20 files changed, 738 insertions(+), 126 deletions(-)
 create mode 100644 crates/edit/src/paragraph_align.rs

diff --git a/crates/automation/src/content.rs b/crates/automation/src/content.rs
index 8926a1368b..c162e739df 100644
--- a/crates/automation/src/content.rs
+++ b/crates/automation/src/content.rs
@@ -53,17 +53,48 @@ fn style(a: &Args, t: &mut AddedText) -> Result<()> {
         t.color = parse_color(c)?;
     }
     if let Some(al) = a.opt_str("align")? {
-        t.align = match al {
-            "left" => TextAlign::Left,
-            "center" | "centre" => TextAlign::Center,
-            "right" => TextAlign::Right,
-            "justify" => TextAlign::Justify,
-            other => return Err(bad(format!("unknown align {other:?}"))),
-        };
+        t.align = parse_align(al)?;
+        // The whole box: no paragraph keeps an alignment of its own unless `aligns` gives it one.
+        t.aligns.clear();
+    }
+    if let Some(aligns) = opt_aligns(a)? {
+        let count = pdfcraft_engine::paragraph_align::count(&t.text);
+        t.aligns = pdfcraft_engine::paragraph_align::tidy(aligns.into_iter().take(count).collect(), t.align);
     }
     Ok(())
 }
 
+pub(crate) fn parse_align(al: &str) -> Result<TextAlign> {
+    Ok(match al {
+        "left" => TextAlign::Left,
+        "center" | "centre" => TextAlign::Center,
+        "right" => TextAlign::Right,
+        "justify" => TextAlign::Justify,
+        other => return Err(bad(format!("unknown align {other:?}"))),
+    })
+}
+
+/// Most entries `aligns` takes: one per paragraph, and no text has this many.
+const MAX_ALIGNS: usize = 4096;
+
+/// `aligns`: each paragraph's (line's) own alignment, or null where it follows `align`.
+pub(crate) fn opt_aligns(a: &Args) -> Result<Option<Vec<Option<TextAlign>>>> {
+    let Some(v) = a.get("aligns") else { return Ok(None) };
+    let items = v.as_array().ok_or_else(|| bad("aligns must be an array of left, center, right, justify or null"))?;
+    if items.len() > MAX_ALIGNS {
+        return Err(bad(format!("aligns takes at most {MAX_ALIGNS} entries")));
+    }
+    items
+        .iter()
+        .map(|v| match v {
+            Value::Null => Ok(None),
+            Value::String(s) => parse_align(s).map(Some),
+            _ => Err(bad("each entry of aligns is left, center, right, justify or null")),
+        })
+        .collect::<Result<Vec<_>>>()
+        .map(Some)
+}
+
 impl Automation {
     pub(crate) fn content_list(&self, a: &Args) -> Result<Value> {
         let doc = self.doc(a)?;
@@ -153,6 +184,8 @@ impl Automation {
         match &mut content {
             AddedContent::Text(t) => {
                 if let Some(s) = a.opt_str("text")? {
+                    // Each paragraph keeps its own alignment through the retyping.
+                    t.aligns = pdfcraft_engine::paragraph_align::remap(&t.text, s, &t.aligns);
                     t.text = s.to_string();
                 }
                 style(a, t)?;
@@ -164,8 +197,8 @@ impl Automation {
                 if a.get("text").is_some() {
                     return Err(bad("images have no text"));
                 }
-                if ["font", "size", "bold", "italic", "color", "align"].iter().any(|k| a.get(k).is_some()) {
-                    return Err(bad("font, size, bold, italic, color and align apply to text"));
+                if ["font", "size", "bold", "italic", "color", "align", "aligns"].iter().any(|k| a.get(k).is_some()) {
+                    return Err(bad("font, size, bold, italic, color, align and aligns apply to text"));
                 }
                 if let Some(deg) = a.opt_int("rotate")? {
                     if deg.rem_euclid(90) != 0 {
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 1dae412e41..8c5ae96bc3 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -726,13 +726,10 @@ impl Automation {
                     style.color = Some(comments::parse_color(c)?);
                 }
                 if let Some(al) = a.opt_str("align")? {
-                    style.align = Some(match al {
-                        "left" => pdfcraft_engine::TextAlign::Left,
-                        "center" => pdfcraft_engine::TextAlign::Center,
-                        "right" => pdfcraft_engine::TextAlign::Right,
-                        "justify" => pdfcraft_engine::TextAlign::Justify,
-                        other => return Err(ToolError::InvalidArgs(format!("unknown align {other:?}"))),
-                    });
+                    style.align = Some(content::parse_align(al)?);
+                }
+                if let Some(aligns) = content::opt_aligns(&a)? {
+                    style.aligns = aligns;
                 }
                 // Where the paragraph is drawn after the edit: moved by dx, dy (up is +dy).
                 let [dx, dy] = style.offset.unwrap_or([0.0, 0.0]);
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 1e009c1170..db521074d7 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -594,6 +594,7 @@ pub fn tools() -> Vec<ToolDef> {
                 "font": { "type": "string", "enum": ["helvetica", "times", "courier"] }, "size": { "type": "number", "minimum": 1, "maximum": 500 },
                 "bold": { "type": "boolean" }, "italic": { "type": "boolean" }, "color": { "type": "string" },
                 "align": { "type": "string", "enum": ["left", "center", "right", "justify"] },
+                "aligns": { "type": "array", "maxItems": 4096, "items": { "enum": ["left", "center", "right", "justify", null] }, "description": "Each paragraph's (line's) own alignment, by index; null follows align." },
             }),
             &["doc", "page", "text"],
         )),
@@ -615,6 +616,7 @@ pub fn tools() -> Vec<ToolDef> {
                     "font": { "type": "string", "enum": ["helvetica", "times", "courier"] }, "size": { "type": "number", "minimum": 1, "maximum": 500 },
                     "bold": { "type": "boolean" }, "italic": { "type": "boolean" }, "color": { "type": "string" },
                     "align": { "type": "string", "enum": ["left", "center", "right", "justify"] },
+                    "aligns": { "type": "array", "maxItems": 4096, "items": { "enum": ["left", "center", "right", "justify", null] }, "description": "Each paragraph's (line's) own alignment, by index; null follows align." },
                     "rotate": { "type": "integer" }, "flip_h": { "type": "boolean" }, "flip_v": { "type": "boolean" },
                     "crop": { "type": "array", "items": { "type": "number", "minimum": 0, "maximum": 0.49 }, "minItems": 4, "maxItems": 4 },
                     "image": { "type": "string", "description": "Replace the picture with this file." },
@@ -1362,6 +1364,7 @@ pub fn tools() -> Vec<ToolDef> {
                     "size": { "type": "number", "exclusiveMinimum": 0 },
                     "color": { "type": "string", "description": "#rrggbb" },
                     "align": { "type": "string", "enum": ["left", "center", "right", "justify"] },
+                    "aligns": { "type": "array", "maxItems": 4096, "items": { "enum": ["left", "center", "right", "justify", null] }, "description": "Each paragraph's (line's) own alignment, by index; null follows align." },
                     "underline": { "type": "boolean" },
                     "line_spacing": { "type": "number", "description": "Multiple of the font size (1.2 is ordinary)." },
                     "dx": { "type": "number", "description": "Paragraph only: move right by this many points (negative: left)." },
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 9fd5c4269a..5b8931c6af 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -8424,3 +8424,26 @@ fn bookmark_list_reports_colour_and_style() {
     let re = ok(&mut b, "doc_open", json!({ "path": "restyled.pdf" }))["doc"].as_u64().unwrap();
     assert_eq!(style(&ok(&mut b, "bookmark_list", json!({ "doc": re }))["bookmarks"]), style(&set), "saved");
 }
+
+/// `aligns` gives each line of added text an alignment of its own; `align` alone is the whole box
+/// again. Text edits take `aligns` for a paragraph's rows the same way.
+#[test]
+fn added_text_lines_take_their_own_alignments() {
+    let dir = workdir("paragraph-aligns");
+    let mut a = auto(&dir);
+    let id = ok(&mut a, "doc_create", json!({"from":"blank","width":600,"height":400}))["doc"].as_u64().unwrap();
+    ok(&mut a, "page_add_text", json!({"doc":id,"page":1,"text":"Left line\nRight line","at":[40,50],"width":500,"size":12,"aligns":[null,"right"]}));
+    let rect = |a: &mut Automation, text: &str| -> Vec<f64> {
+        let lines = ok(a, "text_lines", json!({"doc":id,"page":1}));
+        let line = lines["lines"].as_array().unwrap().iter().find(|l| l["text"] == text).cloned().unwrap();
+        line["rect"].as_array().unwrap().iter().map(|v| v.as_f64().unwrap()).collect()
+    };
+    assert!((rect(&mut a, "Left line")[0] - 40.0).abs() < 1.0);
+    assert!((rect(&mut a, "Right line")[2] - 540.0).abs() < 1.0, "{:?}", rect(&mut a, "Right line"));
+    // The whole box centred: the right-aligned line goes with it.
+    ok(&mut a, "content_update", json!({"doc":id,"page":1,"index":1,"align":"center"}));
+    let right = rect(&mut a, "Right line");
+    assert!(((right[0] + right[2]) / 2.0 - 290.0).abs() < 1.0, "{right:?}");
+    assert!(a.call("content_update", &json!({"doc":id,"page":1,"index":1,"aligns":["sideways"]})).is_err());
+    assert!(a.call("content_update", &json!({"doc":id,"page":1,"index":1,"aligns":"right"})).is_err());
+}
diff --git a/crates/edit/src/added.rs b/crates/edit/src/added.rs
index d39bb0fa91..29ccc4e8c9 100644
--- a/crates/edit/src/added.rs
+++ b/crates/edit/src/added.rs
@@ -116,6 +116,16 @@ pub struct AddedText {
     pub size: f64,
     pub color: [f64; 3],
     pub align: Align,
+    /// Paragraphs (lines typed with Enter) aligned other than [`AddedText::align`], by index;
+    /// `None` and paragraphs past the end follow `align` ([`crate::paragraph_align`]).
+    pub aligns: Vec<Option<Align>>,
+}
+
+impl AddedText {
+    /// Paragraph `i`'s alignment.
+    pub fn paragraph_align(&self, i: usize) -> Align {
+        crate::paragraph_align::align_of(&self.aligns, i, self.align)
+    }
 }
 
 impl Default for AddedText {
@@ -129,6 +139,7 @@ impl Default for AddedText {
             size: 12.0,
             color: [0.0; 3],
             align: Align::Left,
+            aligns: Vec::new(),
         }
     }
 }
@@ -232,7 +243,7 @@ fn norm(r: [f64; 4]) -> [f64; 4] {
 
 /// The lines of a text item after wrapping to its box width.
 pub fn lines(t: &AddedText) -> Vec<String> {
-    wrapped(t).into_iter().map(|(line, _)| line).collect()
+    wrapped(t).into_iter().map(|(line, ..)| line).collect()
 }
 
 #[cfg(test)]
@@ -242,13 +253,13 @@ thread_local! {
 }
 
 /// [`lines`], each with whether its paragraph runs right to left (its first strong character
-/// does).
-fn wrapped(t: &AddedText) -> Vec<(String, bool)> {
+/// does) and which paragraph it is in.
+fn wrapped(t: &AddedText) -> Vec<(String, bool, usize)> {
     #[cfg(test)]
     WRAP_CALLS.with(|c| c.set(c.get().saturating_add(1)));
     let width = (t.rect[2] - t.rect[0]).max(t.size);
     let mut out = Vec::new();
-    for para in t.text.split('\n') {
+    for (index, para) in t.text.split('\n').enumerate() {
         // Arabic or Hebrew: laid out with the bidirectional algorithm and shaped.
         let rtl_script = para.chars().any(|c| is_arabic(c) || is_hebrew(c));
         let thai = para.chars().any(is_thai);
@@ -256,7 +267,7 @@ fn wrapped(t: &AddedText) -> Vec<(String, bool)> {
             && !rtl_script
             && let Ok(lines) = thai_lines(t, para, width)
         {
-            out.extend(lines.into_iter().map(|line| (line, false)));
+            out.extend(lines.into_iter().map(|line| (line, false, index)));
             continue;
         }
         let rtl = rtl_script && unicode_bidi::get_base_direction(para) == unicode_bidi::Direction::Rtl;
@@ -272,7 +283,7 @@ fn wrapped(t: &AddedText) -> Vec<(String, bool)> {
             let candidate_w =
                 if rtl_script || thai { if line.is_empty() { measure(word) } else { line_w + space + measure(word) } } else { measure(&candidate) };
             if !line.is_empty() && candidate_w > width {
-                out.push((std::mem::take(&mut line), rtl));
+                out.push((std::mem::take(&mut line), rtl, index));
                 line = word.to_string();
                 line_w = measure(word);
             } else {
@@ -280,7 +291,7 @@ fn wrapped(t: &AddedText) -> Vec<(String, bool)> {
                 line_w = candidate_w;
             }
         }
-        out.push((line, rtl));
+        out.push((line, rtl, index));
     }
     out
 }
@@ -354,7 +365,7 @@ pub fn first_undrawable(t: &AddedText) -> Option<char> {
         return t.text.split('\n').find_map(pdfcraft_fonts::first_non_win_ansi);
     }
     // What `shaped_layout` leaves to the standard font, exactly as `draw_shaped` splits it.
-    wrapped(t).into_iter().find_map(|(line, rtl)| {
+    wrapped(t).into_iter().find_map(|(line, rtl, _)| {
         let (pieces, _) = shaped_layout(t, &line, rtl).ok()?;
         pieces.iter().find_map(|p| match p {
             Piece::Latin(s) => pdfcraft_fonts::first_non_win_ansi(s),
@@ -523,8 +534,26 @@ fn font_name(base: &str) -> String {
 const GLYPHS_PER_FONT: usize = 240;
 
 /// A line of a shaped-text item after layout: its text, whether its paragraph runs right to left,
-/// its pieces in drawing order and its width at the item's size.
-type LaidLine = (String, bool, Vec<Piece>, f64);
+/// its paragraph, its pieces in drawing order and its width at the item's size.
+type LaidLine = (String, bool, usize, Vec<Piece>, f64);
+
+/// Where line `i` (`w` wide unstretched, with `spaces` spaces) starts in the box `r`, and its word
+/// spacing. `paragraphs` holds each line's paragraph: a line takes its paragraph's alignment, and
+/// every line of a justified paragraph but its last is stretched to the box's width.
+fn placed(t: &AddedText, r: [f64; 4], paragraphs: &[usize], i: usize, w: f64, spaces: usize, rtl: bool) -> (f64, f64) {
+    let paragraph = paragraphs.get(i).copied().unwrap_or(0);
+    let align = t.paragraph_align(paragraph);
+    let ends_paragraph = paragraphs.get(i + 1) != Some(&paragraph);
+    let tw = if align == Align::Justify && !ends_paragraph && spaces > 0 { ((r[2] - r[0]) - w).max(0.0) / spaces as f64 } else { 0.0 };
+    let x = match align {
+        // A right-to-left paragraph's unstretched last line ends at the right edge.
+        Align::Justify if rtl => r[2] - w - tw * spaces as f64,
+        Align::Left | Align::Justify => r[0],
+        Align::Center => r[0] + ((r[2] - r[0]) - w) / 2.0,
+        Align::Right => r[2] - w,
+    };
+    (x, tw)
+}
 
 /// Draw a text item that has Arabic, Hebrew or Thai in it. Each line is laid out in display order; their glyphs
 /// come from Type 3 fonts drawn from the craft-fonts face's outlines (no font file is embedded),
@@ -532,7 +561,7 @@ type LaidLine = (String, bool, Vec<Piece>, f64);
 fn draw_shaped(doc: &mut Document, t: &AddedText, taken: &Dict, fonts: &mut Dict, out: &mut Vec<u8>) -> Result<(), EditError> {
     let laid = wrapped(t)
         .into_iter()
-        .map(|(line, rtl)| shaped_layout(t, &line, rtl).map(|(pieces, w)| (line, rtl, pieces, w)))
+        .map(|(line, rtl, paragraph)| shaped_layout(t, &line, rtl).map(|(pieces, w)| (line, rtl, paragraph, pieces, w)))
         .collect::<Result<Vec<_>, _>>()?;
     draw_laid_shaped(doc, t, &laid, taken, fonts, out, shaped_glyph)
 }
@@ -554,7 +583,7 @@ fn draw_laid_shaped(
     // one of the fonts, so copy and search get each character exactly once.
     let mut keys: Vec<&ShapedCluster> = Vec::new();
     let mut index: HashMap<ClusterKey, usize> = HashMap::new();
-    for c in laid.iter().flat_map(|(_, _, pieces, _)| pieces).flat_map(|p| match p {
+    for c in laid.iter().flat_map(|(_, _, _, pieces, _)| pieces).flat_map(|p| match p {
         Piece::Shaped(clusters) => clusters.as_slice(),
         Piece::Latin(_) => &[],
     }) {
@@ -596,21 +625,14 @@ fn draw_laid_shaped(
     }
     let [cr, cg, cb] = t.color.map(|v| v.clamp(0.0, 1.0));
     out.extend(format!("BT {} {} {} rg\n", n(cr), n(cg), n(cb)).bytes());
-    for (i, (line, rtl, pieces, w)) in laid.iter().enumerate() {
+    let paragraphs: Vec<usize> = laid.iter().map(|(_, _, p, ..)| *p).collect();
+    for (i, (line, rtl, _, pieces, w)) in laid.iter().enumerate() {
         // Shaped glyphs are painted in visual order. Keep the original line's typing order
         // explicitly, including marks, ligatures, digits and mixed-script punctuation.
         let logical: String = line.encode_utf16().map(|u| format!("{u:04X}")).collect();
         out.extend(format!("/Span <</ActualText <FEFF{logical}>>> BDC\n").bytes());
         let spaces = line.matches(' ').count();
-        // Justified: the spaces of every line but the last stretch to fill the box.
-        let tw = if t.align == Align::Justify && i + 1 < laid.len() && spaces > 0 { ((r[2] - r[0]) - w).max(0.0) / spaces as f64 } else { 0.0 };
-        let x = match t.align {
-            // A right-to-left paragraph's unstretched last line ends at the right edge.
-            Align::Justify if *rtl => r[2] - w - tw * spaces as f64,
-            Align::Left | Align::Justify => r[0],
-            Align::Center => r[0] + ((r[2] - r[0]) - w) / 2.0,
-            Align::Right => r[2] - w,
-        };
+        let (x, tw) = placed(t, r, &paragraphs, i, *w, spaces, *rtl);
         let y = r[3] - (i as f64 * 1.2 + 0.95) * t.size;
         let mut pen = x;
         let mut current: Option<&str> = None;
@@ -788,20 +810,14 @@ fn draw(doc: &mut Document, c: &Content, view: [f64; 6], taken: &Dict, existing:
             let r = text_rect(t);
             let [cr, cg, cb] = t.color.map(|v| v.clamp(0.0, 1.0));
             out.extend(format!("BT /{name} {} Tf {} {} {} rg\n", n(t.size), n(cr), n(cg), n(cb)).bytes());
-            let all = lines(t);
-            for (i, line) in all.iter().enumerate() {
+            let all = wrapped(t);
+            let paragraphs: Vec<usize> = all.iter().map(|(_, _, p)| *p).collect();
+            for (i, (line, ..)) in all.iter().enumerate() {
                 let w = t.family.width(line, t.size, t.bold, t.italic);
-                let x = match t.align {
-                    Align::Left | Align::Justify => r[0],
-                    Align::Center => r[0] + ((r[2] - r[0]) - w) / 2.0,
-                    Align::Right => r[2] - w,
-                };
                 // Baseline: 0.8 em below the line top.
                 let y = r[3] - (i as f64 * 1.2 + 0.95) * t.size;
-                // Justified: word spacing makes every line but the last fill the box.
-                let spaces = line.matches(' ').count();
-                let tw =
-                    if t.align == Align::Justify && i + 1 < all.len() && spaces > 0 { ((r[2] - r[0]) - w).max(0.0) / spaces as f64 } else { 0.0 };
+                // Justified: word spacing makes every line of a paragraph but its last fill the box.
+                let (x, tw) = placed(t, r, &paragraphs, i, w, line.matches(' ').count(), false);
                 out.extend(format!("1 0 0 1 {} {} Tm {} Tw ", n(x), n(y), n(tw)).bytes());
                 out.extend(literal(&win_ansi(line)));
                 out.extend_from_slice(b" Tj\n");
@@ -851,15 +867,12 @@ fn params(c: &Content) -> Dict {
             d.set(b"Font".to_vec(), Object::name(t.family.base_font(t.bold, t.italic)));
             d.set(b"Size".to_vec(), Object::Real(t.size));
             d.set(b"Color".to_vec(), arr(&t.color));
-            d.set(
-                b"Align".to_vec(),
-                Object::Int(match t.align {
-                    Align::Left => 0,
-                    Align::Center => 1,
-                    Align::Right => 2,
-                    Align::Justify => 3,
-                }),
-            );
+            d.set(b"Align".to_vec(), Object::Int(align_code(t.align)));
+            // Each paragraph's own alignment, or null where it follows /Align.
+            let aligns = crate::paragraph_align::tidy(t.aligns.clone(), t.align);
+            if !aligns.is_empty() {
+                d.set(b"Aligns".to_vec(), Object::Array(aligns.iter().map(|a| a.map_or(Object::Null, |a| Object::Int(align_code(a)))).collect()));
+            }
             d.set(b"Rect".to_vec(), arr(&text_rect(t)));
         }
         Content::Image(i) => {
@@ -883,6 +896,24 @@ fn params(c: &Content) -> Dict {
     d
 }
 
+fn align_code(a: Align) -> i64 {
+    match a {
+        Align::Left => 0,
+        Align::Center => 1,
+        Align::Right => 2,
+        Align::Justify => 3,
+    }
+}
+
+fn align_from(code: Option<i64>) -> Align {
+    match code {
+        Some(1) => Align::Center,
+        Some(2) => Align::Right,
+        Some(3) => Align::Justify,
+        _ => Align::Left,
+    }
+}
+
 fn parse(doc: &Document, d: &Dict) -> Option<Content> {
     let r = nums(doc, d.get(b"Rect"));
     let rect: [f64; 4] = r.try_into().ok()?;
@@ -890,20 +921,27 @@ fn parse(doc: &Document, d: &Dict) -> Option<Content> {
         b"Text" => {
             let (family, bold, italic) = Family::from_base(d.name(b"Font").unwrap_or(b"Helvetica"));
             let c = nums(doc, d.get(b"Color"));
+            let text = d.get(b"Text").and_then(|t| doc.resolve(t).as_string().map(|s| s.to_text())).unwrap_or_default();
+            let align = align_from(d.int(b"Align"));
+            // At most one entry per paragraph, whatever the file says.
+            let aligns = d
+                .get(b"Aligns")
+                .and_then(|a| {
+                    doc.resolve(a)
+                        .as_array()
+                        .map(|a| a.iter().take(crate::paragraph_align::count(&text)).map(|v| v.as_int().map(|c| align_from(Some(c)))).collect())
+                })
+                .unwrap_or_default();
             Some(Content::Text(AddedText {
                 rect,
-                text: d.get(b"Text").and_then(|t| doc.resolve(t).as_string().map(|s| s.to_text())).unwrap_or_default(),
+                text,
                 family,
                 bold,
                 italic,
                 size: d.get(b"Size").and_then(Object::as_f64).unwrap_or(12.0),
                 color: if c.len() == 3 { [c[0], c[1], c[2]] } else { [0.0; 3] },
-                align: match d.int(b"Align") {
-                    Some(1) => Align::Center,
-                    Some(2) => Align::Right,
-                    Some(3) => Align::Justify,
-                    _ => Align::Left,
-                },
+                align,
+                aligns: crate::paragraph_align::tidy(aligns, align),
             }))
         }
         b"Image" => {
diff --git a/crates/edit/src/added/arabic_tests.rs b/crates/edit/src/added/arabic_tests.rs
index d4ebb73e42..0671e3ce32 100644
--- a/crates/edit/src/added/arabic_tests.rs
+++ b/crates/edit/src/added/arabic_tests.rs
@@ -24,7 +24,7 @@ fn cluster(id: u32, advance: f64) -> ShapedCluster {
 fn line(clusters: Vec<ShapedCluster>, rtl: bool) -> LaidLine {
     let text = clusters.iter().map(|c| c.text.as_str()).collect();
     let width = clusters.iter().map(|c| c.advance).sum::<f64>() * item().size;
-    (text, rtl, vec![Piece::Shaped(clusters)], width)
+    (text, rtl, 0, vec![Piece::Shaped(clusters)], width)
 }
 
 /// A glyph outline: a box on the baseline, `advance` em wide.
@@ -147,7 +147,7 @@ fn an_item_below_the_old_limit_is_drawn_exactly_as_before() {
     let space = ShapedCluster { script: ShapedScript::Arabic, glyphs: vec![(6, [0.0, 0.0])], advance: 0.25, text: " ".into() };
     let ligature = ShapedCluster { script: ShapedScript::Arabic, glyphs: vec![(4, [0.0, 0.0]), (5, [-0.1, 0.2])], advance: 0.6, text: "لا".into() };
     let mixed: LaidLine =
-        ("Hi ب".into(), false, vec![Piece::Latin("Hi ".into()), Piece::Shaped(vec![cluster(1, 0.5), cluster(2, 0.5), space, ligature])], 4.0);
+        ("Hi ب".into(), false, 0, vec![Piece::Latin("Hi ".into()), Piece::Shaped(vec![cluster(1, 0.5), cluster(2, 0.5), space, ligature])], 4.0);
     let rtl = line(vec![cluster(2, 0.5), cluster(9, 0.75)], true);
     let laid = vec![mixed, rtl];
     let mut doc = Document::new_empty();
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 630f12550b..f367b39d85 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -1031,6 +1031,7 @@ pub use images::{ImageChange, PageImage, change_image, page_images, reading_imag
 pub mod bidi;
 pub mod indic;
 mod linebreak;
+pub mod paragraph_align;
 pub mod text;
 pub use text::{
     BlockKey, BlockStyle, LineEdit, MAX_FORM_DEPTH, MAX_FORM_VISITS, RangeStyle, ReadingBlocks, TextBlock, TextLine, TextSession, block_overlapping,
diff --git a/crates/edit/src/paragraph_align.rs b/crates/edit/src/paragraph_align.rs
new file mode 100644
index 0000000000..cf2023e615
--- /dev/null
+++ b/crates/edit/src/paragraph_align.rs
@@ -0,0 +1,135 @@
+//! Alignment paragraph by paragraph. A paragraph is the text between two hard line breaks
+//! (`\n`): a line typed with Enter in added text, or a source row of an edited paragraph. Each can
+//! have an alignment of its own; `None` (or no entry) follows the box's or paragraph's alignment.
+
+use std::ops::RangeInclusive;
+
+use crate::added::Align;
+
+/// How many paragraphs `text` has (an empty text has one).
+pub fn count(text: &str) -> usize {
+    text.bytes().filter(|b| *b == b'\n').count().saturating_add(1)
+}
+
+/// The paragraph the byte position `at` of `text` is in.
+fn paragraph_at(text: &str, at: usize) -> usize {
+    let bytes = text.as_bytes();
+    bytes.get(..at.min(bytes.len())).unwrap_or_default().iter().filter(|b| **b == b'\n').count()
+}
+
+/// The paragraphs a selection (byte range) of `text` touches. An empty selection is the caret's
+/// paragraph; a selection ending just after a line break doesn't reach the next paragraph.
+pub fn selected(text: &str, range: std::ops::Range<usize>) -> RangeInclusive<usize> {
+    let first = paragraph_at(text, range.start);
+    let last = if range.end > range.start { paragraph_at(text, range.end - 1) } else { first };
+    first..=last.max(first)
+}
+
+/// Paragraph `i`'s alignment: its own, or `base`.
+pub fn align_of(aligns: &[Option<Align>], i: usize, base: Align) -> Align {
+    aligns.get(i).copied().flatten().unwrap_or(base)
+}
+
+/// Give paragraphs `which` of a text with `count` paragraphs the alignment `align`; the others
+/// keep theirs. With a `base`, entries equal to it become `None` ([`tidy`]), so equal alignments
+/// compare equal however they were set; without one (the base is only guessed, as for an edited
+/// paragraph's own rows) every entry set stays. Trailing `None`s are dropped either way.
+pub fn set(aligns: &[Option<Align>], count: usize, which: RangeInclusive<usize>, align: Align, base: Option<Align>) -> Vec<Option<Align>> {
+    let mut out: Vec<Option<Align>> = (0..count).map(|i| aligns.get(i).copied().flatten()).collect();
+    for i in which {
+        if let Some(a) = out.get_mut(i) {
+            *a = Some(align);
+        }
+    }
+    match base {
+        Some(base) => tidy(out, base),
+        None => trimmed(out),
+    }
+}
+
+/// `aligns` without entries that only repeat `base`, and without trailing `None`s.
+pub fn tidy(mut aligns: Vec<Option<Align>>, base: Align) -> Vec<Option<Align>> {
+    for a in &mut aligns {
+        if *a == Some(base) {
+            *a = None;
+        }
+    }
+    trimmed(aligns)
+}
+
+fn trimmed(mut aligns: Vec<Option<Align>>) -> Vec<Option<Align>> {
+    while aligns.last() == Some(&None) {
+        aligns.pop();
+    }
+    aligns
+}
+
+/// Carry the alignments of `old`'s paragraphs over to `new`: the paragraphs before and after
+/// the change keep theirs, and the paragraphs the change made take the alignment of the first
+/// paragraph it changed, or for lines only inserted, of the paragraph before them (so Enter in or
+/// after a centred paragraph makes centred ones).
+pub fn remap(old: &str, new: &str, aligns: &[Option<Align>]) -> Vec<Option<Align>> {
+    if aligns.is_empty() || old == new {
+        return aligns.to_vec();
+    }
+    let (o, n): (Vec<&str>, Vec<&str>) = (old.split('\n').collect(), new.split('\n').collect());
+    let shortest = o.len().min(n.len());
+    let prefix = o.iter().zip(&n).take_while(|(a, b)| a == b).count().min(shortest);
+    let suffix = o.iter().rev().zip(n.iter().rev()).take_while(|(a, b)| a == b).count().min(shortest - prefix);
+    let at = |i: usize| aligns.get(i).copied().flatten();
+    let inserted_only = o.len() - prefix - suffix == 0;
+    let changed = if inserted_only && prefix > 0 { at(prefix - 1) } else { at(prefix) };
+    let mut out: Vec<Option<Align>> = (0..prefix).map(at).collect();
+    out.extend(std::iter::repeat_n(changed, n.len() - prefix - suffix));
+    out.extend((o.len() - suffix..o.len()).map(at));
+    trimmed(out)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use Align::*;
+
+    #[test]
+    fn a_selection_names_the_paragraphs_it_touches() {
+        let text = "One\nTwo\nThree";
+        assert_eq!(count(text), 3);
+        assert_eq!(count(""), 1);
+        assert_eq!(selected(text, 0..0), 0..=0, "the caret's paragraph");
+        assert_eq!(selected(text, 5..6), 1..=1);
+        assert_eq!(selected(text, 2..9), 0..=2);
+        assert_eq!(selected(text, 4..8), 1..=1, "a whole line with its break stays on that line");
+        assert_eq!(selected(text, 0..999), 0..=2, "past the end is clamped");
+        // Not a character boundary: still counted by bytes, never a panic.
+        assert_eq!(selected("é\nb", 1..1), 0..=0);
+    }
+
+    #[test]
+    fn setting_one_paragraph_keeps_the_others_and_tidies() {
+        let one = set(&[], 3, 1..=1, Center, Some(Left));
+        assert_eq!(one, [None, Some(Center)]);
+        assert_eq!(align_of(&one, 0, Left), Left);
+        assert_eq!(align_of(&one, 1, Left), Center);
+        assert_eq!(align_of(&one, 9, Right), Right);
+        assert_eq!(set(&one, 3, 1..=1, Left, Some(Left)), [], "back to the box's alignment is no entry at all");
+        assert_eq!(set(&one, 3, 2..=7, Right, Some(Left)), [None, Some(Center), Some(Right)], "paragraphs past the end are ignored");
+        assert_eq!(set(&[Some(Right); 9], 2, 0..=0, Center, Some(Left)), [Some(Center), Some(Right)], "entries past the text are dropped");
+        assert_eq!(set(&[], 3, 0..=0, Left, None), [Some(Left)], "without a base, an explicit entry stays");
+    }
+
+    #[test]
+    fn alignments_follow_their_paragraphs_through_an_edit() {
+        let aligns = [Some(Center), None, Some(Right)];
+        assert_eq!(remap("A\nB\nC", "A\nB\nC", &aligns), aligns);
+        // A line inserted before the last keeps the last right-aligned.
+        assert_eq!(remap("A\nB\nC", "A\nB\nnew\nC", &aligns), [Some(Center), None, None, Some(Right)]);
+        // Enter inside the centred first paragraph: both halves are centred.
+        assert_eq!(remap("Ab\nB\nC", "A\nb\nB\nC", &aligns), [Some(Center), Some(Center), None, Some(Right)]);
+        // The middle paragraph deleted.
+        assert_eq!(remap("A\nB\nC", "A\nC", &aligns), [Some(Center), Some(Right)]);
+        // Everything replaced takes the first changed paragraph's alignment.
+        assert_eq!(remap("A\nB", "x", &[None, Some(Right)]), []);
+        assert_eq!(remap("A\nA", "A", &[Some(Center), Some(Right)]), [Some(Center)]);
+        assert_eq!(remap("A", "A\nA", &[Some(Center)]), [Some(Center), Some(Center)]);
+    }
+}
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 0549906dbe..692a21c8c2 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -6638,3 +6638,74 @@ fn a_flatten_refused_on_a_later_page_changes_nothing() {
     assert!(matches!(flatten(&mut doc, &[0, 1], true, false), Err(EditError::Invalid(_))));
     assert_eq!((*doc.get(first)).clone(), before, "the first page keeps its comment and content");
 }
+
+/// One row of an edited paragraph aligned on its own (#A: highlighting a line and aligning it):
+/// the other rows stay where they were.
+#[test]
+fn one_row_of_a_paragraph_takes_its_own_alignment() {
+    let mut doc = text_page("BT /F1 10 Tf 12 TL 100 700 Td (One two three four five six seven) Tj T* (eight nine ten eleven twelve) Tj ET");
+    let block = text::text_blocks(&doc, 0).unwrap()[0].clone();
+    assert_eq!(block.editor_text, "One two three four five six seven\neight nine ten eleven twelve");
+    let style = text::BlockStyle { aligns: vec![None, Some(added::Align::Right)], ..Default::default() };
+    text::rewrite_block(&mut doc, 0, 0, Some(&block.editor_text), &style).unwrap();
+    let lines = text::text_lines(&doc, 0).unwrap();
+    let row = |t: &str| lines.iter().find(|l| l.text.starts_with(t)).unwrap().rect;
+    assert!((row("One")[0] - block.rect[0]).abs() < 0.5, "the first row stays at the left: {:?}", row("One"));
+    assert!((row("eight")[2] - block.rect[2]).abs() < 1.0, "the second row ends at the right edge: {:?} vs {}", row("eight"), block.rect[2]);
+}
+
+/// The same in a region of several styles: only the short first row is centred.
+#[test]
+fn one_row_of_a_styled_region_takes_its_own_alignment() {
+    let mut doc = mixed_region_page();
+    let block = text::text_blocks(&doc, 0).unwrap()[1].clone();
+    assert_eq!(
+        block.editor_text,
+        "About
+Plain bold text.
+Italic footer"
+    );
+    let row = |lines: &[text::TextLine], t: &str| lines.iter().find(|l| l.text.starts_with(t)).unwrap().rect;
+    let before = text::text_lines(&doc, 0).unwrap();
+    let style = text::BlockStyle { aligns: vec![Some(added::Align::Center)], ..Default::default() };
+    text::rewrite_block(&mut doc, 0, 1, Some(&block.editor_text), &style).unwrap();
+    let lines = text::text_lines(&doc, 0).unwrap();
+    assert!((row(&lines, "Italic")[0] - row(&before, "Italic")[0]).abs() < 0.5, "the last row stays put");
+    assert!((row(&lines, "Plain")[0] - row(&before, "Plain")[0]).abs() < 0.5, "the middle row stays put");
+    let about = row(&lines, "About");
+    let (mid, centre) = ((about[0] + about[2]) / 2.0, (block.rect[0] + block.rect[2]) / 2.0);
+    assert!(about[0] > row(&before, "About")[0] + 5.0 && (mid - centre).abs() < 1.5, "the first row is centred: {mid} vs {centre}");
+}
+
+/// Added text: each paragraph is laid out with its own alignment, a justified paragraph's last
+/// line isn't stretched, and the alignments survive saving and reopening.
+#[test]
+fn added_text_paragraphs_keep_their_own_alignments() {
+    let mut doc = fixture();
+    let text = AddedText {
+        rect: [72.0, 600.0, 372.0, 700.0],
+        text: "Left line\nRight line\nCentred line".into(),
+        size: 12.0,
+        aligns: vec![None, Some(Align::Right), Some(Align::Center)],
+        ..AddedText::default()
+    };
+    assert_eq!(text.paragraph_align(1), Align::Right);
+    add_content(&mut doc, 0, &Content::Text(text.clone())).unwrap();
+    let doc = reopen(&doc);
+    let Content::Text(t) = &list_added(&doc)[0].content else { panic!() };
+    assert_eq!(t.aligns, text.aligns, "saved with the item");
+    let page = streams(&doc, 0).join("\n");
+    let x_of = |s: &str| -> f64 {
+        let at = page.find(&format!("({s}) Tj")).unwrap();
+        let tm = page[..at].rfind(" Tm").unwrap();
+        let nums: Vec<f64> = page[..tm].rsplit("1 0 0 1 ").next().unwrap().split_whitespace().filter_map(|v| v.parse().ok()).collect();
+        nums[0]
+    };
+    let w = |s: &str| Family::Helvetica.width(s, 12.0, false, false);
+    assert!((x_of("Left line") - 72.0).abs() < 0.01);
+    assert!((x_of("Right line") - (372.0 - w("Right line"))).abs() < 0.01);
+    assert!((x_of("Centred line") - (72.0 + (300.0 - w("Centred line")) / 2.0)).abs() < 0.01);
+    // A paragraph's own alignment the same as the box's is no entry at all.
+    let tidy = paragraph_align::tidy(vec![Some(Align::Left), Some(Align::Right)], Align::Left);
+    assert_eq!(tidy, [None, Some(Align::Right)]);
+}
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index d003935314..3ce185a985 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -2565,10 +2565,10 @@ fn paragraph_separator(c: char) -> bool {
 
 /// Greedy word wrapping to `width` with `advance` giving a string's width. Each `\n` starts a
 /// new line. A row may also end inside a word of Chinese or Japanese text ([`crate::linebreak`]);
-/// those pieces join without a space.
-fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec<String> {
+/// those pieces join without a space. Each line comes with the `\n`-separated row it is from.
+fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec<(String, usize)> {
     let mut out = Vec::new();
-    for row in text.split('\n') {
+    for (index, row) in text.split('\n').enumerate() {
         let mut line = String::new();
         let start = out.len();
         for word in row.split(paragraph_separator).filter(|word| !word.is_empty()) {
@@ -2579,7 +2579,7 @@ fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec<String> {
                     (false, _) => format!("{line}{piece}"),
                 };
                 if !line.is_empty() && advance(&candidate) > width {
-                    out.push(std::mem::take(&mut line));
+                    out.push((std::mem::take(&mut line), index));
                     line = piece.to_string();
                 } else {
                     line = candidate;
@@ -2587,7 +2587,7 @@ fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec<String> {
             }
         }
         if !line.is_empty() || out.len() == start {
-            out.push(line);
+            out.push((line, index));
         }
     }
     out
@@ -2616,6 +2616,9 @@ pub struct BlockStyle {
     /// Fill colour (RGB 0–1).
     pub color: Option<[f64; 3]>,
     pub align: Option<crate::added::Align>,
+    /// Rows (the text's lines between `\n`s) aligned other than the paragraph, by index; `None`
+    /// and rows past the end follow `align` ([`crate::paragraph_align`]).
+    pub aligns: Vec<Option<crate::added::Align>>,
     /// Draw a line under each line of text.
     pub underline: Option<bool>,
     /// Line spacing as a multiple of the font size (1.2 is ordinary).
@@ -2926,8 +2929,10 @@ fn rewrite_block_from(
     }
     block_ops.extend(state.ops());
     block_ops.push(Op::new("Tm", tm.iter().map(|v| n(*v)).collect()));
+    // Each row's alignment: its own, or the paragraph's.
+    let align_of = |row: usize| style.aligns.get(row).copied().flatten().or(align);
     // Alignment: each line's offset from the left edge, in text space.
-    let offset = |line: &str| -> f64 {
+    let offset = |line: &str, align: Option<crate::added::Align>| -> f64 {
         let free = (width - advance(line)).max(0.0) / k;
         match align {
             Some(crate::added::Align::Center) => free / 2.0,
@@ -2943,7 +2948,6 @@ fn rewrite_block_from(
     // (ISO 32000-1 §9.3.3), so where a space is shown with another code (a composite font, a
     // generated Type 3 font, a subset without a space) the extra space follows each space as a
     // TJ adjustment instead, and code 32, which may then be a letter, gets none.
-    let justify = align == Some(crate::added::Align::Justify);
     let word_spacing_reaches_spaces = match metrics.as_ref().filter(|_| reuse) {
         Some(m) => m.encode(" ").is_some_and(|b| m.codes(&b).iter().all(|(c, len)| m.is_space(*c, *len))),
         None => type3.is_none(),
@@ -2951,12 +2955,14 @@ fn rewrite_block_from(
     let mut x = 0.0;
     let mut tw_set = 0.0;
     let mut underlines: Vec<(f64, f64, f64)> = Vec::new(); // (x0, x1, y) in text space
-    for (i, line) in wrapped.iter().enumerate() {
+    for (i, (line, row)) in wrapped.iter().enumerate() {
+        let line_align = align_of(*row);
+        let justify = line_align == Some(crate::added::Align::Justify);
         let spaces = line.matches(' ').count();
         let tw =
             if justify && i + 1 < wrapped.len() && spaces > 0 { (width - advance(line)).max(0.0) / k / o_state.scale / spaces as f64 } else { 0.0 };
         // A stretched line fills the width from the left edge.
-        let dx = if tw > 0.0 { 0.0 } else { offset(line) };
+        let dx = if tw > 0.0 { 0.0 } else { offset(line, line_align) };
         if i > 0 || dx != 0.0 {
             block_ops.push(Op::new("Td", vec![n(dx - x), n(if i > 0 { -lead } else { 0.0 })]));
         }
@@ -3349,24 +3355,28 @@ mod tests {
         assert!(!same_base_font("Arial", ""));
     }
 
+    fn rows(lines: Vec<(String, usize)>) -> Vec<String> {
+        lines.into_iter().map(|(line, _)| line).collect()
+    }
+
     #[test]
     fn paragraph_wrapping_keeps_ideographic_spaces() {
         let width = |s: &str| s.chars().count() as f64;
-        assert_eq!(wrap("A　　B C", 4.0, width), ["A　　B", "C"]);
-        assert_eq!(wrap("A\u{a0}B C", 3.0, width), ["A B", "C"]);
-        assert_eq!(wrap("A\u{2028}B C", 3.0, width), ["A B", "C"]);
-        assert_eq!(wrap(" \tA  B\r\nC ", 3.0, width), ["A B", "C"]);
+        assert_eq!(rows(wrap("A　　B C", 4.0, width)), ["A　　B", "C"]);
+        assert_eq!(rows(wrap("A\u{a0}B C", 3.0, width)), ["A B", "C"]);
+        assert_eq!(rows(wrap("A\u{2028}B C", 3.0, width)), ["A B", "C"]);
+        assert_eq!(rows(wrap(" \tA  B\r\nC ", 3.0, width)), ["A B", "C"]);
     }
 
     #[test]
     fn japanese_text_wraps_between_characters_but_not_before_closing_marks() {
         let width = |s: &str| s.chars().count() as f64;
-        assert_eq!(wrap("日本語の文章です。", 3.0, width), ["日本語", "の文章", "です。"]);
+        assert_eq!(rows(wrap("日本語の文章です。", 3.0, width)), ["日本語", "の文章", "です。"]);
         // The comma can't begin a row, so the character before it moves down with it.
-        assert_eq!(wrap("あいう、えお", 3.0, width), ["あい", "う、え", "お"]);
+        assert_eq!(rows(wrap("あいう、えお", 3.0, width)), ["あい", "う、え", "お"]);
         // Pieces of one word join without a space; separate words keep theirs.
-        assert_eq!(wrap("Edit PDFを編集", 6.0, width), ["Edit", "PDFを編集"]);
-        assert_eq!(wrap("一行目　二行目", 4.0, width), ["一行目　", "二行目"]);
+        assert_eq!(rows(wrap("Edit PDFを編集", 6.0, width)), ["Edit", "PDFを編集"]);
+        assert_eq!(rows(wrap("一行目　二行目", 4.0, width)), ["一行目　", "二行目"]);
     }
 
     #[test]
diff --git a/crates/edit/src/text_regions.rs b/crates/edit/src/text_regions.rs
index a775594944..11ae6c5a2c 100644
--- a/crates/edit/src/text_regions.rs
+++ b/crates/edit/src/text_regions.rs
@@ -728,6 +728,9 @@ pub(super) fn rewrite_styled_block(
     let mut rows: Vec<Vec<(char, usize, String)>> = Vec::new();
     // Each row's characters, as indexes into the draft's characters (`chars` holds all of them).
     let mut row_ranges = Vec::new();
+    // Each row's line in the draft (its `\n`-separated part), which [`BlockStyle::aligns`] counts.
+    let mut row_lines: Vec<usize> = Vec::new();
+    let mut draft_line = 0usize;
     let mut row_start = 0;
     let mut row = Vec::new();
     let mut row_width = 0.0;
@@ -737,6 +740,8 @@ pub(super) fn rewrite_styled_block(
         let Some(item) = chars.get(at) else { break };
         if item.0 == '\n' {
             row_ranges.push(row_start..row_start + row.len());
+            row_lines.push(draft_line);
+            draft_line = draft_line.saturating_add(1);
             rows.push(std::mem::take(&mut row));
             row_width = 0.0;
             at += 1;
@@ -760,6 +765,7 @@ pub(super) fn rewrite_styled_block(
                 row.pop();
             }
             row_ranges.push(row_start..row_start + row.len());
+            row_lines.push(draft_line);
             rows.push(std::mem::take(&mut row));
             row_width = 0.0;
             row_start = at;
@@ -770,6 +776,7 @@ pub(super) fn rewrite_styled_block(
     }
     if !row.is_empty() {
         row_ranges.push(row_start..row_start + row.len());
+        row_lines.push(draft_line);
         rows.push(row);
     }
     let streams = content_streams(doc, &p.dict)?;
@@ -869,10 +876,12 @@ pub(super) fn rewrite_styled_block(
             continue;
         }
         let w = measured.get(row_index).copied().unwrap_or(0.0);
-        let align = style.align.unwrap_or(if centered { crate::added::Align::Center } else { crate::added::Align::Left });
+        // The row's own alignment, or the paragraph's.
+        let asked = row_lines.get(row_index).and_then(|l| style.aligns.get(*l)).copied().flatten().or(style.align);
+        let align = asked.unwrap_or(if centered { crate::added::Align::Center } else { crate::added::Align::Left });
         let original_rect = block.rows.get(row_index).and_then(|row| row_rect(row, lines)).unwrap_or(block.rect);
-        let left = if style.width.is_none() && style.align.is_none() { original_rect[0] } else { block.rect[0] };
-        let available = if style.width.is_none() && style.align.is_none() { original_rect[2] - original_rect[0] } else { width };
+        let left = if style.width.is_none() && asked.is_none() { original_rect[0] } else { block.rect[0] };
+        let available = if style.width.is_none() && asked.is_none() { original_rect[2] - original_rect[0] } else { width };
         let mut x = left
             + match align {
                 crate::added::Align::Center => (available - w) / 2.0,
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 68fc076b97..caeddb02ac 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -56,6 +56,7 @@ pub use pdfcraft_organize::view::{InitialView, Layout as InitialLayout, Magnific
 pub use pdfcraft_cos::Algorithm;
 pub use pdfcraft_create::{CONVERTIBLE, CreateError, ImageResolution, SourceKind, decode_text, source_kind};
 pub use pdfcraft_edit::added::{text_rect as added_text_rect, text_width as added_text_width};
+pub use pdfcraft_edit::paragraph_align;
 pub use pdfcraft_edit::{
     Added, AddedImage, AddedText, Align as TextAlign, Background, Content as AddedContent, Family as FontFamily, HeaderFooter, MarkKind, Watermark,
 };
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index ed4e6efa1c..7e2542c5d5 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -6369,6 +6369,7 @@ fn content_edit_keeps_pages_annotations_fields_and_links() {
         size: 12.0,
         color: [0.0, 0.0, 0.0],
         align: TextAlign::Left,
+        aligns: Vec::new(),
     };
     session.apply(id, Edit::AddText { page: 1, text }).unwrap();
     let after = session.get(id).unwrap();
@@ -6408,6 +6409,7 @@ fn content_refresh_lists_match_the_storages_an_edit_touches() {
                 size: 12.0,
                 color: [0.0, 0.0, 0.0],
                 align: TextAlign::Left,
+                aligns: Vec::new(),
             },
         },
         Edit::MoveObjects { page: 0, objects: vec![target(crate::ObjectKind::Added)], offset: [1.0, 0.0] },
diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index c99c2cd787..c9d2c33aba 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -66,9 +66,12 @@ pub struct TextDraft {
     /// Display space.
     pub rect: [f64; 4],
     pub text: String,
-    /// The box's formatting; its `text` is what the page has (empty for new text).
+    /// The box's formatting; its `text` and `rect` are what the page has (empty for new text), and
+    /// its `aligns` follow `text` as it is typed.
     pub style: AddedText,
     pub focus: bool,
+    /// The selected bytes of `text` (empty: the caret), for aligning the lines it touches.
+    pub selection: Option<std::ops::Range<usize>>,
     /// The text the box's own Undo history starts from ([`crate::edit_text_ui::forget_typing_before`]).
     pub typing_from: Option<String>,
 }
@@ -404,7 +407,7 @@ pub(crate) fn page_input(
             let page_width = info.pages.get(page).map_or(f64::INFINITY, |p| p.width as f64);
             let rect = [at[0], at[1] - style.size * 1.2, (at[0] + 200.0).min(page_width), at[1]];
             style.rect = rect;
-            cv.draft = Some(TextDraft { page, index: None, rect, text: String::new(), style, focus: true, typing_from: None });
+            cv.draft = Some(TextDraft { page, index: None, rect, text: String::new(), style, focus: true, selection: None, typing_from: None });
             consumed = true;
             if typed.is_some() {
                 view.pending_edit = typed;
@@ -442,7 +445,16 @@ pub(crate) fn page_input(
         if let Some(edit) = cv.finish_draft(added) {
             view.pending_edit = Some(edit);
         }
-        cv.draft = Some(TextDraft { page, index: Some(i), rect: t.rect, text: t.text.clone(), style: t.clone(), focus: true, typing_from: None });
+        cv.draft = Some(TextDraft {
+            page,
+            index: Some(i),
+            rect: t.rect,
+            text: t.text.clone(),
+            style: t.clone(),
+            focus: true,
+            selection: None,
+            typing_from: None,
+        });
         cv.selected = Some((page, i));
         consumed = true;
         return consumed;
@@ -552,6 +564,11 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
     let (mut commit, mut cancel, mut done) = (false, false, false);
     let mut undrawable = None;
     let memo = &view.content.undrawable;
+    // Clicks outside the document (the Format text panel) keep the text open, as they keep a
+    // paragraph being edited open.
+    // Where the click that took the focus was: the pointer itself may be gone by then (a touch, a
+    // pen lifted away).
+    let outside = ctx.input(|i| i.pointer.interact_pos()).is_some_and(|p| !view.viewport_rect().contains(p));
     // Shown at once, like the paragraph editor: a fade-in shows the page's copy through it. Over
     // the page, so only where the document shows: text scrolled under the mode bar or a side
     // panel must leave them their pointer (#2755).
@@ -570,28 +587,38 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
             // The box is white in every theme, so the caret must not follow the theme (pale in dark mode) (#655).
             ui.visuals_mut().text_cursor.stroke.color = crate::edit_text_ui::caret_color_on(Color32::WHITE);
             let [cr, cg, cb] = t.style.color.map(|v| (v.clamp(0.0, 1.0) * 255.0) as u8);
-            // Laid out as the page draws it, so opening the box doesn't show it realigned.
-            // shortcut: justified text is shown left-aligned here (TextEdit can't justify), until the editor gets its own layouter.
-            let halign = match t.style.align {
-                pdfcraft_engine::TextAlign::Center => egui::Align::Center,
-                pdfcraft_engine::TextAlign::Right => egui::Align::Max,
-                pdfcraft_engine::TextAlign::Left | pdfcraft_engine::TextAlign::Justify => egui::Align::Min,
-            };
+            let color = Color32::from_rgb(cr, cg, cb);
+            // Laid out as the page draws it, each paragraph with its own alignment, so opening the
+            // box doesn't show it realigned.
+            let style = t.style.clone();
+            let line_font = font.clone();
+            let mut layouter =
+                |ui: &egui::Ui, text: &dyn egui::TextBuffer, wrap: f32| aligned_galley(ui, text.as_str(), &style, &line_font, color, wrap);
+            let before = t.text.clone();
             let input = input_id();
             crate::edit_text_ui::forget_typing_before(ui.ctx(), input, &mut t.typing_from, &t.style.text);
             ui.horizontal_top(|ui| {
                 ui.spacing_mut().item_spacing.x = 4.0;
-                let resp = ui.add(
-                    egui::TextEdit::multiline(&mut t.text)
-                        .font(font)
-                        .desired_width(r.width().max(60.0))
-                        .desired_rows(1)
-                        .horizontal_align(halign)
-                        .background_color(if background_ready { Color32::TRANSPARENT } else { Color32::WHITE })
-                        .text_color(Color32::from_rgb(cr, cg, cb))
-                        .hint_text(tl!("Type text"))
-                        .id(input),
-                );
+                let output = egui::TextEdit::multiline(&mut t.text)
+                    .font(font)
+                    .desired_width(r.width().max(60.0))
+                    .desired_rows(1)
+                    .layouter(&mut layouter)
+                    .background_color(if background_ready { Color32::TRANSPARENT } else { Color32::WHITE })
+                    .text_color(color)
+                    .hint_text(tl!("Type text"))
+                    .id(input)
+                    .show(ui);
+                let resp = output.response;
+                if let Some(cursor) = output.cursor_range {
+                    let chars = cursor.as_sorted_char_range();
+                    let byte = |index: usize| t.text.char_indices().nth(index).map_or(t.text.len(), |(at, _)| at);
+                    t.selection = Some(byte(chars.start.into())..byte(chars.end.into()));
+                }
+                // Each paragraph keeps its own alignment through the typing.
+                if t.text != before {
+                    t.style.aligns = pdfcraft_engine::paragraph_align::remap(&before, &t.text, &t.style.aligns);
+                }
                 if t.focus {
                     resp.request_focus();
                     t.focus = false;
@@ -613,7 +640,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                 // Pressing a button takes the focus from the text: that is not a click away.
                 let on_buttons = ui.input(|i| i.pointer.interact_pos()).is_some_and(|p| buttons.contains(p));
                 cancel |= ui.input(|i| i.key_pressed(egui::Key::Escape));
-                commit = done || resp.lost_focus() && !on_buttons && !view.objects.hold_editor;
+                commit = done || resp.lost_focus() && !on_buttons && !outside && !view.objects.hold_editor;
             });
             // Page text is drawn with the standard fonts; anything else would be saved as `?` (#125).
             undrawable = self::undrawable(t, memo);
@@ -637,6 +664,8 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
 /// updated, and text emptied by retyping removed. Empty new text adds nothing.
 fn finish(cv: &mut ContentView, d: TextDraft, added: &[Added]) -> Option<Edit> {
     let text = d.text.trim_end().to_string();
+    let aligns = pdfcraft_engine::paragraph_align::remap(&d.text, &text, &d.style.aligns);
+    let d = TextDraft { style: AddedText { aligns, ..d.style }, ..d };
     match d.index {
         None if text.trim().is_empty() => None,
         None => {
@@ -658,6 +687,50 @@ pub(crate) fn input_id() -> egui::Id {
     egui::Id::new("added-text-input")
 }
 
+/// `text` laid out as added text with `style` is drawn: each paragraph (line typed with Enter) wrapped
+/// to `wrap` and placed by its own alignment, a justified one with every row but its last
+/// stretched.
+fn aligned_galley(ui: &egui::Ui, text: &str, style: &AddedText, font: &egui::FontId, color: Color32, wrap: f32) -> std::sync::Arc<egui::Galley> {
+    use pdfcraft_engine::TextAlign;
+    let job = |text: &str, align: TextAlign| {
+        let mut job = egui::text::LayoutJob::simple(text.to_owned(), font.clone(), color, wrap);
+        job.justify = align == TextAlign::Justify;
+        job
+    };
+    let uniform = text.split('\n').enumerate().all(|(i, _)| style.paragraph_align(i) == style.align);
+    if uniform && style.align != TextAlign::Center && style.align != TextAlign::Right {
+        return ui.fonts_mut(|f| f.layout_job(job(text, style.align)));
+    }
+    // Each paragraph on its own (egui aligns a whole job one way), its rows moved within the
+    // box's width, then joined in order: the caret and selection see one text.
+    let mut galleys = Vec::new();
+    let mut start = 0;
+    for (i, paragraph) in text.split('\n').enumerate() {
+        let end = start + paragraph.len();
+        // The last paragraph keeps a trailing break, as egui's own split does.
+        let last = end + 1 == text.len();
+        let piece = if last { text.get(start..).unwrap_or_default() } else { paragraph };
+        let mut galley = ui.fonts_mut(|f| f.layout_job(job(piece, style.paragraph_align(i))));
+        let g = std::sync::Arc::make_mut(&mut galley);
+        for placed in &mut g.rows {
+            let free = (wrap - placed.row.size.x).max(0.0);
+            placed.pos.x = match style.paragraph_align(i) {
+                TextAlign::Center => free / 2.0,
+                TextAlign::Right => free,
+                TextAlign::Left | TextAlign::Justify => 0.0,
+            };
+        }
+        g.rect = Rect::from_min_max(Pos2::ZERO, Pos2::new(g.rect.width().max(wrap), g.rect.height()));
+        galleys.push(galley);
+        if last {
+            break;
+        }
+        start = end + 1;
+    }
+    let whole = std::sync::Arc::new(egui::text::LayoutJob::simple(text.to_owned(), font.clone(), color, wrap));
+    std::sync::Arc::new(egui::Galley::concat(whole, &galleys, ui.ctx().pixels_per_point()))
+}
+
 /// How to use the tools, under the Add content list.
 pub(crate) fn hint(ui: &mut egui::Ui, t: &Tokens) {
     ui.label(
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index f2c5c55151..f9074af30f 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -356,7 +356,12 @@ impl LineEditor {
             family: (l.family != o.family || self.family_chosen || l.bold != o.bold || l.italic != o.italic).then_some((l.family, l.bold, l.italic)),
             size: (l.size != o.size).then_some(l.size),
             color: (l.color != o.color).then_some(l.color),
-            align: (l.align != o.align).then_some(l.align),
+            // The whole paragraph's alignment when it was picked, or when the rows' own were
+            // dropped for it (the rows are where those put them, so leaving it out keeps them there).
+            align: (l.align != o.align || l.aligns.is_empty() && !o.aligns.is_empty()).then_some(l.align),
+            // Rows aligned on their own, sent with every rewrite of the paragraph while it is open:
+            // nothing in the page records them, so a rewrite without them would undo them.
+            aligns: if l.aligns != o.aligns || self.text != self.original { l.aligns.clone() } else { Vec::new() },
             underline: (self.extras.underline != self.extras0.underline).then_some(self.extras.underline),
             line_spacing: (self.extras.line_spacing != self.extras0.line_spacing && self.extras.line_spacing > 0.0)
                 .then_some(self.extras.line_spacing),
@@ -403,9 +408,17 @@ impl LineEditor {
         self.source_rect = block.rect.map(|v| v as f32);
         self.multiline = block.rows.len() > 1;
         self.source = Some((block.clone(), lines));
-        self.text = block.editor_text.clone();
+        let before = std::mem::replace(&mut self.text, block.editor_text.clone());
+        self.follow_rows(&before);
         self.original = self.text.clone();
     }
+
+    /// The text changed from `before`: rows aligned on their own keep their alignment.
+    pub(crate) fn follow_rows(&mut self, before: &str) {
+        for look in [&mut self.look, &mut self.look0] {
+            look.aligns = pdfcraft_engine::paragraph_align::remap(before, &self.text, &look.aligns);
+        }
+    }
 }
 
 /// The look shown for a paragraph: the family and weight guessed from its PDF font name.
@@ -1539,7 +1552,14 @@ fn editor_galley(ui: &egui::Ui, ed: &LineEditor, text: &str, scale: f32, width:
     let g = Arc::make_mut(&mut galley);
     let mut bounds = Rect::NOTHING;
     let mut meshes = Rect::NOTHING;
+    // Which line of the text (between `\n`s) each row is on: rows aligned on their own go where
+    // the rewrite will put them, in the paragraph's width.
+    let mut line = 0usize;
     for (index, placed) in g.rows.iter_mut().enumerate() {
+        let own = ed.look.aligns.get(line).copied().flatten();
+        if placed.ends_with_newline {
+            line = line.saturating_add(1);
+        }
         let (last_baseline, last_rect) = sources.last().copied().unwrap_or((first_baseline, first_rect));
         let (baseline, source_rect) = sources
             .get(index)
@@ -1552,7 +1572,14 @@ fn editor_galley(ui: &egui::Ui, ed: &LineEditor, text: &str, scale: f32, width:
         let base_y = (block.rect[3] - baseline) as f32 * scale;
         let row = Arc::make_mut(&mut placed.row);
         placed.pos.y = base_y - ascent;
-        placed.pos.x = if centered { (width - row.size.x) / 2.0 } else { (source_rect[0] - block.rect[0]) as f32 * scale };
+        let free = (width - row.size.x).max(0.0);
+        placed.pos.x = match own {
+            Some(pdfcraft_engine::TextAlign::Center) => free / 2.0,
+            Some(pdfcraft_engine::TextAlign::Right) => free,
+            Some(pdfcraft_engine::TextAlign::Left | pdfcraft_engine::TextAlign::Justify) => 0.0,
+            None if centered => (width - row.size.x) / 2.0,
+            None => (source_rect[0] - block.rect[0]) as f32 * scale,
+        };
         for glyph in &mut row.glyphs {
             let dy = ascent - glyph.pos.y;
             glyph.pos.y = ascent;
@@ -1578,7 +1605,9 @@ fn editor_galley(ui: &egui::Ui, ed: &LineEditor, text: &str, scale: f32, width:
 /// The inline editor; returns the edit once the text is applied.
 pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -> Option<Edit> {
     // Clicks outside the document (the Format text panel) keep the paragraph open.
-    let outside = ctx.input(|i| i.pointer.latest_pos()).is_some_and(|p| !view.viewport_rect().contains(p));
+    // Where the click that took the focus was: the pointer itself may be gone by then (a touch, a
+    // pen lifted away).
+    let outside = ctx.input(|i| i.pointer.interact_pos()).is_some_and(|p| !view.viewport_rect().contains(p));
     let page = view.line_editor.as_ref()?.page;
     let xf = view.page_xform(page)?;
     let hold = view.objects.hold_editor;
@@ -1692,6 +1721,7 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                     let galley = editor_galley(ui, &snapshot, text.as_str(), scale, wrap_width);
                     if snapshot.changes_with(text.as_str()) { galley } else { unseen(galley) }
                 };
+                let before = ed.text.clone();
                 let input = input_id();
                 forget_typing_before(ui.ctx(), input, &mut ed.typing_from, &ed.original);
                 let output = egui::TextEdit::multiline(&mut ed.text)
@@ -1719,6 +1749,7 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                 }
                 let r = output.response;
                 if r.changed() {
+                    ed.follow_rows(&before);
                     // The next pass measures the updated draft with the Apply/Save rewrite.
                     ctx.request_repaint();
                 }
diff --git a/crates/ui-egui/src/format_text_ui.rs b/crates/ui-egui/src/format_text_ui.rs
index 749f09dcc2..6071b76b67 100644
--- a/crates/ui-egui/src/format_text_ui.rs
+++ b/crates/ui-egui/src/format_text_ui.rs
@@ -39,6 +39,44 @@ pub(crate) struct Fonts<'a> {
     pub shown: String,
 }
 
+/// Text being typed in, for the alignment buttons: with some of it selected, they show and set the
+/// alignment of the paragraphs (lines between `\n`s) the selection touches; with none, the box's.
+pub(crate) struct Paragraphs<'a> {
+    pub text: &'a str,
+    /// A byte range of `text`; empty or `None` is nothing selected.
+    pub selection: Option<std::ops::Range<usize>>,
+    /// The box's own alignment is known (added text), so a paragraph set to it keeps no entry of its
+    /// own. An edited paragraph's alignment is only guessed from where its rows sit: its rows keep
+    /// every alignment set.
+    pub tidy: bool,
+}
+
+impl Paragraphs<'_> {
+    /// The paragraphs a selection touches, or `None` with nothing selected.
+    fn selected(&self) -> Option<std::ops::RangeInclusive<usize>> {
+        self.selection.clone().filter(|r| !r.is_empty()).map(|r| pdfcraft_engine::paragraph_align::selected(self.text, r))
+    }
+
+    /// The alignment the buttons show: the first selected paragraph's, or the box's.
+    fn shown(&self, look: &AddedText) -> TextAlign {
+        self.selected().map_or(look.align, |which| look.paragraph_align(*which.start()))
+    }
+
+    /// `align` picked: for the selected paragraphs, or the whole box (dropping theirs).
+    fn choose(&self, look: &mut AddedText, align: TextAlign) {
+        match self.selected() {
+            Some(which) => {
+                let count = pdfcraft_engine::paragraph_align::count(self.text);
+                look.aligns = pdfcraft_engine::paragraph_align::set(&look.aligns, count, which, align, self.tidy.then_some(look.align));
+            }
+            None => {
+                look.align = align;
+                look.aligns.clear();
+            }
+        }
+    }
+}
+
 /// What the panel changed: the style (in place) and a font picked from the list.
 #[derive(Default)]
 pub(crate) struct Outcome {
@@ -70,7 +108,14 @@ fn number(v: f64) -> String {
     s.trim_end_matches('0').trim_end_matches('.').to_string()
 }
 
-pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, look: &mut AddedText, extras: Option<&mut Extras>, fonts: Fonts) -> Outcome {
+pub(crate) fn panel(
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    look: &mut AddedText,
+    extras: Option<&mut Extras>,
+    fonts: Fonts,
+    paragraphs: Option<Paragraphs>,
+) -> Outcome {
     let before = (look.clone(), extras.as_deref().copied());
     let mut out = Outcome::default();
     widgets::section_title(ui, tl!("Format text"));
@@ -148,7 +193,8 @@ pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, look: &mut AddedText, extras:
         ui.painter().vline(sep.center().x, sep.y_range().shrink(3.0), Stroke::new(1.0, t.divider));
         planned(ui, "list", tl!("Bulleted list"));
         planned(ui, "list-ordered", tl!("Numbered list"));
-        let current = match look.align {
+        let shown = paragraphs.as_ref().map_or(look.align, |p| p.shown(look));
+        let current = match shown {
             TextAlign::Left => "align-left",
             TextAlign::Center => "align-center",
             TextAlign::Right => "align-right",
@@ -164,8 +210,14 @@ pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, look: &mut AddedText, extras:
                     (TextAlign::Right, "align-right", tl!("Align right")),
                     (TextAlign::Justify, "align-justify", tl!("Justify")),
                 ] {
-                    if icons::button(ui, icon, 30.0, look.align == a, tip).clicked() {
-                        look.align = a;
+                    if icons::button(ui, icon, 30.0, shown == a, tip).clicked() {
+                        match &paragraphs {
+                            Some(p) => p.choose(look, a),
+                            None => {
+                                look.align = a;
+                                look.aligns.clear();
+                            }
+                        }
                         ui.close();
                     }
                 }
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index 7d16bc3407..4285f1da31 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -534,7 +534,9 @@ fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
             .map(|f| (f.resource, f.face))
             .collect();
         let shown = ed.font_shown(&sources);
-        let out = crate::format_text_ui::panel(ui, t, &mut ed.look, Some(&mut ed.extras), Fonts { sources: Some(&sources), shown });
+        // A selection aligns the rows it touches; the caret alone, the whole paragraph.
+        let paragraphs = crate::format_text_ui::Paragraphs { text: &ed.text, selection: ed.selection.clone(), tidy: false };
+        let out = crate::format_text_ui::panel(ui, t, &mut ed.look, Some(&mut ed.extras), Fonts { sources: Some(&sources), shown }, Some(paragraphs));
         let mut changed = out.changed;
         match out.font {
             Some(FontChoice::KeepSource) => {
@@ -561,6 +563,21 @@ fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
         }
         return;
     }
+    // Typing added text: the box's formatting, and alignment for the lines a selection touches.
+    if let Some(i) = app.active_ids().map(|(i, _)| i)
+        && let Some(draft) = app.views[i].content.draft.clone()
+    {
+        if draft.index.is_none() && app.quick_tool == crate::QuickTool::AddText {
+            crate::content_ui::hint(ui, t);
+        }
+        let mut style = draft.style.clone();
+        let paragraphs = crate::format_text_ui::Paragraphs { text: &draft.text, selection: draft.selection.clone(), tidy: true };
+        added_text_format(ui, t, &mut style, Some(paragraphs));
+        if style != draft.style {
+            app.restyle_draft(i, style);
+        }
+        return;
+    }
     let image = app.active_ids().and_then(|(i, id)| {
         let (page, index) = app.views[i].content.selected?;
         let doc = app.session.get(id)?;
@@ -593,34 +610,65 @@ fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
     match selected {
         Some((page, index, text)) => {
             let mut style = text.clone();
-            added_text_format(ui, t, &mut style);
+            added_text_format(ui, t, &mut style, None);
             if style != text {
                 // The reusable style follows the selection only when the edit took, so a refused one adds nothing odd later.
                 if app.apply_edit(pdfcraft_engine::Edit::UpdateContent { page, index, content: pdfcraft_engine::AddedContent::Text(style.clone()) }) {
-                    app.text_style = pdfcraft_engine::AddedText { text: String::new(), rect: [0.0; 4], ..style };
+                    app.text_style = pdfcraft_engine::AddedText { text: String::new(), rect: [0.0; 4], aligns: Vec::new(), ..style };
                 }
             }
         }
         None if app.quick_tool == crate::QuickTool::AddText => {
             crate::content_ui::hint(ui, t);
             let mut style = app.text_style.clone();
-            added_text_format(ui, t, &mut style);
+            added_text_format(ui, t, &mut style, None);
             app.text_style = style;
         }
         None => {}
     }
 }
 
-/// Format text for added text: the standard families, size, colour, style and alignment.
-fn added_text_format(ui: &mut egui::Ui, t: &Tokens, style: &mut pdfcraft_engine::AddedText) {
+/// Format text for added text: the standard families, size, colour, style and alignment
+/// (of the lines `paragraphs` selects, while the text is being typed).
+fn added_text_format(ui: &mut egui::Ui, t: &Tokens, style: &mut pdfcraft_engine::AddedText, paragraphs: Option<crate::format_text_ui::Paragraphs>) {
     let shown = style.family.label().to_string();
-    let out = crate::format_text_ui::panel(ui, t, style, None, crate::format_text_ui::Fonts { sources: None, shown });
+    let out = crate::format_text_ui::panel(ui, t, style, None, crate::format_text_ui::Fonts { sources: None, shown }, paragraphs);
     if let Some(crate::format_text_ui::FontChoice::Family(family)) = out.font {
         style.family = family;
     }
 }
 
 impl PdfCraftApp {
+    /// Format text changed while added text is being typed in view `index`: the box takes the new
+    /// style at once and stays open. Text already on the page is updated with what has been typed,
+    /// as one undoable change; new text waits until it is finished. Text typed after this styling
+    /// starts from it too.
+    pub(crate) fn restyle_draft(&mut self, index: usize, style: pdfcraft_engine::AddedText) {
+        let Some(view) = self.views.get_mut(index) else { return };
+        // Text the standard fonts can't draw stays in the box, unwritten, until it is corrected (#125).
+        let blocked = view.content.blocked().is_some();
+        let Some(d) = view.content.draft.as_mut() else { return };
+        let committed = d.style.clone();
+        // `text` and `rect` stay what the page has; the rest is the new style.
+        d.style = pdfcraft_engine::AddedText { text: committed.text.clone(), rect: committed.rect, ..style };
+        d.focus = true;
+        self.text_style = pdfcraft_engine::AddedText { text: String::new(), rect: [0.0; 4], aligns: Vec::new(), ..d.style.clone() };
+        let (page, item) = (d.page, d.index);
+        let text = d.text.trim_end().to_string();
+        let Some(item) = item.filter(|_| !text.trim().is_empty() && !blocked) else { return };
+        let aligns = pdfcraft_engine::paragraph_align::remap(&d.text, &text, &d.style.aligns);
+        let updated = pdfcraft_engine::AddedText { text, rect: d.rect, aligns, ..d.style.clone() };
+        if updated == committed {
+            return;
+        }
+        if self.apply_edit(pdfcraft_engine::Edit::UpdateContent { page, index: item, content: pdfcraft_engine::AddedContent::Text(updated.clone()) })
+            && let Some(d) = self.views.get_mut(index).and_then(|v| v.content.draft.as_mut())
+        {
+            // What the page has now. The aligns stay those of the text in the box.
+            d.style = pdfcraft_engine::AddedText { aligns: std::mem::take(&mut d.style.aligns), ..updated };
+        }
+    }
+
     /// Apply the open paragraph's formatting as one change; the paragraph stays open.
     pub(crate) fn apply_line_format(&mut self, index: usize, mut ed: crate::edit_text_ui::LineEditor, ctx: Option<&egui::Context>) {
         let edit = pdfcraft_engine::Edit::EditTextBlock { page: ed.page, block: ed.block, text: ed.text.clone(), style: ed.style() };
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index de06d44b15..0476064618 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -883,3 +883,35 @@ fn a_resized_added_picture_shows_only_at_its_new_size() {
     let pixels = h.render().unwrap();
     assert!(red(&pixels, kept) > 100 && red(&pixels, gone) == 0, "the page raster has the picture at its new size");
 }
+
+/// Bug A for added text: with one line of the box selected, an alignment applies to that line
+/// only, the box stays open, and Undo puts it back and closes the box.
+#[test]
+fn aligning_a_selected_line_of_added_text_aligns_only_that_line() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 220.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Line one\nLine two".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.key_press_modifiers(egui::Modifiers::SHIFT, egui::Key::Home);
+    h.run_steps(2);
+    let button = h.get_by_label("Alignment").rect().center();
+    click(&mut h, button);
+    let item = h.get_by_label("Align right").rect().center();
+    click(&mut h, item);
+    let aligns = |h: &Harness<'static, PdfCraftApp>| match &added(h)[0].content {
+        pdfcraft_engine::AddedContent::Text(t) => (t.align, t.aligns.clone()),
+        _ => panic!(),
+    };
+    assert_eq!(aligns(&h), (pdfcraft_engine::TextAlign::Left, vec![None, Some(pdfcraft_engine::TextAlign::Right)]));
+    assert!(h.state().views[0].content.draft.is_some(), "the box stays open");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(4);
+    assert_eq!(aligns(&h), (pdfcraft_engine::TextAlign::Left, vec![]), "Undo puts it back");
+    assert!(h.state().views[0].content.draft.is_none(), "and closes the box");
+}
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 2fcf67dc42..d51f7f551f 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6074,3 +6074,56 @@ fn undo_while_typing_takes_back_the_typing_first() {
     assert_eq!(ed.text, original, "the typing is taken back");
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), None, "the document is untouched");
 }
+
+/// A paragraph of a short, a wide and a short row, opened in the paragraph editor.
+fn three_row_paragraph() -> Harness<'static, PdfCraftApp> {
+    let bytes = paragraph_drag_fixture("BT /F1 10 Tf 12 TL 60 400 Td (One two) Tj T* (three four five six seven eight) Tj T* (nine ten) Tj ET", 0, 1);
+    let mut h = paragraph_drag_harness(bytes, 0);
+    let (at, _) = paragraph_drag_points(&h, "One two three four five six seven eight nine ten", [0.0, 0.0]);
+    click_at(&mut h, at);
+    assert!(h.state().views[0].line_editor.is_some(), "the paragraph opens for typing");
+    h
+}
+
+/// Format text's alignment flyout, by pointer.
+fn align_by_pointer(h: &mut Harness<'static, PdfCraftApp>, choice: &str) {
+    let button = h.get_by_label("Alignment").rect().center();
+    click_at(h, button);
+    let item = h.get_by_label(choice).rect().center();
+    click_at(h, item);
+}
+
+fn row_rect(h: &Harness<'static, PdfCraftApp>, starts: &str) -> [f64; 4] {
+    let s = h.state();
+    s.session.get(s.views[0].id).unwrap().text_lines(0).into_iter().find(|l| l.text.starts_with(starts)).expect("the row").rect
+}
+
+/// Bug A: with one row of a paragraph selected, an alignment applies to that row only.
+/// Bug C: Undo then puts the paragraph back and closes the editor, instead of leaving it open on
+/// a text the page no longer has.
+#[test]
+fn aligning_a_selected_row_aligns_only_that_row_and_undo_puts_it_back() {
+    let mut h = three_row_paragraph();
+    let first = row_rect(&h, "One");
+    let wide = row_rect(&h, "three");
+    let last = row_rect(&h, "nine");
+    // Select the last row.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
+    h.run_steps(2);
+    align_by_pointer(&mut h, "Align right");
+    {
+        let s = h.state();
+        assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), Some("Edit text"));
+        assert!(s.views[0].line_editor.is_some(), "the paragraph stays open");
+    }
+    let moved = row_rect(&h, "nine");
+    assert!((row_rect(&h, "One")[0] - first[0]).abs() < 0.5, "the first row stays put");
+    assert!((moved[2] - wide[2]).abs() < 1.0 && moved[0] > last[0] + 20.0, "the last row is right-aligned: {moved:?}");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    let s = h.state();
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), None, "the alignment is undone");
+    assert!(s.views[0].line_editor.is_none(), "the editor closed with the step it showed");
+    assert!((row_rect(&h, "nine")[0] - last[0]).abs() < 0.5, "the last row is back");
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 4af0cd98c2..f0deaf5b16 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1962,8 +1962,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text", "edit.text"]
 tools = ["text_edit", "content_update"]
-evidence = ["crates/edit/src/tests.rs::justify_underline_and_spacing", "crates/edit/src/tests.rs::paragraphs_take_new_formatting", "crates/edit/src/tests.rs::a_one_row_title_keeps_its_centre_when_it_grows_and_when_it_wraps", "crates/ui-egui/tests/it/editing.rs::the_format_panel_restyles_the_paragraph_being_edited"]
-notes = "left, centre, right and justify (word spacing per line, last line left) for existing paragraphs and added text. A centred paragraph is found either from its ragged rows or, for a one row title, from its centre sitting on the page's own centre away from the edge the rest of the text uses, so growing or wrapping it keeps that centre (#2581)"
+evidence = ["crates/edit/src/tests.rs::justify_underline_and_spacing", "crates/edit/src/tests.rs::paragraphs_take_new_formatting", "crates/edit/src/tests.rs::a_one_row_title_keeps_its_centre_when_it_grows_and_when_it_wraps", "crates/ui-egui/tests/it/editing.rs::the_format_panel_restyles_the_paragraph_being_edited", "crates/edit/src/tests.rs::one_row_of_a_paragraph_takes_its_own_alignment", "crates/edit/src/tests.rs::one_row_of_a_styled_region_takes_its_own_alignment", "crates/edit/src/tests.rs::added_text_paragraphs_keep_their_own_alignments", "crates/ui-egui/tests/it/editing.rs::aligning_a_selected_row_aligns_only_that_row_and_undo_puts_it_back", "crates/ui-egui/tests/it/content.rs::aligning_a_selected_line_of_added_text_aligns_only_that_line", "crates/automation/tests/it/automation.rs::added_text_lines_take_their_own_alignments"]
+notes = "left, centre, right and justify (word spacing per line, last line left) for existing paragraphs and added text. A centred paragraph is found either from its ragged rows or, for a one row title, from its centre sitting on the page's own centre away from the edge the rest of the text uses, so growing or wrapping it keeps that centre (#2581). With text selected, Format text aligns only the lines (rows between line breaks) the selection touches; with only the caret, the whole paragraph or box (aligns in text_edit, page_add_text and content_update). Added text keeps each line's alignment in its /PCAdded parameters, and a justified line's last row is not stretched. Missing: an edited paragraph's per-row alignment is not recorded in the page, so after it is closed and reopened a later rewrite of it can put that row back to the paragraph's alignment (as whole-paragraph justify is lost, #2508/#2515); aligning a row can regroup the paragraph, and the editor then shows only the part it groups first; the added-text editor stretches justified lines with egui's own spacing, close to but not exactly as written"
 
 [[feature]]
 id = "edit.line-paragraph-spacing"

From 1f29575d34cda035b52997c14e31253ff8dd7f3e Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 12:42:12 +1100
Subject: [PATCH 036/270] M7: align a one-row paragraph across the column it
 sits in

Centring one highlighted line of a paragraph moves it out of the
paragraph's rows, so the next alignment of it saw a one-row paragraph
and aligned it in its own box: Left left it where it was, and since a
single row grows to the page's margin, each Centre moved it further
right. An alignment for a one-row paragraph is now laid out across the
column of text it sits in (the left edge the page's other text uses, to
the furthest right those rows reach), or its own box when no column
holds it.
---
 crates/edit/src/tests.rs        | 33 +++++++++++++++++++++++++++++++++
 crates/edit/src/text.rs         | 12 +++++++++++-
 crates/edit/src/text_regions.rs | 25 +++++++++++++++++++++++++
 3 files changed, 69 insertions(+), 1 deletion(-)

diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 692a21c8c2..ecac4c782c 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -6709,3 +6709,36 @@ fn added_text_paragraphs_keep_their_own_alignments() {
     let tidy = paragraph_align::tidy(vec![Some(Align::Left), Some(Align::Right)], Align::Left);
     assert_eq!(tidy, [None, Some(Align::Right)]);
 }
+
+/// A one-row title over a body column: an alignment picked for it is measured across the column.
+/// Left puts it on the column's left edge, and centring it again leaves it where it is, rather
+/// than aligning it in its own box (a no-op) or toward the page's margin (moving it right each
+/// time). It is aligned as the editor aligns a selected row, in whichever paragraph holds it.
+#[test]
+fn a_lone_row_aligns_across_the_column_it_sits_in() {
+    let mut doc = text_page(
+        "BT /F1 24 Tf 1 0 0 1 250 700 Tm (Title) Tj ET          BT /F1 10 Tf 12 TL 72 650 Td (The body of the page runs across the whole column here.) Tj T* (It has a second row that is a little shorter.) Tj ET",
+    );
+    let blocks = text::text_blocks(&doc, 0).unwrap();
+    assert_eq!(blocks[0].text, "Title");
+    let column = [blocks[1].rect[0], blocks[1].rect[2]];
+    let title = |doc: &Document| text::text_lines(doc, 0).unwrap().into_iter().find(|l| l.text == "Title").unwrap().rect;
+    let align = |doc: &mut Document, a: added::Align| {
+        let lines = text::text_lines(doc, 0).unwrap();
+        let line = lines.iter().position(|l| l.text == "Title").unwrap();
+        let blocks = text::text_blocks(doc, 0).unwrap();
+        let (index, block) = blocks.iter().enumerate().find(|(_, b)| b.lines.contains(&line)).unwrap();
+        // The title is the paragraph's first row.
+        let style = text::BlockStyle { aligns: vec![Some(a)], ..Default::default() };
+        text::rewrite_block(doc, 0, index, Some(&block.editor_text), &style).unwrap();
+    };
+    align(&mut doc, added::Align::Center);
+    let centred = title(&doc);
+    assert!(((centred[0] + centred[2]) / 2.0 - (column[0] + column[1]) / 2.0).abs() < 1.0, "centred in the column: {centred:?} vs {column:?}");
+    align(&mut doc, added::Align::Center);
+    assert!((title(&doc)[0] - centred[0]).abs() < 0.5, "centring again leaves it where it is: {:?} vs {centred:?}", title(&doc));
+    align(&mut doc, added::Align::Left);
+    assert!((title(&doc)[0] - column[0]).abs() < 0.5, "left: back on the column's edge, {:?} vs {column:?}", title(&doc));
+    align(&mut doc, added::Align::Right);
+    assert!((title(&doc)[2] - column[1]).abs() < 1.0, "right: on the column's right edge, {:?} vs {column:?}", title(&doc));
+}
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index 3ce185a985..e8e80d29f5 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -24,7 +24,7 @@ use crate::EditError;
 mod regions;
 #[path = "text_session.rs"]
 mod session;
-use regions::{group_blocks, is_centred, rewrite_styled_block};
+use regions::{alignment_frame, group_blocks, is_centred, rewrite_styled_block};
 pub use session::TextSession;
 
 /// One line of existing text.
@@ -2678,6 +2678,16 @@ fn rewrite_block_from(
 ) -> Result<LineEdit, EditError> {
     let blocks = group_blocks(&lines);
     let b = blocks.get(block).cloned().ok_or_else(|| EditError::Invalid(format!("page {} has no paragraph {}", page + 1, block + 1)))?;
+    // An alignment for a one-row paragraph is laid out across the column it sits in, as a
+    // paragraph of that width moved to its left edge.
+    let framed;
+    let style = match alignment_frame(&lines, &b, style) {
+        Some([left, right]) => {
+            framed = BlockStyle { width: Some(right - left), offset: Some([left - b.rect[0], 0.0]), ..style.clone() };
+            &framed
+        }
+        None => style,
+    };
     let members: Vec<&TextLine> = b.lines.iter().map(|i| &lines[*i]).collect();
     // One clipping run is enough: rewriting the paragraph would drop its mask with the rest.
     let mut dropped = coincident_ops(&lines, &members);
diff --git a/crates/edit/src/text_regions.rs b/crates/edit/src/text_regions.rs
index 11ae6c5a2c..d9465cdffd 100644
--- a/crates/edit/src/text_regions.rs
+++ b/crates/edit/src/text_regions.rs
@@ -44,6 +44,31 @@ fn neighbour_left(lines: &[TextLine], block: &TextBlock) -> Option<f64> {
     Some(best as f64 / 4.0)
 }
 
+/// Where an alignment picked for a one-row paragraph is measured, as `[left, right]`: the column of
+/// text it sits in (the left edge the rest of the page's text uses, to the furthest right those
+/// rows reach) when that column holds it, otherwise its own box. A lone row's own box is no frame
+/// to align in: left-aligning a title centred on the page left it where it was, and since a single
+/// row grows to the page's margin, centring it again moved it right each time. `None` when no
+/// alignment is asked for, or when the paragraph is several rows, turned, or given a width or a
+/// move of its own.
+pub(super) fn alignment_frame(lines: &[TextLine], block: &TextBlock, style: &BlockStyle) -> Option<[f64; 2]> {
+    let asked = style.align.is_some() || style.aligns.iter().any(Option::is_some);
+    if !asked || style.width.is_some() || style.offset.is_some() || block.rows.len() != 1 || block.rotation.abs() > 0.01 {
+        return None;
+    }
+    let own = [block.rect[0], block.rect[2]];
+    let tolerance = block.size.max(1.0) * 0.5;
+    let Some(left) = neighbour_left(lines, block) else { return Some(own) };
+    let right = lines
+        .iter()
+        .enumerate()
+        .filter(|(i, line)| !block.lines.contains(i) && (line.rect[0] - left).abs() < tolerance)
+        .map(|(_, line)| line.rect[2])
+        .fold(f64::NEG_INFINITY, f64::max);
+    let holds = right.is_finite() && right - left > own[1] - own[0] && own[0] >= left - tolerance && own[1] <= right + tolerance;
+    Some(if holds { [left, right] } else { own })
+}
+
 /// Whether a block reads as centred, and so must keep its centre when it grows or wraps.
 ///
 /// Several ragged rows whose left edges disagree while their centres agree are centred. A one row

From 5c61312d81157e9092fa8aadebf8fa7122d57713 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:05:23 +1100
Subject: [PATCH 037/270] fix(ui): Redo after Undo in a page text box puts the
 typing back

With typing undone in a paragraph or added text box, its text matches
the page again, so Undo and Redo went to the document. Redo then closed
the box and redid a document change (or nothing), instead of putting the
typing back as the box's own Redo did before. And Shift+Cmd+Z is also
Cmd+Z to the Undo shortcut, so even a Redo the box kept was taken as a
document Undo.

Redo stays with the box while its own history has typing to put back
(the test egui makes when it handles the key), and Shift+Cmd+Z is never
a document Undo.
---
 crates/ui-egui/src/commands.rs     | 10 ++++++++--
 crates/ui-egui/src/editing.rs      | 21 ++++++++++++++++++++
 crates/ui-egui/tests/it/content.rs | 30 +++++++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 31 ++++++++++++++++++++++++++++++
 4 files changed, 90 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index ee19c168eb..fb4d6f1b6f 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -727,8 +727,14 @@ impl PdfCraftApp {
                 continue;
             }
             // A box typed into on the page (a paragraph being edited, added text) keeps Undo and
-            // Redo only while it holds typing the page doesn't have; then they reach the document.
-            let page_box = matches!(spec.id, "edit.undo" | "edit.redo") && self.page_box_focused(ctx) && !self.page_typing_unapplied();
+            // Redo only while it holds typing the page doesn't have, or Redo has typing to put
+            // back; then they reach the document. ⌘⇧Z is also ⌘Z to the Undo shortcut, so a
+            // Redo the box keeps is never taken as Undo.
+            let page_box = matches!(spec.id, "edit.undo" | "edit.redo")
+                && self.page_box_focused(ctx)
+                && !self.page_typing_unapplied()
+                && !(spec.id == "edit.redo" && self.page_box_can_redo(ctx))
+                && !(spec.id == "edit.undo" && ctx.input(|i| i.modifiers.shift));
             if typing && !spec.in_text && !page_box {
                 continue;
             }
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 6f16837242..2b31091084 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -293,6 +293,27 @@ impl PdfCraftApp {
         focused == Some(crate::edit_text_ui::input_id()) || focused == Some(crate::content_ui::input_id())
     }
 
+    /// Whether the focused box on the page has typing its own Redo would put back: after Undo in
+    /// the box restores what the page has, Redo still belongs to the box, not the document. The
+    /// same test egui makes when it handles the key.
+    pub(crate) fn page_box_can_redo(&self, ctx: &egui::Context) -> bool {
+        let Some(view) = self.active.and_then(|i| self.views.get(i)) else { return false };
+        let focused = ctx.memory(|m| m.focused());
+        let (id, text) = if focused == Some(crate::edit_text_ui::input_id())
+            && let Some(ed) = &view.line_editor
+        {
+            (crate::edit_text_ui::input_id(), &ed.text)
+        } else if focused == Some(crate::content_ui::input_id())
+            && let Some(d) = &view.content.draft
+        {
+            (crate::content_ui::input_id(), &d.text)
+        } else {
+            return false;
+        };
+        egui::TextEdit::load_state(ctx, id)
+            .is_some_and(|state| state.cursor.char_range().is_some_and(|range| state.undoer().has_redo(&(range, text.clone()))))
+    }
+
     /// Typing in a box on the page (a paragraph being edited, added text) that the page doesn't
     /// have yet: Undo and Redo keys take it back in the box first.
     pub(crate) fn page_typing_unapplied(&self) -> bool {
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 0476064618..7edb13ef6a 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -915,3 +915,33 @@ fn aligning_a_selected_line_of_added_text_aligns_only_that_line() {
     assert_eq!(aligns(&h), (pdfcraft_engine::TextAlign::Left, vec![]), "Undo puts it back");
     assert!(h.state().views[0].content.draft.is_none(), "and closes the box");
 }
+
+/// The same in an added text box: Redo after Undo puts the typing back in the box, and the
+/// document's own Redo stays waiting.
+#[test]
+fn redo_after_undoing_typing_in_added_text_puts_it_back() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    let bold = pdfcraft_engine::AddedText { bold: true, ..text };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::UpdateContent { page: 0, index: 0, content: pdfcraft_engine::AddedContent::Text(bold) }));
+    assert!(h.state_mut().execute("edit.undo"));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"));
+    h.key_press_modifiers(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "Redo puts the typing back");
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!(doc.can_redo(), Some("Edit content"), "the document's Redo still waits");
+}
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index d51f7f551f..b19f69cb46 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6127,3 +6127,34 @@ fn aligning_a_selected_row_aligns_only_that_row_and_undo_puts_it_back() {
     assert!(s.views[0].line_editor.is_none(), "the editor closed with the step it showed");
     assert!((row_rect(&h, "nine")[0] - last[0]).abs() < 0.5, "the last row is back");
 }
+
+/// Redo after Undo in the box puts the typing back, in the box: it doesn't reach the document,
+/// whose own Redo (a formatting change waiting here) must stay waiting.
+#[test]
+fn redo_after_undoing_typing_puts_the_typing_back() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    // Undo the bold (closing the editor), so the document has it to redo.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), Some("Edit text"));
+    open_paragraph(&mut h);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    let typed = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_ne!(h.state().views[0].line_editor.as_ref().unwrap().text, typed, "the typing is taken back");
+    h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
+    h.run_steps(3);
+    let s = h.state();
+    let ed = s.views[0].line_editor.as_ref().expect("still typing");
+    assert_eq!(ed.text, typed, "Redo puts the typing back");
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
+}

From a44b850dac96fb4a375e9c54f693123fafed54f4 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:23:58 +1100
Subject: [PATCH 038/270] fix(ui): a narrow added-text box keeps its text at
 its own edge

The editor is at least 60 points wide on screen, so a short box can be
clicked into. With the box's alignment applied, right-aligned or centred
text in a box narrower than that was placed against the wider editor's
edge, past the box's right edge. The editor now reaches past a narrow
box away from the edge its text keeps, so the text stays where the page
draws it.
---
 crates/ui-egui/src/content_ui.rs   | 17 +++++++++++++++--
 crates/ui-egui/tests/it/content.rs | 23 +++++++++++++++++++++++
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index c9d2c33aba..58f954a895 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -559,6 +559,19 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
     }
     let r = screen_rect(&xf, info, page, draft.rect);
     let source_rect = draft.index.map(|_| screen_rect(&xf, info, page, draft.style.rect));
+    // At least 60 points wide, so a short box can still be clicked into. Where that is wider than
+    // the box, the editor reaches past it away from the edge its text keeps (the right edge for
+    // right-aligned text, both halves for centred), so the text stays where the page draws it.
+    // shortcut: lines aligned differently from each other in a box under 60 points keep the
+    // editor's left edge; anchor each line on its own if such boxes turn out to matter.
+    let width = r.width().max(60.0);
+    let uniform = (0..pdfcraft_engine::paragraph_align::count(&draft.text)).all(|i| draft.style.paragraph_align(i) == draft.style.align);
+    let anchor = match draft.style.align {
+        pdfcraft_engine::TextAlign::Center if uniform => 0.5,
+        pdfcraft_engine::TextAlign::Right if uniform => 1.0,
+        _ => 0.0,
+    };
+    let at = r.min - egui::vec2((width - r.width()) * anchor, 0.0);
     let background_ready = draft.index.is_some_and(|index| view.text_background.ready_added(page, index));
     let tokens = Tokens::get(ctx);
     let (mut commit, mut cancel, mut done) = (false, false, false);
@@ -575,7 +588,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
     egui::Area::new(egui::Id::new(("added-text", view.id.0)))
         .fade_in(false)
         .order(egui::Order::Foreground)
-        .fixed_pos(r.min)
+        .fixed_pos(at)
         .constrain_to(view.viewport_rect())
         .constrain(false)
         .show(ctx, |ui| {
@@ -601,7 +614,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                 ui.spacing_mut().item_spacing.x = 4.0;
                 let output = egui::TextEdit::multiline(&mut t.text)
                     .font(font)
-                    .desired_width(r.width().max(60.0))
+                    .desired_width(width)
                     .desired_rows(1)
                     .layouter(&mut layouter)
                     .background_color(if background_ready { Color32::TRANSPARENT } else { Color32::WHITE })
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 7edb13ef6a..a4024e513e 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -737,6 +737,29 @@ fn the_text_editor_keeps_the_boxs_alignment() {
     assert!(left == 0 && right > 20, "the text is drawn at the right ({left} dark pixels left, {right} right)");
 }
 
+/// A box narrower than the editor's least width (60 points on screen): right-aligned text stays
+/// at the box's right edge, not the wider editor's, which lies past it.
+#[test]
+fn the_text_editor_aligns_a_narrow_box_to_its_own_edge() {
+    let _gpu = gpu();
+    let mut h = harness();
+    let rect = [40.0, 195.0, 60.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Hi".into(), align: pdfcraft_engine::TextAlign::Right, ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 50.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.run_steps(3);
+    let r = item_on_screen(&h, rect);
+    assert!(r.width() < 60.0, "the box is narrower than the editor: {}", r.width());
+    let pixels = h.render().unwrap();
+    let inside = ink(&pixels, r);
+    let past = ink(&pixels, egui::Rect::from_min_max(pos2(r.right() + 2.0, r.min.y), pos2(r.right() + 40.0, r.max.y)));
+    assert!(inside > 20 && past == 0, "the text is drawn in its box ({inside} dark pixels in it, {past} past its right edge)");
+}
+
 fn mode_tab(h: &Harness<'static, PdfCraftApp>, label: &str) -> egui::Rect {
     h.get_all_by_role_and_label(egui::accesskit::Role::Button, label).map(|n| n.rect()).find(|r| r.bottom() < 120.0).expect("a mode tab")
 }

From eba7e47159621e9993dd26b983ba9c560e2464e9 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:48:26 +1100
Subject: [PATCH 039/270] M7: text_edit with aligns alone keeps the paragraph's
 rows

Without new text, text_edit rewrote a paragraph from its text joined
with spaces, so its rows were rewrapped into one and only the first
entry of `aligns`, which counts rows, had any effect. With `aligns`
given, the paragraph's own rows (its editor text) are kept, as in the
app.
---
 crates/automation/src/lib.rs             |  5 ++++-
 crates/automation/tests/it/automation.rs | 20 ++++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 8c5ae96bc3..c92ba9b8fb 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -696,7 +696,10 @@ impl Automation {
                 };
                 let index = self.paragraph_index(id, page, k, &blocks)?;
                 let block = blocks.get(index).cloned().ok_or_else(|| ToolError::InvalidArgs(format!("paragraph {k} is out of range")))?;
-                let text = a.opt_str("text")?.map(str::to_owned).unwrap_or(block.text);
+                // `aligns` counts rows, so without new text the paragraph keeps its rows (the
+                // editor text); otherwise its text joined with spaces is rewrapped.
+                let own = if a.get("aligns").is_some() { block.editor_text } else { block.text };
+                let text = a.opt_str("text")?.map(str::to_owned).unwrap_or(own);
                 let mut style = pdfcraft_engine::BlockStyle {
                     ranges: parse_style_ranges(a.get("ranges"))?,
                     resource: a.opt_str("font_resource")?.map(str::to_owned),
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 5b8931c6af..46f4bf391c 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -8447,3 +8447,23 @@ fn added_text_lines_take_their_own_alignments() {
     assert!(a.call("content_update", &json!({"doc":id,"page":1,"index":1,"aligns":["sideways"]})).is_err());
     assert!(a.call("content_update", &json!({"doc":id,"page":1,"index":1,"aligns":"right"})).is_err());
 }
+
+/// `aligns` alone on an existing paragraph aligns its rows by index, as the app does: the rows
+/// stay rows instead of being rewrapped into one, where only the first entry would count.
+#[test]
+fn text_edit_aligns_alone_aligns_the_paragraphs_rows() {
+    let dir = workdir("paragraph-row-aligns");
+    let body = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (The quick brown fox jumps over the lazy dog) Tj T* (and keeps running.) Tj ET";
+    std::fs::write(dir.join("rows.pdf"), win_ansi_paragraph_pdf(body)).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "rows.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "text_edit", json!({ "doc": doc, "page": 1, "paragraph": 1, "aligns": [null, "right"] }));
+    let lines = ok(&mut a, "text_lines", json!({ "doc": doc, "page": 1 }));
+    let rect = |t: &str| -> Vec<f64> {
+        let line = lines["lines"].as_array().unwrap().iter().find(|l| l["text"] == t).unwrap_or_else(|| panic!("{t:?} is a row: {lines}"));
+        line["rect"].as_array().unwrap().iter().map(|v| v.as_f64().unwrap()).collect()
+    };
+    let (first, second) = (rect("The quick brown fox jumps over the lazy dog"), rect("and keeps running."));
+    assert!((first[0] - 72.0).abs() < 0.5, "the first row stays at the left: {first:?}");
+    assert!((second[2] - first[2]).abs() < 1.0 && second[0] > 100.0, "the second row is right-aligned: {second:?} vs {first:?}");
+}

From 7f0b451e2b4aaeb7bb31f9ec10670ac862a9d1f5 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:48:26 +1100
Subject: [PATCH 040/270] fix(ui): a narrow added-text box keeps the edge its
 lines share

The editor of a box narrower than its 60-point minimum was anchored by
the box's own alignment. A box whose lines are all right-aligned (or
centred) on their own while the box stays Left wasn't anchored, so its
text was placed against the wider editor's edge, past the box. The
lines are now compared with each other and the editor keeps the edge
they share.
---
 crates/ui-egui/src/content_ui.rs   | 10 ++++++----
 crates/ui-egui/tests/it/content.rs | 23 +++++++++++++++++++++++
 2 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 58f954a895..5e4f2975aa 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -565,10 +565,12 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
     // shortcut: lines aligned differently from each other in a box under 60 points keep the
     // editor's left edge; anchor each line on its own if such boxes turn out to matter.
     let width = r.width().max(60.0);
-    let uniform = (0..pdfcraft_engine::paragraph_align::count(&draft.text)).all(|i| draft.style.paragraph_align(i) == draft.style.align);
-    let anchor = match draft.style.align {
-        pdfcraft_engine::TextAlign::Center if uniform => 0.5,
-        pdfcraft_engine::TextAlign::Right if uniform => 1.0,
+    // The alignment every line shares, its own or the box's.
+    let first = draft.style.paragraph_align(0);
+    let shared = (1..pdfcraft_engine::paragraph_align::count(&draft.text)).all(|i| draft.style.paragraph_align(i) == first).then_some(first);
+    let anchor = match shared {
+        Some(pdfcraft_engine::TextAlign::Center) => 0.5,
+        Some(pdfcraft_engine::TextAlign::Right) => 1.0,
         _ => 0.0,
     };
     let at = r.min - egui::vec2((width - r.width()) * anchor, 0.0);
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index a4024e513e..0798abdff5 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -760,6 +760,29 @@ fn the_text_editor_aligns_a_narrow_box_to_its_own_edge() {
     assert!(inside > 20 && past == 0, "the text is drawn in its box ({inside} dark pixels in it, {past} past its right edge)");
 }
 
+/// The same when the line is right-aligned on its own while the box keeps Left: all its lines
+/// share one alignment, so the editor keeps the box's right edge for them.
+#[test]
+fn the_text_editor_aligns_a_narrow_box_whose_lines_share_an_alignment() {
+    let _gpu = gpu();
+    let mut h = harness();
+    let rect = [40.0, 195.0, 60.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Hi".into(), aligns: vec![Some(pdfcraft_engine::TextAlign::Right)], ..Default::default() };
+    assert_eq!(text.align, pdfcraft_engine::TextAlign::Left);
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 50.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.run_steps(3);
+    let r = item_on_screen(&h, rect);
+    let pixels = h.render().unwrap();
+    let inside = ink(&pixels, r);
+    let past = ink(&pixels, egui::Rect::from_min_max(pos2(r.right() + 2.0, r.min.y), pos2(r.right() + 40.0, r.max.y)));
+    assert!(inside > 20 && past == 0, "the text is drawn in its box ({inside} dark pixels in it, {past} past its right edge)");
+}
+
 fn mode_tab(h: &Harness<'static, PdfCraftApp>, label: &str) -> egui::Rect {
     h.get_all_by_role_and_label(egui::accesskit::Role::Button, label).map(|n| n.rect()).find(|r| r.bottom() < 120.0).expect("a mode tab")
 }

From d162efacaa9722a3e214a8deeddeba00541231ac Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:57:46 +1100
Subject: [PATCH 041/270] test(ui): the Redo test checks Undo restores the
 exact paragraph text

---
 crates/ui-egui/tests/it/editing.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index b19f69cb46..2df634ef2f 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6143,13 +6143,14 @@ fn redo_after_undoing_typing_puts_the_typing_back() {
     h.run_steps(4);
     assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), Some("Edit text"));
     open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
     h.key_press_modifiers(Modifiers::COMMAND, Key::End);
     h.event(egui::Event::Text(" more".into()));
     h.run_steps(2);
     let typed = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
     h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
     h.run_steps(3);
-    assert_ne!(h.state().views[0].line_editor.as_ref().unwrap().text, typed, "the typing is taken back");
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the typing is taken back");
     h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
     h.run_steps(3);
     let s = h.state();

From 489a76acbaf41319d9fbdc09f2038a404163bdd5 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 16:14:01 +1100
Subject: [PATCH 042/270] fix(ui): an unchanged added-text box closes without
 an edit

Finishing a box trimmed its text before comparing it with the item, so
an unchanged box whose text was saved with trailing spaces finished as
an edit. Before an Undo or Redo step that edit was applied, clearing
the document's Redo. A box matching its item is now no edit.
---
 crates/ui-egui/src/content_ui.rs   |  8 ++++++++
 crates/ui-egui/tests/it/content.rs | 26 ++++++++++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 5e4f2975aa..ff987716d1 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -678,6 +678,14 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
 /// A finished draft as an edit: new text is added (and selected once it exists), retyped text
 /// updated, and text emptied by retyping removed. Empty new text adds nothing.
 fn finish(cv: &mut ContentView, d: TextDraft, added: &[Added]) -> Option<Edit> {
+    // Unchanged is no edit, even for text saved with trailing spaces the trim would drop.
+    if let Some(i) = d.index
+        && let Some((_, a)) = on_page(added, d.page).into_iter().find(|(k, _)| *k == i)
+        && let AddedContent::Text(old) = &a.content
+        && *old == (AddedText { text: d.text.clone(), rect: d.rect, ..d.style.clone() })
+    {
+        return None;
+    }
     let text = d.text.trim_end().to_string();
     let aligns = pdfcraft_engine::paragraph_align::remap(&d.text, &text, &d.style.aligns);
     let d = TextDraft { style: AddedText { aligns, ..d.style }, ..d };
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 0798abdff5..2b84582fea 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -991,3 +991,29 @@ fn redo_after_undoing_typing_in_added_text_puts_it_back() {
     let doc = s.session.get(s.views[0].id).unwrap();
     assert_eq!(doc.can_redo(), Some("Edit content"), "the document's Redo still waits");
 }
+
+/// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
+/// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
+/// that Redo first.
+#[test]
+fn redo_with_an_unchanged_box_open_redoes_the_document() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed ".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    let pdfcraft_engine::AddedContent::Text(saved) = added(&h)[0].content.clone() else { panic!() };
+    assert_eq!(saved.text, "Reviewed ", "the trailing space is kept");
+    let bold = pdfcraft_engine::AddedText { bold: true, ..saved };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::UpdateContent { page: 0, index: 0, content: pdfcraft_engine::AddedContent::Text(bold) }));
+    assert!(h.state_mut().execute("edit.undo"));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT, egui::Key::Z);
+    h.run_steps(4);
+    let pdfcraft_engine::AddedContent::Text(now) = &added(&h)[0].content else { panic!() };
+    assert!(now.bold, "the waiting Redo was redone");
+    assert!(h.state().views[0].content.draft.is_none(), "the box closed with the step");
+}

From 56b5d4f52e0748962035323ec3e51cd3a6300241 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 16:26:21 +1100
Subject: [PATCH 043/270] test(ui): the narrow-box tests check the text reaches
 the box's right edge

---
 crates/ui-egui/tests/it/content.rs | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 2b84582fea..f572d7feb2 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -756,8 +756,12 @@ fn the_text_editor_aligns_a_narrow_box_to_its_own_edge() {
     assert!(r.width() < 60.0, "the box is narrower than the editor: {}", r.width());
     let pixels = h.render().unwrap();
     let inside = ink(&pixels, r);
+    let edge = ink(&pixels, egui::Rect::from_min_max(pos2(r.right() - r.width() * 0.25, r.min.y), r.max));
     let past = ink(&pixels, egui::Rect::from_min_max(pos2(r.right() + 2.0, r.min.y), pos2(r.right() + 40.0, r.max.y)));
-    assert!(inside > 20 && past == 0, "the text is drawn in its box ({inside} dark pixels in it, {past} past its right edge)");
+    assert!(
+        inside > 20 && edge > 0 && past == 0,
+        "the text is drawn in its box, up to its right edge ({inside} dark pixels in it, {edge} in its last quarter, {past} past it)"
+    );
 }
 
 /// The same when the line is right-aligned on its own while the box keeps Left: all its lines
@@ -779,8 +783,12 @@ fn the_text_editor_aligns_a_narrow_box_whose_lines_share_an_alignment() {
     let r = item_on_screen(&h, rect);
     let pixels = h.render().unwrap();
     let inside = ink(&pixels, r);
+    let edge = ink(&pixels, egui::Rect::from_min_max(pos2(r.right() - r.width() * 0.25, r.min.y), r.max));
     let past = ink(&pixels, egui::Rect::from_min_max(pos2(r.right() + 2.0, r.min.y), pos2(r.right() + 40.0, r.max.y)));
-    assert!(inside > 20 && past == 0, "the text is drawn in its box ({inside} dark pixels in it, {past} past its right edge)");
+    assert!(
+        inside > 20 && edge > 0 && past == 0,
+        "the text is drawn in its box, up to its right edge ({inside} dark pixels in it, {edge} in its last quarter, {past} past it)"
+    );
 }
 
 fn mode_tab(h: &Harness<'static, PdfCraftApp>, label: &str) -> egui::Rect {

From 7e96230a12b8e198d4e5e84f29dbd19829dee838 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 16:26:30 +1100
Subject: [PATCH 044/270] M7: parity notes say a justified row in a mixed-style
 region isn't stretched

---
 parity/acrobat-features.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index f0deaf5b16..9eb608eedd 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1963,7 +1963,7 @@ status = "shipped"
 commands = ["edit.edit_text", "edit.text"]
 tools = ["text_edit", "content_update"]
 evidence = ["crates/edit/src/tests.rs::justify_underline_and_spacing", "crates/edit/src/tests.rs::paragraphs_take_new_formatting", "crates/edit/src/tests.rs::a_one_row_title_keeps_its_centre_when_it_grows_and_when_it_wraps", "crates/ui-egui/tests/it/editing.rs::the_format_panel_restyles_the_paragraph_being_edited", "crates/edit/src/tests.rs::one_row_of_a_paragraph_takes_its_own_alignment", "crates/edit/src/tests.rs::one_row_of_a_styled_region_takes_its_own_alignment", "crates/edit/src/tests.rs::added_text_paragraphs_keep_their_own_alignments", "crates/ui-egui/tests/it/editing.rs::aligning_a_selected_row_aligns_only_that_row_and_undo_puts_it_back", "crates/ui-egui/tests/it/content.rs::aligning_a_selected_line_of_added_text_aligns_only_that_line", "crates/automation/tests/it/automation.rs::added_text_lines_take_their_own_alignments"]
-notes = "left, centre, right and justify (word spacing per line, last line left) for existing paragraphs and added text. A centred paragraph is found either from its ragged rows or, for a one row title, from its centre sitting on the page's own centre away from the edge the rest of the text uses, so growing or wrapping it keeps that centre (#2581). With text selected, Format text aligns only the lines (rows between line breaks) the selection touches; with only the caret, the whole paragraph or box (aligns in text_edit, page_add_text and content_update). Added text keeps each line's alignment in its /PCAdded parameters, and a justified line's last row is not stretched. Missing: an edited paragraph's per-row alignment is not recorded in the page, so after it is closed and reopened a later rewrite of it can put that row back to the paragraph's alignment (as whole-paragraph justify is lost, #2508/#2515); aligning a row can regroup the paragraph, and the editor then shows only the part it groups first; the added-text editor stretches justified lines with egui's own spacing, close to but not exactly as written"
+notes = "left, centre, right and justify (word spacing per line, last line left) for existing paragraphs and added text. A centred paragraph is found either from its ragged rows or, for a one row title, from its centre sitting on the page's own centre away from the edge the rest of the text uses, so growing or wrapping it keeps that centre (#2581). With text selected, Format text aligns only the lines (rows between line breaks) the selection touches; with only the caret, the whole paragraph or box (aligns in text_edit, page_add_text and content_update). Added text keeps each line's alignment in its /PCAdded parameters, and a justified line's last row is not stretched. Missing: an edited paragraph's per-row alignment is not recorded in the page, so after it is closed and reopened a later rewrite of it can put that row back to the paragraph's alignment (as whole-paragraph justify is lost, #2508/#2515); aligning a row can regroup the paragraph, and the editor then shows only the part it groups first; a row justified on its own in a region of mixed styles is left-aligned, as the styled-region rewrite doesn't justify (a whole paragraph there isn't justified either); the added-text editor stretches justified lines with egui's own spacing, close to but not exactly as written"
 
 [[feature]]
 id = "edit.line-paragraph-spacing"

From ea6420cde51ea9429506f8ec3c7e91ec2a84283e Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sat, 24 Oct 2026 02:34:24 +1100
Subject: [PATCH 045/270] M7: a lone row aligns across the column under it, not
 the page's busiest

alignment_frame found the column by the left edge most of the page's other
rows share. On a page of two columns, a title over the column with fewer rows
took the other column's edge, failed to fit in it, and was aligned in its own
box. Only rows reaching across the title now count.

Tests: the two-column case; a two-colour title (the styled-region path) is
framed too; a justified paragraph sent with its rows split by line breaks, as
the editor sends it, still fills every row but the last.
---
 crates/edit/src/tests.rs        | 65 +++++++++++++++++++++++++++++++++
 crates/edit/src/text_regions.rs | 19 +++++-----
 2 files changed, 75 insertions(+), 9 deletions(-)

diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index ecac4c782c..a20dba68af 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -6742,3 +6742,68 @@ fn a_lone_row_aligns_across_the_column_it_sits_in() {
     align(&mut doc, added::Align::Right);
     assert!((title(&doc)[2] - column[1]).abs() < 1.0, "right: on the column's right edge, {:?} vs {column:?}", title(&doc));
 }
+
+/// An edited paragraph's text has a line break between its source rows (`editor_text`), as the
+/// paragraph editor sends it. Those are the rows of one paragraph, not paragraph ends: justified
+/// in a font of its own (the single-style rewrite), every row but the last still fills the width.
+#[test]
+fn a_justified_paragraph_from_the_editor_fills_its_rows() {
+    let mut doc =
+        text_page("BT /F1 10 Tf 12 TL 100 700 Td (One two three four five six seven) Tj T* (eight nine ten eleven twelve) Tj T* (end) Tj ET");
+    let block = text::text_blocks(&doc, 0).unwrap()[0].clone();
+    assert_eq!(block.editor_text.matches('\n').count(), 2);
+    let style = text::BlockStyle { align: Some(added::Align::Justify), family: Some((Family::Helvetica, true, false)), ..Default::default() };
+    text::rewrite_block(&mut doc, 0, 0, Some(&block.editor_text), &style).unwrap();
+    let lines = text::text_lines(&doc, 0).unwrap();
+    let row = |t: &str| lines.iter().find(|l| l.text.starts_with(t)).unwrap().rect;
+    let right = row("One")[2];
+    assert!((row("eight")[2] - right).abs() < 1.0, "the second row is stretched: {:?} vs {right}", row("eight"));
+    assert!(row("end")[2] < right - 20.0, "the last row isn't");
+}
+
+/// The same on a page of two columns, where the other column has more rows: a title over the
+/// first column is aligned across the first column, not its own box.
+#[test]
+fn a_lone_row_aligns_across_its_own_column_of_two() {
+    let mut doc = text_page(
+        "BT /F1 18 Tf 1 0 0 1 120 700 Tm (Title) Tj ET \
+         BT /F1 10 Tf 12 TL 50 660 Td (The first column runs to here.) Tj T* (A second row of it.) Tj ET \
+         BT /F1 10 Tf 12 TL 320 660 Td (The second column has more rows.) Tj T* (One.) Tj T* (Two.) Tj T* (Three.) Tj T* (Four.) Tj ET",
+    );
+    let blocks = text::text_blocks(&doc, 0).unwrap();
+    let column = blocks.iter().find(|b| b.text.starts_with("The first")).unwrap().rect;
+    let index = blocks.iter().position(|b| b.text == "Title").unwrap();
+    let style = text::BlockStyle { aligns: vec![Some(added::Align::Left)], ..Default::default() };
+    text::rewrite_block(&mut doc, 0, index, Some("Title"), &style).unwrap();
+    let title = text::text_lines(&doc, 0).unwrap().into_iter().find(|l| l.text == "Title").unwrap().rect;
+    assert!((title[0] - column[0]).abs() < 0.5, "left: on the first column's edge, {title:?} vs {column:?}");
+}
+
+/// A one-row title in two colours is rewritten by the styled-region path, which is given the
+/// same column frame: centred twice, it stays centred in the column instead of moving right.
+#[test]
+fn a_lone_row_of_two_styles_aligns_across_its_column() {
+    let mut doc = text_page(
+        "BT /F1 18 Tf 1 0 0 1 250 700 Tm (Big ) Tj 1 0 0 rg (Title) Tj ET \
+         BT 0 g /F1 10 Tf 12 TL 72 650 Td (The body of the page runs across the whole column here.) Tj T* (It has a second row that is a little shorter.) Tj ET",
+    );
+    let blocks = text::text_blocks(&doc, 0).unwrap();
+    assert_eq!(blocks[0].text, "Big Title");
+    let column = [blocks[1].rect[0], blocks[1].rect[2]];
+    let title = |doc: &Document| {
+        let lines = text::text_lines(doc, 0).unwrap();
+        let block = text::text_blocks(doc, 0).unwrap().into_iter().find(|b| b.text == "Big Title").unwrap();
+        block.lines.iter().map(|i| lines[*i].rect).reduce(|a, b| [a[0].min(b[0]), a[1].min(b[1]), a[2].max(b[2]), a[3].max(b[3])]).unwrap()
+    };
+    let centre = |doc: &mut Document| {
+        let blocks = text::text_blocks(doc, 0).unwrap();
+        let (index, block) = blocks.iter().enumerate().find(|(_, b)| b.text == "Big Title").unwrap();
+        let style = text::BlockStyle { aligns: vec![Some(added::Align::Center)], ..Default::default() };
+        text::rewrite_block(doc, 0, index, Some(&block.editor_text), &style).unwrap();
+    };
+    centre(&mut doc);
+    let centred = title(&doc);
+    assert!(((centred[0] + centred[2]) / 2.0 - (column[0] + column[1]) / 2.0).abs() < 1.0, "centred in the column: {centred:?} vs {column:?}");
+    centre(&mut doc);
+    assert!((title(&doc)[0] - centred[0]).abs() < 0.5, "centring again leaves it where it is: {:?} vs {centred:?}", title(&doc));
+}
diff --git a/crates/edit/src/text_regions.rs b/crates/edit/src/text_regions.rs
index d9465cdffd..c8758d4422 100644
--- a/crates/edit/src/text_regions.rs
+++ b/crates/edit/src/text_regions.rs
@@ -30,11 +30,12 @@ fn frame_row_rect(row: &[usize], lines: &[TextLine]) -> Option<[f64; 4]> {
 
 /// The left edge the rest of the page's text sits on, ignoring the rows of `block`. A single row
 /// that does not share it is not merely an indented or full-width left-aligned line, so its own
-/// centre is the only remaining explanation for where it sits.
-fn neighbour_left(lines: &[TextLine], block: &TextBlock) -> Option<f64> {
+/// centre is the only remaining explanation for where it sits. With `over`, only rows reaching
+/// across that span count: the edge of the column under it, however many rows another column has.
+fn neighbour_left(lines: &[TextLine], block: &TextBlock, over: Option<[f64; 2]>) -> Option<f64> {
     let mut edges: HashMap<i64, usize> = HashMap::new();
     for (i, line) in lines.iter().enumerate() {
-        if block.lines.contains(&i) {
+        if block.lines.contains(&i) || over.is_some_and(|[left, right]| line.rect[2] <= left || line.rect[0] >= right) {
             continue;
         }
         // Quarter-point buckets: equal edges found through different runs still agree.
@@ -45,8 +46,8 @@ fn neighbour_left(lines: &[TextLine], block: &TextBlock) -> Option<f64> {
 }
 
 /// Where an alignment picked for a one-row paragraph is measured, as `[left, right]`: the column of
-/// text it sits in (the left edge the rest of the page's text uses, to the furthest right those
-/// rows reach) when that column holds it, otherwise its own box. A lone row's own box is no frame
+/// text it sits in (the left edge the text under or over it uses, to the furthest right those rows
+/// reach) when that column holds it, otherwise its own box. A lone row's own box is no frame
 /// to align in: left-aligning a title centred on the page left it where it was, and since a single
 /// row grows to the page's margin, centring it again moved it right each time. `None` when no
 /// alignment is asked for, or when the paragraph is several rows, turned, or given a width or a
@@ -58,7 +59,7 @@ pub(super) fn alignment_frame(lines: &[TextLine], block: &TextBlock, style: &Blo
     }
     let own = [block.rect[0], block.rect[2]];
     let tolerance = block.size.max(1.0) * 0.5;
-    let Some(left) = neighbour_left(lines, block) else { return Some(own) };
+    let Some(left) = neighbour_left(lines, block, Some(own)) else { return Some(own) };
     let right = lines
         .iter()
         .enumerate()
@@ -85,9 +86,9 @@ pub(super) fn is_centred(block: &TextBlock, lines: &[TextLine], page_centre: f64
         return left_span > size * 0.5
             && block.rows.iter().all(|row| row_rect(row, lines).is_some_and(|r| ((r[0] + r[2]) / 2.0 - centre).abs() < size));
     }
-    lefts
-        .first()
-        .is_some_and(|left| (centre - page_centre).abs() < size && neighbour_left(lines, block).is_none_or(|edge| (*left - edge).abs() > size * 0.5))
+    lefts.first().is_some_and(|left| {
+        (centre - page_centre).abs() < size && neighbour_left(lines, block, None).is_none_or(|edge| (*left - edge).abs() > size * 0.5)
+    })
 }
 
 pub(super) fn group_blocks(lines: &[TextLine]) -> Vec<TextBlock> {

From 98a5dde39852ba9e071d9cb97ebcf13827f3896c Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sat, 24 Oct 2026 02:34:24 +1100
Subject: [PATCH 046/270] fix(ui): formatting keeps per-row alignments, the
 selection, and Redo

- A row aligned on its own lost its alignment when the paragraph was then
  given a colour, size or font: the rewrite left the rows' alignments out
  once they had been applied. They now go with every rewrite.
- egui drops a box's selection while the box is unfocused, so after one
  alignment or format a second choice went to the whole paragraph or box.
  The selection is given back when formatting returns the focus.
- Redo from the menu or toolbar applied the box's typing first, a new edit
  that dropped the document's Redo. It now redoes in the box, as the key does.
---
 crates/ui-egui/src/content_ui.rs   |  3 ++
 crates/ui-egui/src/edit_text_ui.rs | 33 +++++++++++--
 crates/ui-egui/src/editing.rs      | 36 ++++++++++++++-
 crates/ui-egui/tests/it/content.rs | 12 ++++-
 crates/ui-egui/tests/it/editing.rs | 74 ++++++++++++++++++++++++++++++
 5 files changed, 150 insertions(+), 8 deletions(-)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index ff987716d1..d30a814d43 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -636,6 +636,9 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                 }
                 if t.focus {
                     resp.request_focus();
+                    if let Some(range) = &t.selection {
+                        crate::edit_text_ui::reselect(ui.ctx(), input, &t.text, range);
+                    }
                     t.focus = false;
                 }
                 let buttons = egui::Frame::NONE
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index f9074af30f..53426d8757 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -281,6 +281,19 @@ pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, from: &mut
     *from = Some(text.to_owned());
 }
 
+/// Select `range` (bytes of `text`) in the page text box `id` again. egui keeps a box's selection
+/// only while it has the focus, so a click on Format text drops it; given back as formatting
+/// returns the focus, it stays shown, and a second choice reaches the same text.
+pub(crate) fn reselect(ctx: &egui::Context, id: egui::Id, text: &str, range: &std::ops::Range<usize>) {
+    let chars = |at: usize| text.get(..at).map(|s| s.chars().count());
+    let (Some(start), Some(end)) = (chars(range.start), chars(range.end)) else { return };
+    if start < end {
+        let mut state = egui::TextEdit::load_state(ctx, id).unwrap_or_default();
+        state.cursor.set_char_range(Some(egui::text::CCursorRange::two(egui::text::CCursor::new(start), egui::text::CCursor::new(end))));
+        egui::TextEdit::store_state(ctx, id, state);
+    }
+}
+
 #[derive(Clone, Copy, Debug, PartialEq)]
 pub struct Extras {
     pub underline: bool,
@@ -359,9 +372,6 @@ impl LineEditor {
             // The whole paragraph's alignment when it was picked, or when the rows' own were
             // dropped for it (the rows are where those put them, so leaving it out keeps them there).
             align: (l.align != o.align || l.aligns.is_empty() && !o.aligns.is_empty()).then_some(l.align),
-            // Rows aligned on their own, sent with every rewrite of the paragraph while it is open:
-            // nothing in the page records them, so a rewrite without them would undo them.
-            aligns: if l.aligns != o.aligns || self.text != self.original { l.aligns.clone() } else { Vec::new() },
             underline: (self.extras.underline != self.extras0.underline).then_some(self.extras.underline),
             line_spacing: (self.extras.line_spacing != self.extras0.line_spacing && self.extras.line_spacing > 0.0)
                 .then_some(self.extras.line_spacing),
@@ -369,6 +379,12 @@ impl LineEditor {
             scale: (self.extras.scale != self.extras0.scale).then_some(self.extras.scale),
             ..Default::default()
         };
+        // Rows aligned on their own, sent with every rewrite of the paragraph while it is open
+        // (a colour or size change too): nothing in the page records them, so a rewrite without
+        // them would undo them. Alone, they are sent only when they changed.
+        if l.aligns != o.aligns || self.text != self.original || style != pdfcraft_engine::BlockStyle::default() {
+            style.aligns = l.aligns.clone();
+        }
         if let Some(range) = &self.selection
             && (style.family.is_some()
                 || style.resource.is_some()
@@ -392,9 +408,9 @@ impl LineEditor {
         style
     }
 
-    /// After applying formatting: the paragraph now has it.
+    /// After applying formatting: the paragraph now has it. The selection stays, as the box still
+    /// shows it, so a second alignment or format picked for it applies to the same rows.
     pub fn applied(&mut self) {
-        self.selection = None;
         self.font_resource = None;
         self.family_chosen = false;
         self.look0 = self.look.clone();
@@ -409,6 +425,10 @@ impl LineEditor {
         self.multiline = block.rows.len() > 1;
         self.source = Some((block.clone(), lines));
         let before = std::mem::replace(&mut self.text, block.editor_text.clone());
+        if self.text != before {
+            // A byte range of the old text: it may name other characters, or none, in the new.
+            self.selection = None;
+        }
         self.follow_rows(&before);
         self.original = self.text.clone();
     }
@@ -1755,6 +1775,9 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                 }
                 if ed.focus {
                     r.request_focus();
+                    if let Some(range) = &ed.selection {
+                        reselect(ui.ctx(), input, &ed.text, range);
+                    }
                     ed.focus = false;
                 }
                 let esc = ui.input(|i| i.key_pressed(egui::Key::Escape));
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 2b31091084..b7109b9c50 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -222,11 +222,33 @@ impl PdfCraftApp {
     pub fn redo(&mut self) {
         if self.combine_showing() {
             self.combine_history_step(false);
-        } else {
+        } else if !self.redo_in_page_box() {
             self.history_step(false);
         }
     }
 
+    /// Redo from the menu or toolbar while a box on the page has typing of its own: the step is
+    /// the box's, as the key's is. What Undo took back in the box comes back; typing the page
+    /// doesn't have yet stays as it is, since applying it first is a new edit, which drops the
+    /// document's Redo. True when the box took the step.
+    fn redo_in_page_box(&mut self) -> bool {
+        let Some(ctx) = self.ctx.clone() else { return false };
+        let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
+        if let Some(ed) = view.line_editor.as_mut() {
+            let Some(text) = redo_typing(&ctx, crate::edit_text_ui::input_id(), &ed.text) else { return ed.has_unsaved_text() };
+            let before = std::mem::replace(&mut ed.text, text);
+            ed.follow_rows(&before);
+            return true;
+        }
+        if let Some(d) = view.content.draft.as_mut() {
+            let Some(text) = redo_typing(&ctx, crate::content_ui::input_id(), &d.text) else { return d.has_unapplied_typing() };
+            d.style.aligns = pdfcraft_engine::paragraph_align::remap(&d.text, &text, &d.style.aligns);
+            d.text = text;
+            return true;
+        }
+        false
+    }
+
     fn history_step(&mut self, undo: bool) {
         let Some((i, id)) = self.active_ids() else { return };
         if !self.close_text_editors(i, id) {
@@ -1041,6 +1063,18 @@ impl PdfCraftApp {
 
 /// The single page a content edit changes (`None` for other edits). Like comment edits,
 /// these leave every other page's bytes, geometry and text alone, so their rasters stay valid.
+/// What the page text box `id`, showing `text`, gets back from its own Redo history, if anything;
+/// its caret goes where the Redo puts it.
+fn redo_typing(ctx: &egui::Context, id: egui::Id, text: &str) -> Option<String> {
+    let mut state = egui::TextEdit::load_state(ctx, id)?;
+    let mut undoer = state.undoer();
+    let (range, redone) = undoer.redo(&(state.cursor.char_range()?, text.to_owned()))?.clone();
+    state.set_undoer(undoer);
+    state.cursor.set_char_range(Some(range));
+    egui::TextEdit::store_state(ctx, id, state);
+    Some(redone)
+}
+
 fn content_page(edit: &Edit) -> Option<usize> {
     match edit {
         Edit::MoveObjects { page, .. }
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index f572d7feb2..1fd887bf5e 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -939,7 +939,7 @@ fn a_resized_added_picture_shows_only_at_its_new_size() {
 }
 
 /// Bug A for added text: with one line of the box selected, an alignment applies to that line
-/// only, the box stays open, and Undo puts it back and closes the box.
+/// only, as does a second one, the box stays open, and Undo puts it back and closes the box.
 #[test]
 fn aligning_a_selected_line_of_added_text_aligns_only_that_line() {
     let mut h = harness();
@@ -964,10 +964,18 @@ fn aligning_a_selected_line_of_added_text_aligns_only_that_line() {
     };
     assert_eq!(aligns(&h), (pdfcraft_engine::TextAlign::Left, vec![None, Some(pdfcraft_engine::TextAlign::Right)]));
     assert!(h.state().views[0].content.draft.is_some(), "the box stays open");
+    // A second choice, the line still selected, is for that line again.
+    let button = h.get_by_label("Alignment").rect().center();
+    click(&mut h, button);
+    let item = h.get_by_label("Centre").rect().center();
+    click(&mut h, item);
+    assert_eq!(aligns(&h), (pdfcraft_engine::TextAlign::Left, vec![None, Some(pdfcraft_engine::TextAlign::Center)]));
     h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
     h.run_steps(4);
-    assert_eq!(aligns(&h), (pdfcraft_engine::TextAlign::Left, vec![]), "Undo puts it back");
+    assert_eq!(aligns(&h), (pdfcraft_engine::TextAlign::Left, vec![None, Some(pdfcraft_engine::TextAlign::Right)]), "Undo puts it back");
     assert!(h.state().views[0].content.draft.is_none(), "and closes the box");
+    assert!(h.state_mut().execute("edit.undo"));
+    assert_eq!(aligns(&h), (pdfcraft_engine::TextAlign::Left, vec![]));
 }
 
 /// The same in an added text box: Redo after Undo puts the typing back in the box, and the
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 2df634ef2f..55a77452fc 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6159,3 +6159,77 @@ fn redo_after_undoing_typing_puts_the_typing_back() {
     let doc = s.session.get(s.views[0].id).unwrap();
     assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
 }
+
+/// A row aligned on its own keeps its alignment when the whole paragraph is then made bold: the
+/// rewrite for the bold carries the rows' alignments too, as nothing in the page records them.
+#[test]
+fn a_row_aligned_on_its_own_keeps_it_through_more_formatting() {
+    let mut h = three_row_paragraph();
+    let wide = row_rect(&h, "three");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
+    h.run_steps(2);
+    align_by_pointer(&mut h, "Align right");
+    // Nothing selected: the bold is for the whole paragraph.
+    h.key_press(Key::End);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().selection, None);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().text_blocks(0)[0].base_font, "Helvetica-Bold");
+    let last = row_rect(&h, "nine");
+    assert!(
+        (last[2] - row_rect(&h, "three")[2].max(wide[2])).abs() < 1.0 && last[0] > wide[0] + 20.0,
+        "the last row is still right-aligned: {last:?}"
+    );
+}
+
+/// A second alignment picked while the same row is still selected applies to that row again, not
+/// the whole paragraph.
+#[test]
+fn a_second_alignment_for_a_selected_row_stays_on_that_row() {
+    let mut h = three_row_paragraph();
+    let first = row_rect(&h, "One");
+    let wide = row_rect(&h, "three");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
+    h.run_steps(2);
+    align_by_pointer(&mut h, "Align right");
+    align_by_pointer(&mut h, "Centre");
+    assert!((row_rect(&h, "One")[0] - first[0]).abs() < 0.5, "the first row stays put: {:?}", row_rect(&h, "One"));
+    let last = row_rect(&h, "nine");
+    let (mid, centre) = ((last[0] + last[2]) / 2.0, (wide[0] + wide[2]) / 2.0);
+    assert!((mid - centre).abs() < 1.0, "the last row is centred: {last:?} in {wide:?}");
+}
+
+/// Redo from the menu (not the key) after Undo in the box took the typing back: the typing comes
+/// back in the box, and the document's own Redo (a formatting change) still waits. The menu went
+/// to the document, which applied the box first: a new edit, which dropped that Redo.
+#[test]
+fn redo_from_the_menu_puts_the_typing_back_in_the_box() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    // Undo the bold (closing the editor), so the document has it to redo.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    let typed = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the typing is taken back");
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    let s = h.state();
+    let ed = s.views[0].line_editor.as_ref().expect("still typing");
+    assert_eq!(ed.text, typed, "Redo puts the typing back");
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
+}

From f1992f5aa1bde2ae5f9e3c7824527f626cb4e5bd Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sat, 24 Oct 2026 03:24:58 +1100
Subject: [PATCH 047/270] fix(ui): typing in one tab's text box never reaches
 another tab's

The paragraph box, and the added-text box, each keep one Undo history under
one egui id, shared by every tab. A box cleared it when it opened on new
text, but a box in another tab on the same text (two copies of a document)
kept it: typing taken back with Undo in one tab came back with Redo in the
other. The document that last used the history is now kept beside it, and
the history is cleared whenever another document's box takes it over.

Tests: the paragraph and added-text cases, each with two copies of a
document open.
---
 crates/ui-egui/src/content_ui.rs   |  3 ++-
 crates/ui-egui/src/edit_text_ui.rs | 19 +++++++++------
 crates/ui-egui/tests/it/content.rs | 37 +++++++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 38 ++++++++++++++++++++++++++++++
 4 files changed, 89 insertions(+), 8 deletions(-)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 788ba49600..66ff781bbd 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -518,6 +518,7 @@ pub(crate) fn after_refresh(view: &mut DocView, added: &[Added]) {
 /// committed (a click away, or Done), and whether Done finished adding text. Discard or Escape
 /// throws the draft away.
 pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, added: &[Added]) -> (Option<Edit>, bool) {
+    let doc_id = view.id;
     let Some(page) = view.content.draft.as_ref().map(|d| d.page) else { return (None, false) };
     let Some(xf) = view.page_xform(page) else { return (None, false) };
     let zoom = xf.rect.width() / xf.pw.max(1.0);
@@ -571,7 +572,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
             ui.visuals_mut().text_cursor.stroke.color = crate::edit_text_ui::caret_color_on(Color32::WHITE);
             let [cr, cg, cb] = t.style.color.map(|v| (v.clamp(0.0, 1.0) * 255.0) as u8);
             let input = input_id();
-            crate::edit_text_ui::forget_typing_before(ui.ctx(), input, &mut t.typing_from, &t.style.text);
+            crate::edit_text_ui::forget_typing_before(ui.ctx(), input, doc_id, &mut t.typing_from, &t.style.text);
             ui.horizontal_top(|ui| {
                 ui.spacing_mut().item_spacing.x = 4.0;
                 let resp = ui.add(
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index f2c5c55151..8e5bf8d368 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -266,18 +266,22 @@ pub(crate) fn input_id() -> egui::Id {
 }
 
 /// The page text box `id` keeps its own Undo history, across every paragraph or box it has shown
-/// (they share the id). Once the page has `text` (the box opened on it, or formatting applied it),
-/// that history is cleared: Undo in the box takes back only what was typed since, and then reaches
-/// the document. Kept, it put back text from another paragraph, or the whole paragraph as it was
-/// before a format change, into a box showing the page as it is now.
-pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, from: &mut Option<String>, text: &str) {
-    if from.as_deref() == Some(text) {
+/// in every tab (they share the id). Once the page has `text` (the box opened on it, or formatting
+/// applied it), that history is cleared: Undo in the box takes back only what was typed since, and
+/// then reaches the document. Kept, it put back text from another paragraph, or the whole paragraph
+/// as it was before a format change, into a box showing the page as it is now. `from` is the box's
+/// own record of that; which document `doc` last used the history is kept beside it, since a box
+/// in another tab on the same text would otherwise take that document's typing with its Redo.
+pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, doc: pdfcraft_engine::DocId, from: &mut Option<String>, text: &str) {
+    let owner = id.with("typing-doc");
+    if from.as_deref() == Some(text) && ctx.data(|d| d.get_temp::<pdfcraft_engine::DocId>(owner)) == Some(doc) {
         return;
     }
     if let Some(mut state) = egui::TextEdit::load_state(ctx, id) {
         state.clear_undoer();
         egui::TextEdit::store_state(ctx, id, state);
     }
+    ctx.data_mut(|d| d.insert_temp(owner, doc));
     *from = Some(text.to_owned());
 }
 
@@ -1577,6 +1581,7 @@ fn editor_galley(ui: &egui::Ui, ed: &LineEditor, text: &str, scale: f32, width:
 
 /// The inline editor; returns the edit once the text is applied.
 pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -> Option<Edit> {
+    let view_id = view.id;
     // Clicks outside the document (the Format text panel) keep the paragraph open.
     let outside = ctx.input(|i| i.pointer.latest_pos()).is_some_and(|p| !view.viewport_rect().contains(p));
     let page = view.line_editor.as_ref()?.page;
@@ -1693,7 +1698,7 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                     if snapshot.changes_with(text.as_str()) { galley } else { unseen(galley) }
                 };
                 let input = input_id();
-                forget_typing_before(ui.ctx(), input, &mut ed.typing_from, &ed.original);
+                forget_typing_before(ui.ctx(), input, view_id, &mut ed.typing_from, &ed.original);
                 let output = egui::TextEdit::multiline(&mut ed.text)
                     .id(input)
                     .font(font.clone())
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index c24501dab3..41957e6f69 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -917,3 +917,40 @@ fn redo_with_an_unchanged_box_open_redoes_the_document() {
     assert!(now.bold, "the waiting Redo was redone");
     assert!(h.state().views[0].content.draft.is_none(), "the box closed with the step");
 }
+
+/// Two copies of a document, the same added text open in each: the boxes share one Undo history,
+/// so typing taken back with Undo in one tab came back with Redo in the other.
+#[test]
+fn typing_in_one_tab_never_reaches_another_tabs_added_text() {
+    let mut h = harness();
+    h.state_mut().open_bytes("copy.pdf", None, include_bytes!("../data/form.pdf").to_vec()).unwrap();
+    h.run_steps(4);
+    let text = pdfcraft_engine::AddedText { rect: [40.0, 195.0, 240.0, 210.0], text: "Reviewed".into(), ..Default::default() };
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.text"));
+        h.run_steps(3);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        let k = r.width() / 300.0;
+        click(h, r.min + egui::vec2(45.0 * k, 195.0 * k));
+        assert_eq!(h.state().views[tab].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    };
+    for tab in [0, 1] {
+        h.state_mut().active = Some(tab);
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    }
+    open_in(&mut h, 1);
+    open_in(&mut h, 0);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" secret".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "taken back");
+    h.state_mut().active = Some(1);
+    h.run_steps(3);
+    h.key_press_modifiers(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[1].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "the other tab's typing stays out");
+}
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 4bb74f82cd..e87697403f 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6067,3 +6067,41 @@ fn redo_after_undoing_typing_puts_the_typing_back() {
     let doc = s.session.get(s.views[0].id).unwrap();
     assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
 }
+
+/// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
+/// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
+/// Typing in one tab, taken back with Undo, then came back with Redo in the other tab.
+#[test]
+fn typing_in_one_tab_never_reaches_another_tabs_paragraph() {
+    let mut h = harness(1, |app| {
+        app.open_bytes("copy.pdf", None, fixture(1)).expect("the copy opens");
+    });
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.edit_text"));
+        h.run_steps(2);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        click_at(h, egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height()));
+        assert!(h.state().views[tab].line_editor.is_some(), "the paragraph opens for typing");
+    };
+    open_in(&mut h, 1);
+    let original = h.state().views[1].line_editor.as_ref().unwrap().text.clone();
+    open_in(&mut h, 0);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the same paragraph");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" secret".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "taken back");
+    // The copy, its paragraph still open: Redo there has nothing of its own to put back.
+    h.state_mut().active = Some(1);
+    h.run_steps(3);
+    h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
+    h.run_steps(3);
+    let s = h.state();
+    let text = s.views[1].line_editor.as_ref().map(|ed| ed.text.clone());
+    assert!(!text.as_deref().unwrap_or_default().contains("secret"), "the other tab's typing came in: {text:?}");
+    assert_eq!(s.session.get(s.views[1].id).unwrap().text_blocks(0)[0].text, s.session.get(s.views[0].id).unwrap().text_blocks(0)[0].text);
+}

From caf7bdd8e1b251b87bb0cd9d6e8f536ff6b28a8d Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sat, 24 Oct 2026 03:24:58 +1100
Subject: [PATCH 048/270] fix(ui): typing in one tab's text box never reaches
 another tab's

The paragraph box, and the added-text box, each keep one Undo history under
one egui id, shared by every tab. A box cleared it when it opened on new
text, but a box in another tab on the same text (two copies of a document)
kept it: typing taken back with Undo in one tab came back with Redo in the
other, from the key or from the menu. The document that last used the
history is now kept beside it, and the history is cleared whenever another
document's box takes it over.

Tests: the paragraph and added-text cases, each with two copies of a
document open; the paragraph case tries the menu's Redo too.
---
 crates/ui-egui/src/content_ui.rs   |  3 +-
 crates/ui-egui/src/edit_text_ui.rs | 19 ++++++++-----
 crates/ui-egui/tests/it/content.rs | 37 ++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 45 ++++++++++++++++++++++++++++++
 4 files changed, 96 insertions(+), 8 deletions(-)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index d30a814d43..4578d0d9d8 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -530,6 +530,7 @@ pub(crate) fn after_refresh(view: &mut DocView, added: &[Added]) {
 /// committed (a click away, or Done), and whether Done finished adding text. Discard or Escape
 /// throws the draft away.
 pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, added: &[Added]) -> (Option<Edit>, bool) {
+    let doc_id = view.id;
     let Some(page) = view.content.draft.as_ref().map(|d| d.page) else { return (None, false) };
     let Some(xf) = view.page_xform(page) else { return (None, false) };
     let zoom = xf.rect.width() / xf.pw.max(1.0);
@@ -611,7 +612,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                 |ui: &egui::Ui, text: &dyn egui::TextBuffer, wrap: f32| aligned_galley(ui, text.as_str(), &style, &line_font, color, wrap);
             let before = t.text.clone();
             let input = input_id();
-            crate::edit_text_ui::forget_typing_before(ui.ctx(), input, &mut t.typing_from, &t.style.text);
+            crate::edit_text_ui::forget_typing_before(ui.ctx(), input, doc_id, &mut t.typing_from, &t.style.text);
             ui.horizontal_top(|ui| {
                 ui.spacing_mut().item_spacing.x = 4.0;
                 let output = egui::TextEdit::multiline(&mut t.text)
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index 53426d8757..12adb622fb 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -266,18 +266,22 @@ pub(crate) fn input_id() -> egui::Id {
 }
 
 /// The page text box `id` keeps its own Undo history, across every paragraph or box it has shown
-/// (they share the id). Once the page has `text` (the box opened on it, or formatting applied it),
-/// that history is cleared: Undo in the box takes back only what was typed since, and then reaches
-/// the document. Kept, it put back text from another paragraph, or the whole paragraph as it was
-/// before a format change, into a box showing the page as it is now.
-pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, from: &mut Option<String>, text: &str) {
-    if from.as_deref() == Some(text) {
+/// in every tab (they share the id). Once the page has `text` (the box opened on it, or formatting
+/// applied it), that history is cleared: Undo in the box takes back only what was typed since, and
+/// then reaches the document. Kept, it put back text from another paragraph, or the whole paragraph
+/// as it was before a format change, into a box showing the page as it is now. `from` is the box's
+/// own record of that; which document `doc` last used the history is kept beside it, since a box
+/// in another tab on the same text would otherwise take that document's typing with its Redo.
+pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, doc: pdfcraft_engine::DocId, from: &mut Option<String>, text: &str) {
+    let owner = id.with("typing-doc");
+    if from.as_deref() == Some(text) && ctx.data(|d| d.get_temp::<pdfcraft_engine::DocId>(owner)) == Some(doc) {
         return;
     }
     if let Some(mut state) = egui::TextEdit::load_state(ctx, id) {
         state.clear_undoer();
         egui::TextEdit::store_state(ctx, id, state);
     }
+    ctx.data_mut(|d| d.insert_temp(owner, doc));
     *from = Some(text.to_owned());
 }
 
@@ -1624,6 +1628,7 @@ fn editor_galley(ui: &egui::Ui, ed: &LineEditor, text: &str, scale: f32, width:
 
 /// The inline editor; returns the edit once the text is applied.
 pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -> Option<Edit> {
+    let view_id = view.id;
     // Clicks outside the document (the Format text panel) keep the paragraph open.
     // Where the click that took the focus was: the pointer itself may be gone by then (a touch, a
     // pen lifted away).
@@ -1743,7 +1748,7 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                 };
                 let before = ed.text.clone();
                 let input = input_id();
-                forget_typing_before(ui.ctx(), input, &mut ed.typing_from, &ed.original);
+                forget_typing_before(ui.ctx(), input, view_id, &mut ed.typing_from, &ed.original);
                 let output = egui::TextEdit::multiline(&mut ed.text)
                     .id(input)
                     .font(font.clone())
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 1fd887bf5e..18e3144f83 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1033,3 +1033,40 @@ fn redo_with_an_unchanged_box_open_redoes_the_document() {
     assert!(now.bold, "the waiting Redo was redone");
     assert!(h.state().views[0].content.draft.is_none(), "the box closed with the step");
 }
+
+/// Two copies of a document, the same added text open in each: the boxes share one Undo history,
+/// so typing taken back with Undo in one tab came back with Redo in the other.
+#[test]
+fn typing_in_one_tab_never_reaches_another_tabs_added_text() {
+    let mut h = harness();
+    h.state_mut().open_bytes("copy.pdf", None, include_bytes!("../data/form.pdf").to_vec()).unwrap();
+    h.run_steps(4);
+    let text = pdfcraft_engine::AddedText { rect: [40.0, 195.0, 240.0, 210.0], text: "Reviewed".into(), ..Default::default() };
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.text"));
+        h.run_steps(3);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        let k = r.width() / 300.0;
+        click(h, r.min + egui::vec2(45.0 * k, 195.0 * k));
+        assert_eq!(h.state().views[tab].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    };
+    for tab in [0, 1] {
+        h.state_mut().active = Some(tab);
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    }
+    open_in(&mut h, 1);
+    open_in(&mut h, 0);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" secret".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "taken back");
+    h.state_mut().active = Some(1);
+    h.run_steps(3);
+    h.key_press_modifiers(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[1].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "the other tab's typing stays out");
+}
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 55a77452fc..f68f997a16 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6233,3 +6233,48 @@ fn redo_from_the_menu_puts_the_typing_back_in_the_box() {
     let doc = s.session.get(s.views[0].id).unwrap();
     assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
 }
+
+/// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
+/// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
+/// Typing in one tab, taken back with Undo, then came back with Redo (the key or the menu) in the
+/// other tab.
+#[test]
+fn typing_in_one_tab_never_reaches_another_tabs_paragraph() {
+    let mut h = harness(1, |app| {
+        app.open_bytes("copy.pdf", None, fixture(1)).expect("the copy opens");
+    });
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.edit_text"));
+        h.run_steps(2);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        click_at(h, egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height()));
+        assert!(h.state().views[tab].line_editor.is_some(), "the paragraph opens for typing");
+    };
+    open_in(&mut h, 1);
+    let original = h.state().views[1].line_editor.as_ref().unwrap().text.clone();
+    open_in(&mut h, 0);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the same paragraph");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" secret".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "taken back");
+    // The copy, its paragraph still open: Redo there has nothing of its own to put back.
+    h.state_mut().active = Some(1);
+    h.run_steps(3);
+    h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
+    h.run_steps(3);
+    let text = h.state().views[1].line_editor.as_ref().map(|ed| ed.text.clone());
+    assert!(!text.as_deref().unwrap_or_default().contains("secret"), "the other tab's typing came in: {text:?}");
+    // Nor through what the menu's Redo runs, which reads the box's history itself (the menu item
+    // is off here, as the copy's document has nothing to redo).
+    h.state_mut().redo();
+    h.run_steps(3);
+    let s = h.state();
+    let text = s.views[1].line_editor.as_ref().map(|ed| ed.text.clone());
+    assert!(!text.as_deref().unwrap_or_default().contains("secret"), "the other tab's typing came in from the menu: {text:?}");
+    assert_eq!(s.session.get(s.views[1].id).unwrap().text_blocks(0)[0].text, s.session.get(s.views[0].id).unwrap().text_blocks(0)[0].text);
+}

From d149d23320797f6b2a5eefff663a4ccf8995c5bd Mon Sep 17 00:00:00 2001
From: srt8hellcat2-ui <srt8hellcat2@gmail.com>
Date: Fri, 23 Oct 2026 13:10:19 -0400
Subject: [PATCH 049/270] Rewrite an unsigned file in full when saving after
 deleting pages (#3407)

---
 crates/engine/src/lib.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 68fc076b97..fefa778afa 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -3945,6 +3945,11 @@ impl Session {
         // Signed documents are only ever saved incrementally: an edit that needs a full rewrite
         // (applying redactions, changing security, sanitizing) would invalidate the signatures.
         // So does any edit to a file rebuilt from object headers: it has no chain to append to.
+        // Deleted pages are freed, but an incremental save keeps them (and their text) in the
+        // earlier revision and the file does not shrink (#3407): rewrite an unsigned file in full.
+        if !signed && matches!(edit, Edit::DeletePages { .. }) {
+            next.require_full_save();
+        }
         let rewrites = |c: &pdfcraft_cos::Document| c.full_save_required() || c.encryption_changed();
         if signed && ((rewrites(&next) && !rewrites(&editor.cos)) || (next.is_modified() && next.revisions().is_empty())) {
             return Err(EditError::SignedRewrite(edit.label().to_string()));

From 143dc669f1605af02e17dbfbea01f627ebb71d6c Mon Sep 17 00:00:00 2001
From: srt8hellcat2-ui <srt8hellcat2@gmail.com>
Date: Fri, 23 Oct 2026 13:11:56 -0400
Subject: [PATCH 050/270] Test saving after deleting pages (#3407)

---
 crates/engine/src/tests.rs | 44 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 43 insertions(+), 1 deletion(-)

diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index ed4e6efa1c..0338909317 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -505,6 +505,47 @@ fn edits_update_view_data_and_mark_dirty() {
     assert_eq!(page_texts(&s, id), ["Page 1", "Page 3"], "renderer refreshed");
 }
 
+fn contains(haystack: &[u8], needle: &[u8]) -> bool {
+    haystack.windows(needle.len()).any(|w| w == needle)
+}
+
+#[test]
+fn saving_after_deleting_pages_rewrites_the_file_without_them() {
+    let (mut s, id) = session_with(6);
+    let original = s.save_bytes(id).unwrap();
+    s.apply(id, Edit::DeletePages { pages: vec![1, 2, 3, 4] }).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    assert!(saved.len() < original.len(), "the file shrank: {} -> {}", original.len(), saved.len());
+    assert!(!saved.starts_with(original.as_slice()), "a full rewrite, not an update appended to the old file");
+    assert!(!contains(&saved, b"Page 3"), "a deleted page's text is not left in an earlier revision");
+    let mut again = Session::new();
+    let id2 = again.open("saved.pdf", None, saved, None).unwrap();
+    assert_eq!(page_texts(&again, id2), ["Page 1", "Page 6"]);
+}
+
+#[test]
+fn saving_after_deleting_pages_from_a_signed_file_stays_incremental() {
+    let p12 = std::fs::read(concat!(env!("CARGO_MANIFEST_DIR"), "/../sign/tests/data/ec-p256.p12")).unwrap();
+    let digital_id = sign::pkcs12::open(&p12, "test").unwrap();
+    let mut s = Session::new().with_clock(|| 1_800_000_000);
+    let id = s.open("fixture.pdf", None, Arc::new(fixture(3)), None).unwrap();
+    let opts = SignOptions { page: 0, rect: Some([20.0, 20.0, 160.0, 50.0]), ..SignOptions::default() };
+    let signed = s.sign(id, &digital_id, opts).unwrap();
+    s.mark_signed(id, signed.clone(), None).unwrap();
+    s.apply(id, Edit::DeletePages { pages: vec![2] }).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    assert!(saved.starts_with(signed.as_ref()), "the signed bytes stay an incremental update");
+    assert!(s.get(id).unwrap().is_signed());
+}
+
+#[test]
+fn saving_without_deleting_pages_stays_incremental() {
+    let (mut s, id) = session_with(3);
+    let original = s.save_bytes(id).unwrap();
+    s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    assert!(saved.starts_with(original.as_slice()), "an edit that deletes nothing is still appended");
+}
 #[test]
 fn metadata_edit_keeps_the_renderer_without_changing_page_content() {
     let (mut s, id) = session_with(1);
@@ -784,9 +825,10 @@ fn revert_preserves_the_saved_pages_after_undo() {
 #[test]
 fn full_save_is_readable_and_smaller_after_deletes() {
     let (mut s, id) = session_with(5);
+    let original = s.save_bytes(id).unwrap();
     s.apply(id, Edit::DeletePages { pages: vec![0, 1, 2] }).unwrap();
     let full = s.save_full_bytes(id).unwrap();
-    assert!(full.len() < s.save_bytes(id).unwrap().len());
+    assert!(full.len() < original.len());
     let mut s2 = Session::new();
     let id2 = s2.open("full.pdf", None, full, None).unwrap();
     assert_eq!(page_texts(&s2, id2), ["Page 4", "Page 5"]);

From 29d12c39e96105380f3234789c85b3e12b5c3f20 Mon Sep 17 00:00:00 2001
From: srt8hellcat2-ui <srt8hellcat2@gmail.com>
Date: Fri, 23 Oct 2026 13:12:53 -0400
Subject: [PATCH 051/270] Add blank line between tests

---
 crates/engine/src/tests.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 0338909317..e94cdc1da9 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -546,6 +546,7 @@ fn saving_without_deleting_pages_stays_incremental() {
     let saved = s.save_bytes(id).unwrap();
     assert!(saved.starts_with(original.as_slice()), "an edit that deletes nothing is still appended");
 }
+
 #[test]
 fn metadata_edit_keeps_the_renderer_without_changing_page_content() {
     let (mut s, id) = session_with(1);

From 17e2c35fdcb7d372a90c5a340c3414b32a6e8f24 Mon Sep 17 00:00:00 2001
From: srt8hellcat2-ui <srt8hellcat2@gmail.com>
Date: Fri, 23 Oct 2026 13:14:11 -0400
Subject: [PATCH 052/270] Note the full-rewrite save on the Pages panel entry
 (#3407)

---
 parity/acrobat-features.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 6d950a71ca..01b694c97d 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1275,7 +1275,7 @@ status = "shipped"
 commands = []
 tools = []
 evidence = ["crates/ui-egui/tests/it/editing.rs::dragging_pages_panel_thumbnails_reorders_pages", "crates/ui-egui/tests/it/viewer.rs::pages_panel_thumbnails_have_a_context_menu", "crates/ui-egui/tests/it/editing.rs::deleting_pages_from_the_pages_panel_menu", "crates/ui-egui/tests/it/editing.rs::the_delete_key_deletes_pages_picked_in_the_pages_panel_but_never_every_page"]
-notes = "Drag the selection (or the page grabbed) to reorder, with a drop bar and edge scrolling; right-click offers Extract pages, Cut, Copy, Paste after and Delete pages (also the Delete key over the panel). Not yet: Rotate, Insert and Page labels in the menu, dragging pages between documents, or dropping files onto the panel."
+notes = "Drag the selection (or the page grabbed) to reorder, with a drop bar and edge scrolling; right-click offers Extract pages, Cut, Copy, Paste after and Delete pages (also the Delete key over the panel). Deleting pages makes the next Save a full rewrite (unsigned files), so the deleted pages leave the file; signed files stay incremental. Not yet: Rotate, Insert and Page labels in the menu, dragging pages between documents, or dropping files onto the panel."
 
 [[feature]]
 id = "view.bookmarks-panel"

From cb17f8490dfa9b40c6040b1d9852167065f7895e Mon Sep 17 00:00:00 2001
From: srt8hellcat2-ui <srt8hellcat2@gmail.com>
Date: Fri, 23 Oct 2026 13:30:10 -0400
Subject: [PATCH 053/270] Also rewrite in full when a batch edit deletes pages

---
 crates/engine/src/lib.rs | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index fefa778afa..55696608d8 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -2888,6 +2888,15 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
     Ok(())
 }
 
+/// Whether the edit, or any edit inside a batch, deletes pages.
+fn deletes_pages(edit: &Edit) -> bool {
+    match edit {
+        Edit::DeletePages { .. } => true,
+        Edit::Batch { edits, .. } => edits.iter().any(deletes_pages),
+        _ => false,
+    }
+}
+
 /// The comment list, read from the object graph (as `inspect` lists comments).
 fn comment_list(doc: &pdfcraft_cos::Document) -> Vec<pdfcraft_render::Annotation> {
     pdfcraft_annot::summaries(doc)
@@ -3947,7 +3956,7 @@ impl Session {
         // So does any edit to a file rebuilt from object headers: it has no chain to append to.
         // Deleted pages are freed, but an incremental save keeps them (and their text) in the
         // earlier revision and the file does not shrink (#3407): rewrite an unsigned file in full.
-        if !signed && matches!(edit, Edit::DeletePages { .. }) {
+        if !signed && deletes_pages(&edit) {
             next.require_full_save();
         }
         let rewrites = |c: &pdfcraft_cos::Document| c.full_save_required() || c.encryption_changed();

From 12d89c551c9876cd24192e293dbb8f197e2b3199 Mon Sep 17 00:00:00 2001
From: srt8hellcat2-ui <srt8hellcat2@gmail.com>
Date: Fri, 23 Oct 2026 13:31:10 -0400
Subject: [PATCH 054/270] Test that a batch deleting pages also saves in full

---
 crates/engine/src/tests.rs | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index e94cdc1da9..3ad72285f0 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -538,6 +538,20 @@ fn saving_after_deleting_pages_from_a_signed_file_stays_incremental() {
     assert!(s.get(id).unwrap().is_signed());
 }
 
+#[test]
+fn saving_after_a_batch_that_deletes_pages_rewrites_the_file() {
+    let (mut s, id) = session_with(6);
+    let original = s.save_bytes(id).unwrap();
+    let batch = Edit::Batch {
+        label: "Delete and rotate".into(),
+        edits: vec![Edit::DeletePages { pages: vec![1, 2, 3, 4] }, Edit::RotatePages { pages: vec![0], degrees: 90 }],
+    };
+    s.apply(id, batch).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    assert!(!saved.starts_with(original.as_slice()), "a full rewrite, not an update appended to the old file");
+    assert!(!contains(&saved, b"Page 3"), "a deleted page's text is not left in an earlier revision");
+}
+
 #[test]
 fn saving_without_deleting_pages_stays_incremental() {
     let (mut s, id) = session_with(3);

From f3e8a9775a10a6dd99d347ddafa6267f6c69507c Mon Sep 17 00:00:00 2001
From: srt8hellcat2-ui <srt8hellcat2@gmail.com>
Date: Fri, 23 Oct 2026 13:53:47 -0400
Subject: [PATCH 055/270] Nest the deleting batch in the regression test

---
 crates/engine/src/tests.rs | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 3ad72285f0..6b64952e13 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -544,7 +544,13 @@ fn saving_after_a_batch_that_deletes_pages_rewrites_the_file() {
     let original = s.save_bytes(id).unwrap();
     let batch = Edit::Batch {
         label: "Delete and rotate".into(),
-        edits: vec![Edit::DeletePages { pages: vec![1, 2, 3, 4] }, Edit::RotatePages { pages: vec![0], degrees: 90 }],
+        edits: vec![
+            Edit::Batch {
+                label: "Delete pages".into(),
+                edits: vec![Edit::DeletePages { pages: vec![1, 2, 3, 4] }],
+            },
+            Edit::RotatePages { pages: vec![0], degrees: 90 },
+        ],
     };
     s.apply(id, batch).unwrap();
     let saved = s.save_bytes(id).unwrap();

From c7715a09e7cd63d9642b70e947d065d0b6e69837 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Fri, 23 Oct 2026 20:29:39 +0200
Subject: [PATCH 056/270] fix(ui): name the pages in the Background dialog's
 backdrop and scan messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"A picture covers this page (a scan?)" didn't say which page, so on a
range of several pages the user couldn't tell where the background
would stay hidden. Both messages now list the pages as 1-based runs
("Page 3", "Pages 1-3, 6"), stopping with "…" after eight runs.
The four strings are updated in every catalogue.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/i18n/ar.tsv      |  8 ++--
 crates/ui-egui/src/i18n/bg.tsv      |  8 ++--
 crates/ui-egui/src/i18n/ca.tsv      |  8 ++--
 crates/ui-egui/src/i18n/ckb.tsv     |  8 ++--
 crates/ui-egui/src/i18n/cs.tsv      |  8 ++--
 crates/ui-egui/src/i18n/de.tsv      |  8 ++--
 crates/ui-egui/src/i18n/el.tsv      |  8 ++--
 crates/ui-egui/src/i18n/es.tsv      |  8 ++--
 crates/ui-egui/src/i18n/fi.tsv      |  8 ++--
 crates/ui-egui/src/i18n/fr.tsv      |  8 ++--
 crates/ui-egui/src/i18n/hi.tsv      |  8 ++--
 crates/ui-egui/src/i18n/hu.tsv      |  8 ++--
 crates/ui-egui/src/i18n/id.tsv      |  8 ++--
 crates/ui-egui/src/i18n/it.tsv      |  8 ++--
 crates/ui-egui/src/i18n/ja.tsv      |  8 ++--
 crates/ui-egui/src/i18n/kk.tsv      |  8 ++--
 crates/ui-egui/src/i18n/ko.tsv      |  8 ++--
 crates/ui-egui/src/i18n/lo.tsv      |  8 ++--
 crates/ui-egui/src/i18n/lt.tsv      |  8 ++--
 crates/ui-egui/src/i18n/nb.tsv      |  8 ++--
 crates/ui-egui/src/i18n/pl.tsv      |  8 ++--
 crates/ui-egui/src/i18n/pt-br.tsv   |  8 ++--
 crates/ui-egui/src/i18n/ro.tsv      |  8 ++--
 crates/ui-egui/src/i18n/ru.tsv      |  8 ++--
 crates/ui-egui/src/i18n/sl.tsv      |  8 ++--
 crates/ui-egui/src/i18n/sq.tsv      |  8 ++--
 crates/ui-egui/src/i18n/te.tsv      |  8 ++--
 crates/ui-egui/src/i18n/th.tsv      |  8 ++--
 crates/ui-egui/src/i18n/tr.tsv      |  8 ++--
 crates/ui-egui/src/i18n/uk.tsv      |  8 ++--
 crates/ui-egui/src/i18n/vi.tsv      |  8 ++--
 crates/ui-egui/src/i18n/zh-hans.tsv |  8 ++--
 crates/ui-egui/src/i18n/zh-hant.tsv |  8 ++--
 crates/ui-egui/src/marks_ui.rs      | 66 ++++++++++++++++++++---------
 crates/ui-egui/tests/it/marks.rs    |  4 +-
 35 files changed, 181 insertions(+), 153 deletions(-)

diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 418ed9a01e..e41a752411 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -857,11 +857,11 @@
 	Applies to {n} pages	يُطبَّق على {n} صفحات
 	Replaces the existing one on those pages.	يستبدل الموجود على تلك الصفحات.
 	Checking pages…	جارٍ فحص الصفحات…
-	This page paints its own white backdrop, which would hide the background. Replace it	ترسم هذه الصفحة تعبئة بيضاء خاصة بها ستُخفي الخلفية. استبدالها
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	عدد الصفحات التي ترسم تعبئة بيضاء خاصة بها ستُخفي الخلفية: {n}. استبدالها
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	الصفحة {pages} ترسم تعبئة بيضاء خاصة بها ستُخفي الخلفية. استبدالها
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	الصفحات {pages} ترسم تعبئة بيضاء خاصة بها ستُخفي الخلفية. استبدالها
 	Removing the background puts the page's own backdrop back.	إزالة الخلفية تعيد التعبئة البيضاء الخاصة بالصفحة.
-	A picture covers this page (a scan?), so the background won't show there.	تغطي صورة هذه الصفحة (مسح ضوئي؟)، لذا لن تظهر الخلفية فيها.
-	A picture covers {n} pages (scans?), so the background won't show there.	عدد الصفحات التي تغطيها صور (مسح ضوئي؟): {n}؛ لن تظهر الخلفية فيها.
+	A picture covers page {pages} (a scan?), so the background won't show there.	تغطي صورة الصفحة {pages} (مسح ضوئي؟)، لذا لن تظهر الخلفية فيها.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	تغطي صور الصفحات {pages} (مسح ضوئي؟)، لذا لن تظهر الخلفية فيها.
 	PDF or image	PDF أو صورة
 	No file chosen	لم يُختر ملف
 	Page number	رقم الصفحة
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index c430dbf387..1854c469ef 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -528,11 +528,11 @@
 	Applies to {n} pages	Прилага се към {n} страници
 	Replaces the existing one on those pages.	Заменя съществуващия на тези страници.
 	Checking pages…	Проверка на страниците…
-	This page paints its own white backdrop, which would hide the background. Replace it	Тази страница има собствено бяло запълване, което би скрило фона. Замяна
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Страници със собствено бяло запълване, което би скрило фона: {n}. Замяна
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Страница {pages} има собствено бяло запълване, което би скрило фона. Замяна
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Страници {pages} имат собствено бяло запълване, което би скрило фона. Замяна
 	Removing the background puts the page's own backdrop back.	Премахването на фона връща собственото бяло запълване на страницата.
-	A picture covers this page (a scan?), so the background won't show there.	Изображение покрива тази страница (сканиране?), затова фонът няма да се вижда там.
-	A picture covers {n} pages (scans?), so the background won't show there.	Страници, покрити с изображения (сканирания?): {n}; фонът няма да се вижда там.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Изображение покрива страница {pages} (сканиране?), затова фонът няма да се вижда там.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Изображения покриват страници {pages} (сканирания?), затова фонът няма да се вижда там.
 	PDF or image	PDF или изображение
 	No file chosen	Не е избран файл
 	Page number	Номер на страница
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 45f3a3e9c8..34ea8188e7 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -816,11 +816,11 @@
 	Applies to {n} pages	S'aplica a {n} pàgines
 	Replaces the existing one on those pages.	Substitueix l'existent en aquestes pàgines.
 	Checking pages…	S'estan comprovant les pàgines…
-	This page paints its own white backdrop, which would hide the background. Replace it	Aquesta pàgina té el seu propi farciment blanc, que amagaria el fons. Substitueix-lo
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} pàgines tenen el seu propi farciment blanc, que amagaria el fons. Substitueix-lo
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	La pàgina {pages} té el seu propi farciment blanc, que amagaria el fons. Substitueix-lo
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Les pàgines {pages} tenen el seu propi farciment blanc, que amagaria el fons. Substitueix-lo
 	Removing the background puts the page's own backdrop back.	En eliminar el fons, es restaura el farciment blanc propi de la pàgina.
-	A picture covers this page (a scan?), so the background won't show there.	Una imatge cobreix aquesta pàgina (un escaneig?), així que el fons no s'hi veurà.
-	A picture covers {n} pages (scans?), so the background won't show there.	Hi ha imatges que cobreixen {n} pàgines (escanejos?), així que el fons no s'hi veurà.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Una imatge cobreix la pàgina {pages} (un escaneig?), així que el fons no s'hi veurà.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Hi ha imatges que cobreixen les pàgines {pages} (escanejos?), així que el fons no s'hi veurà.
 	PDF or image	PDF o imatge
 	No file chosen	Cap fitxer triat
 	Page number	Número de pàgina
diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index 2e6c259688..2e7d8f69a9 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -826,11 +826,11 @@
 	Applies to {n} pages	بۆ {n} پەڕە جێبەجێ دەکرێت
 	Replaces the existing one on those pages.	ئەوەی ئێستا هەیە لەسەر ئەو پەڕانە دەگۆڕێت.
 	Checking pages…	پشکنینی پەڕەکان…
-	This page paints its own white backdrop, which would hide the background. Replace it	ئەم پەڕەیە پڕکردنەوەیەکی سپیی خۆی هەیە کە پاشبنەماکە دەشارێتەوە. جێگرتنەوە
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} پەڕە پڕکردنەوەیەکی سپیی خۆیان هەیە کە پاشبنەماکە دەشارێتەوە. جێگرتنەوە
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	پەڕەی {pages} پڕکردنەوەیەکی سپیی خۆی هەیە کە پاشبنەماکە دەشارێتەوە. جێگرتنەوە
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	پەڕەکانی {pages} پڕکردنەوەیەکی سپیی خۆیان هەیە کە پاشبنەماکە دەشارێتەوە. جێگرتنەوە
 	Removing the background puts the page's own backdrop back.	لابردنی پاشبنەما پڕکردنەوە سپییەکەی خودی پەڕەکە دەگەڕێنێتەوە.
-	A picture covers this page (a scan?), so the background won't show there.	وێنەیەک ئەم پەڕەیە دادەپۆشێت (سکان؟)، بۆیە پاشبنەماکە لەوێ دەرناکەوێت.
-	A picture covers {n} pages (scans?), so the background won't show there.	وێنەکان {n} پەڕە دادەپۆشن (سکان؟)، بۆیە پاشبنەماکە لەوێ دەرناکەوێت.
+	A picture covers page {pages} (a scan?), so the background won't show there.	وێنەیەک پەڕەی {pages} دادەپۆشێت (سکان؟)، بۆیە پاشبنەماکە لەوێ دەرناکەوێت.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	وێنەکان پەڕەکانی {pages} دادەپۆشن (سکان؟)، بۆیە پاشبنەماکە لەوێ دەرناکەوێت.
 	PDF or image	PDF یان وێنە
 	No file chosen	هیچ فایلێک هەڵنەبژێردراوە
 	Page number	ژمارەی پەڕە
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 952e9e1eb6..a2d3f1b0e9 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -932,11 +932,11 @@ key	Space	Mezerník
 	Applies to {n} pages	Počet dotčených stránek: {n}
 	Replaces the existing one on those pages.	Nahradí stávající na těchto stránkách.
 	Checking pages…	Kontrola stránek…
-	This page paints its own white backdrop, which would hide the background. Replace it	Tato stránka má vlastní bílou výplň, která by zakryla pozadí. Nahradit ji
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Stránky s vlastní bílou výplní, která by zakryla pozadí: {n}. Nahradit ji
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Stránka {pages} má vlastní bílou výplň, která by zakryla pozadí. Nahradit ji
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Stránky {pages} mají vlastní bílou výplň, která by zakryla pozadí. Nahradit ji
 	Removing the background puts the page's own backdrop back.	Odebráním pozadí se vrátí vlastní bílá výplň stránky.
-	A picture covers this page (a scan?), so the background won't show there.	Tuto stránku pokrývá obrázek (sken?), takže pozadí na ní nebude vidět.
-	A picture covers {n} pages (scans?), so the background won't show there.	Stránky pokryté obrázky (skeny?): {n}; pozadí na nich nebude vidět.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Stránku {pages} pokrývá obrázek (sken?), takže pozadí na ní nebude vidět.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Stránky {pages} pokrývají obrázky (skeny?), takže pozadí na nich nebude vidět.
 	PDF or image	PDF nebo obrázek
 	No file chosen	Není vybrán žádný soubor
 	Page number	Číslo stránky
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index e67cbbe5b6..f7b6083f6b 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -835,11 +835,11 @@
 	Applies to {n} pages	Gilt für {n} Seiten
 	Replaces the existing one on those pages.	Ersetzt das Vorhandene auf diesen Seiten.
 	Checking pages…	Seiten werden geprüft…
-	This page paints its own white backdrop, which would hide the background. Replace it	Diese Seite hat eine eigene weiße Fläche, die den Hintergrund verdecken würde. Ersetzen
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} Seiten haben eine eigene weiße Fläche, die den Hintergrund verdecken würde. Ersetzen
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Seite {pages} hat eine eigene weiße Fläche, die den Hintergrund verdecken würde. Ersetzen
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Die Seiten {pages} haben eine eigene weiße Fläche, die den Hintergrund verdecken würde. Ersetzen
 	Removing the background puts the page's own backdrop back.	Wird der Hintergrund entfernt, kehrt die eigene weiße Fläche der Seite zurück.
-	A picture covers this page (a scan?), so the background won't show there.	Ein Bild bedeckt diese Seite (ein Scan?), daher ist der Hintergrund dort nicht zu sehen.
-	A picture covers {n} pages (scans?), so the background won't show there.	Bilder bedecken {n} Seiten (Scans?), daher ist der Hintergrund dort nicht zu sehen.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Ein Bild bedeckt Seite {pages} (ein Scan?), daher ist der Hintergrund dort nicht zu sehen.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Bilder bedecken die Seiten {pages} (Scans?), daher ist der Hintergrund dort nicht zu sehen.
 	PDF or image	PDF oder Bild
 	No file chosen	Keine Datei ausgewählt
 	Page number	Seitenzahl
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 72ffad8c40..143c915388 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -439,11 +439,11 @@
 	Applies to {n} pages	Εφαρμόζεται σε {n} σελίδες
 	Replaces the existing one on those pages.	Αντικαθιστά το υπάρχον στοιχείο στις συγκεκριμένες σελίδες.
 	Checking pages…	Έλεγχος σελίδων…
-	This page paints its own white backdrop, which would hide the background. Replace it	Αυτή η σελίδα έχει δική της λευκή γέμιση, που θα έκρυβε το φόντο. Αντικατάσταση
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} σελίδες έχουν δική τους λευκή γέμιση, που θα έκρυβε το φόντο. Αντικατάσταση
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Η σελίδα {pages} έχει δική της λευκή γέμιση, που θα έκρυβε το φόντο. Αντικατάσταση
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Οι σελίδες {pages} έχουν δική τους λευκή γέμιση, που θα έκρυβε το φόντο. Αντικατάσταση
 	Removing the background puts the page's own backdrop back.	Η αφαίρεση του φόντου επαναφέρει τη λευκή γέμιση της σελίδας.
-	A picture covers this page (a scan?), so the background won't show there.	Μια εικόνα καλύπτει αυτή τη σελίδα (σάρωση;), οπότε το φόντο δεν θα φαίνεται εκεί.
-	A picture covers {n} pages (scans?), so the background won't show there.	Εικόνες καλύπτουν {n} σελίδες (σαρώσεις;), οπότε το φόντο δεν θα φαίνεται εκεί.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Μια εικόνα καλύπτει τη σελίδα {pages} (σάρωση;), οπότε το φόντο δεν θα φαίνεται εκεί.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Εικόνες καλύπτουν τις σελίδες {pages} (σαρώσεις;), οπότε το φόντο δεν θα φαίνεται εκεί.
 	PDF or image	PDF ή εικόνα
 	No file chosen	Δεν έχει επιλεγεί αρχείο
 	Scale relative to target page	Κλίμακα ως προς τη σελίδα προορισμού
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index fdda81c7a3..451b0489bc 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -851,11 +851,11 @@
 	Applies to {n} pages	Se aplica a {n} páginas
 	Replaces the existing one on those pages.	Reemplaza al existente en esas páginas.
 	Checking pages…	Comprobando páginas…
-	This page paints its own white backdrop, which would hide the background. Replace it	Esta página tiene su propio relleno blanco, que ocultaría el fondo. Reemplazarlo
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} páginas tienen su propio relleno blanco, que ocultaría el fondo. Reemplazarlo
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	La página {pages} tiene su propio relleno blanco, que ocultaría el fondo. Reemplazarlo
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Las páginas {pages} tienen su propio relleno blanco, que ocultaría el fondo. Reemplazarlo
 	Removing the background puts the page's own backdrop back.	Al quitar el fondo, se restaura el relleno blanco propio de la página.
-	A picture covers this page (a scan?), so the background won't show there.	Una imagen cubre esta página (¿un escaneo?), así que el fondo no se verá ahí.
-	A picture covers {n} pages (scans?), so the background won't show there.	Hay imágenes que cubren {n} páginas (¿escaneos?), así que el fondo no se verá ahí.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Una imagen cubre la página {pages} (¿un escaneo?), así que el fondo no se verá ahí.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Hay imágenes que cubren las páginas {pages} (¿escaneos?), así que el fondo no se verá ahí.
 	PDF or image	PDF o imagen
 	No file chosen	Ningún archivo elegido
 	Page number	Número de página
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index d2499f5261..ba4a72b142 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -815,11 +815,11 @@
 	Applies to {n} pages	Koskee {n} sivua
 	Replaces the existing one on those pages.	Korvaa näiden sivujen nykyisen.
 	Checking pages…	Tarkistetaan sivuja…
-	This page paints its own white backdrop, which would hide the background. Replace it	Tällä sivulla on oma valkoinen täyttö, joka peittäisi taustan. Korvaa se
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} sivulla on oma valkoinen täyttö, joka peittäisi taustan. Korvaa ne
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Sivulla {pages} on oma valkoinen täyttö, joka peittäisi taustan. Korvaa se
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Sivuilla {pages} on oma valkoinen täyttö, joka peittäisi taustan. Korvaa ne
 	Removing the background puts the page's own backdrop back.	Taustan poistaminen palauttaa sivun oman valkoisen täytön.
-	A picture covers this page (a scan?), so the background won't show there.	Kuva peittää tämän sivun (skannaus?), joten tausta ei näy siinä.
-	A picture covers {n} pages (scans?), so the background won't show there.	Kuvat peittävät {n} sivua (skannauksia?), joten tausta ei näy niissä.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Kuva peittää sivun {pages} (skannaus?), joten tausta ei näy siinä.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Kuvat peittävät sivut {pages} (skannauksia?), joten tausta ei näy niissä.
 	PDF or image	PDF tai kuva
 	No file chosen	Tiedostoa ei ole valittu
 	Page number	Sivunumero
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 0e63a24ae7..7eed4b9d4c 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -831,11 +831,11 @@
 	Applies to {n} pages	S'applique à {n} pages
 	Replaces the existing one on those pages.	Remplace celui qui existe déjà sur ces pages.
 	Checking pages…	Vérification des pages…
-	This page paints its own white backdrop, which would hide the background. Replace it	Cette page a son propre remplissage blanc, qui masquerait l'arrière-plan. Le remplacer
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} pages ont leur propre remplissage blanc, qui masquerait l'arrière-plan. Le remplacer
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	La page {pages} a son propre remplissage blanc, qui masquerait l'arrière-plan. Le remplacer
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Les pages {pages} ont leur propre remplissage blanc, qui masquerait l'arrière-plan. Le remplacer
 	Removing the background puts the page's own backdrop back.	Supprimer l'arrière-plan rétablit le remplissage blanc propre à la page.
-	A picture covers this page (a scan?), so the background won't show there.	Une image couvre cette page (une numérisation ?), l'arrière-plan n'y sera donc pas visible.
-	A picture covers {n} pages (scans?), so the background won't show there.	Des images couvrent {n} pages (des numérisations ?), l'arrière-plan n'y sera donc pas visible.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Une image couvre la page {pages} (une numérisation ?), l'arrière-plan n'y sera donc pas visible.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Des images couvrent les pages {pages} (des numérisations ?), l'arrière-plan n'y sera donc pas visible.
 	PDF or image	PDF ou image
 	No file chosen	Aucun fichier choisi
 	Page number	Numéro de page
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index 9202f1d62e..4a6baf1819 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -799,11 +799,11 @@
 	Applies to {n} pages	{n} पृष्ठों पर लागू
 	Replaces the existing one on those pages.	उन पृष्ठों पर मौजूदा वाले को बदल देता है।
 	Checking pages…	पृष्ठों की जाँच हो रही है…
-	This page paints its own white backdrop, which would hide the background. Replace it	इस पृष्ठ की अपनी सफ़ेद भराई है, जो पृष्ठभूमि को छिपा देगी। इसे बदलें
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} पृष्ठों की अपनी सफ़ेद भराई है, जो पृष्ठभूमि को छिपा देगी। इसे बदलें
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	पृष्ठ {pages} की अपनी सफ़ेद भराई है, जो पृष्ठभूमि को छिपा देगी। इसे बदलें
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	पृष्ठ {pages} की अपनी सफ़ेद भराई है, जो पृष्ठभूमि को छिपा देगी। इसे बदलें
 	Removing the background puts the page's own backdrop back.	पृष्ठभूमि हटाने पर पृष्ठ की अपनी सफ़ेद भराई वापस आ जाती है।
-	A picture covers this page (a scan?), so the background won't show there.	एक छवि इस पृष्ठ को ढकती है (स्कैन?), इसलिए वहाँ पृष्ठभूमि नहीं दिखेगी।
-	A picture covers {n} pages (scans?), so the background won't show there.	छवियाँ {n} पृष्ठों को ढकती हैं (स्कैन?), इसलिए वहाँ पृष्ठभूमि नहीं दिखेगी।
+	A picture covers page {pages} (a scan?), so the background won't show there.	एक छवि पृष्ठ {pages} को ढकती है (स्कैन?), इसलिए वहाँ पृष्ठभूमि नहीं दिखेगी।
+	Pictures cover pages {pages} (scans?), so the background won't show there.	छवियाँ पृष्ठ {pages} को ढकती हैं (स्कैन?), इसलिए वहाँ पृष्ठभूमि नहीं दिखेगी।
 	PDF or image	पीडीएफ़ या छवि
 	No file chosen	कोई फ़ाइल नहीं चुनी गई
 	Page number	पृष्ठ संख्या
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 80eeb2007b..f21705c6e1 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -828,11 +828,11 @@
 	Applies to {n} pages	{n} oldalra vonatkozik
 	Replaces the existing one on those pages.	Lecseréli a meglévőt ezeken az oldalakon.
 	Checking pages…	Oldalak ellenőrzése…
-	This page paints its own white backdrop, which would hide the background. Replace it	Ennek az oldalnak saját fehér kitöltése van, amely eltakarná a hátteret. Csere
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} oldalnak saját fehér kitöltése van, amely eltakarná a hátteret. Csere
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Ennek az oldalnak saját fehér kitöltése van, amely eltakarná a hátteret: {pages}. Csere
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Ezeknek az oldalaknak saját fehér kitöltése van, amely eltakarná a hátteret: {pages}. Csere
 	Removing the background puts the page's own backdrop back.	A háttér eltávolítása visszaállítja az oldal saját fehér kitöltését.
-	A picture covers this page (a scan?), so the background won't show there.	Egy kép fedi le ezt az oldalt (szkennelt?), így ott nem látszik a háttér.
-	A picture covers {n} pages (scans?), so the background won't show there.	Képek fednek le {n} oldalt (szkenneltek?), így ott nem látszik a háttér.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Egy kép fedi le ezt az oldalt: {pages} (szkennelt?), így ott nem látszik a háttér.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Képek fedik le ezeket az oldalakat: {pages} (szkenneltek?), így ott nem látszik a háttér.
 	PDF or image	PDF vagy kép
 	No file chosen	Nincs fájl kiválasztva
 	Page number	Oldalszám
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 3d7e01d636..002cd54de7 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -945,11 +945,11 @@
 	Replacement: pages of {name}	Pengganti: halaman dari {name}
 	Replaces the existing one on those pages.	Menggantikan yang ada di halaman-halaman itu.
 	Checking pages…	Memeriksa halaman…
-	This page paints its own white backdrop, which would hide the background. Replace it	Halaman ini memiliki isian putihnya sendiri, yang akan menutupi latar belakang. Ganti
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} halaman memiliki isian putihnya sendiri, yang akan menutupi latar belakang. Ganti
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Halaman {pages} memiliki isian putihnya sendiri, yang akan menutupi latar belakang. Ganti
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Halaman-halaman {pages} memiliki isian putihnya sendiri, yang akan menutupi latar belakang. Ganti
 	Removing the background puts the page's own backdrop back.	Menghapus latar belakang akan mengembalikan isian putih milik halaman.
-	A picture covers this page (a scan?), so the background won't show there.	Sebuah gambar menutupi halaman ini (hasil pindai?), jadi latar belakang tidak akan terlihat di sana.
-	A picture covers {n} pages (scans?), so the background won't show there.	Gambar menutupi {n} halaman (hasil pindai?), jadi latar belakang tidak akan terlihat di sana.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Sebuah gambar menutupi halaman {pages} (hasil pindai?), jadi latar belakang tidak akan terlihat di sana.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Gambar menutupi halaman-halaman {pages} (hasil pindai?), jadi latar belakang tidak akan terlihat di sana.
 	Report	Laporan
 	Report…	Laporan…
 	Requires user to enter a password for:	Memerlukan pengguna untuk memasukkan kata sandi untuk:
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index a11fb4abc7..fb64615371 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -854,11 +854,11 @@
 	Applies to {n} pages	Si applica a {n} pagine
 	Replaces the existing one on those pages.	Sostituisce l'elemento esistente su quelle pagine.
 	Checking pages…	Verifica delle pagine…
-	This page paints its own white backdrop, which would hide the background. Replace it	Questa pagina ha un proprio riempimento bianco, che nasconderebbe lo sfondo. Sostituiscilo
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} pagine hanno un proprio riempimento bianco, che nasconderebbe lo sfondo. Sostituiscilo
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	La pagina {pages} ha un proprio riempimento bianco, che nasconderebbe lo sfondo. Sostituiscilo
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Le pagine {pages} hanno un proprio riempimento bianco, che nasconderebbe lo sfondo. Sostituiscilo
 	Removing the background puts the page's own backdrop back.	Rimuovendo lo sfondo, il riempimento bianco della pagina viene ripristinato.
-	A picture covers this page (a scan?), so the background won't show there.	Un'immagine copre questa pagina (una scansione?), quindi lì lo sfondo non sarà visibile.
-	A picture covers {n} pages (scans?), so the background won't show there.	Delle immagini coprono {n} pagine (scansioni?), quindi lì lo sfondo non sarà visibile.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Un'immagine copre la pagina {pages} (una scansione?), quindi lì lo sfondo non sarà visibile.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Delle immagini coprono le pagine {pages} (scansioni?), quindi lì lo sfondo non sarà visibile.
 	PDF or image	PDF o immagine
 	No file chosen	Nessun file scelto
 	Page number	Numero di pagina
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index f71e0b2fc2..79b12f015a 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -858,11 +858,11 @@
 	Applies to {n} pages	{n} ページに適用
 	Replaces the existing one on those pages.	対象ページの既存の項目を置き換えます。
 	Checking pages…	ページを確認しています…
-	This page paints its own white backdrop, which would hide the background. Replace it	このページには独自の白い塗りがあり、背景が隠れてしまいます。置き換える
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} ページに独自の白い塗りがあり、背景が隠れてしまいます。置き換える
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	{pages} ページには独自の白い塗りがあり、背景が隠れてしまいます。置き換える
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	{pages} ページに独自の白い塗りがあり、背景が隠れてしまいます。置き換える
 	Removing the background puts the page's own backdrop back.	背景を削除すると、ページ独自の白い塗りが元に戻ります。
-	A picture covers this page (a scan?), so the background won't show there.	このページは画像（スキャン？）で覆われているため、背景は表示されません。
-	A picture covers {n} pages (scans?), so the background won't show there.	{n} ページが画像（スキャン？）で覆われているため、そこでは背景は表示されません。
+	A picture covers page {pages} (a scan?), so the background won't show there.	{pages} ページは画像（スキャン？）で覆われているため、背景は表示されません。
+	Pictures cover pages {pages} (scans?), so the background won't show there.	{pages} ページが画像（スキャン？）で覆われているため、そこでは背景は表示されません。
 	PDF or image	PDF または画像
 	No file chosen	ファイルが選択されていません
 	Page number	ページ番号
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 0ddf3c9b1f..a040c013b5 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -813,11 +813,11 @@
 	Applies to {n} pages	{n} бетке қолданылады
 	Replaces the existing one on those pages.	Осы беттерде бар элементті ауыстырады.
 	Checking pages…	Беттер тексерілуде…
-	This page paints its own white backdrop, which would hide the background. Replace it	Бұл беттің өз ақ толтыруы бар, ол фонды жасырады. Ауыстыру
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} беттің өз ақ толтыруы бар, ол фонды жасырады. Ауыстыру
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Өз ақ толтыруы фонды жасыратын бет: {pages}. Ауыстыру
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Өз ақ толтыруы фонды жасыратын беттер: {pages}. Ауыстыру
 	Removing the background puts the page's own backdrop back.	Фонды жою беттің өз ақ толтыруын қайтарады.
-	A picture covers this page (a scan?), so the background won't show there.	Бұл бетті сурет жауып тұр (сканер ме?), сондықтан онда фон көрінбейді.
-	A picture covers {n} pages (scans?), so the background won't show there.	{n} бетті суреттер жауып тұр (сканер ме?), сондықтан онда фон көрінбейді.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Сурет жауып тұрған бет (сканер ме?): {pages}; онда фон көрінбейді.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Суреттер жауып тұрған беттер (сканер ме?): {pages}; онда фон көрінбейді.
 	PDF or image	PDF немесе сурет
 	No file chosen	Файл таңдалмады
 	Page number	Бет нөмірі
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 8310f1f323..873c93b6f9 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -799,11 +799,11 @@
 	Applies to {n} pages	{n}개 페이지에 적용됩니다
 	Replaces the existing one on those pages.	해당 페이지의 기존 항목을 대체합니다.
 	Checking pages…	페이지 확인 중…
-	This page paints its own white backdrop, which would hide the background. Replace it	이 페이지에는 배경을 가리는 자체 흰색 채우기가 있습니다. 바꾸기
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n}개 페이지에 배경을 가리는 자체 흰색 채우기가 있습니다. 바꾸기
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	{pages}페이지에는 배경을 가리는 자체 흰색 채우기가 있습니다. 바꾸기
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	{pages}페이지에 배경을 가리는 자체 흰색 채우기가 있습니다. 바꾸기
 	Removing the background puts the page's own backdrop back.	배경을 제거하면 페이지 자체의 흰색 채우기가 복원됩니다.
-	A picture covers this page (a scan?), so the background won't show there.	이미지가 이 페이지를 덮고 있어(스캔본?) 배경이 보이지 않습니다.
-	A picture covers {n} pages (scans?), so the background won't show there.	이미지가 {n}개 페이지를 덮고 있어(스캔본?) 배경이 보이지 않습니다.
+	A picture covers page {pages} (a scan?), so the background won't show there.	이미지가 {pages}페이지를 덮고 있어(스캔본?) 배경이 보이지 않습니다.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	이미지들이 {pages}페이지를 덮고 있어(스캔본?) 배경이 보이지 않습니다.
 	PDF or image	PDF 또는 이미지
 	No file chosen	선택한 파일 없음
 	Page number	페이지 번호
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index 587a5933a7..04d5b73d1d 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -825,11 +825,11 @@
 	Applies to {n} pages	ນຳໃຊ້ກັບ {n} ໜ້າ
 	Replaces the existing one on those pages.	ປ່ຽນແທນສິ່ງທີ່ມີຢູ່ແລ້ວໃນໜ້າເຫຼົ່ານັ້ນ.
 	Checking pages…	ກຳລັງກວດສອບໜ້າ…
-	This page paints its own white backdrop, which would hide the background. Replace it	ໜ້ານີ້ມີພື້ນສີຂາວຂອງມັນເອງ ເຊິ່ງຈະບັງພື້ນຫຼັງ. ປ່ຽນແທນ
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} ໜ້າມີພື້ນສີຂາວຂອງມັນເອງ ເຊິ່ງຈະບັງພື້ນຫຼັງ. ປ່ຽນແທນ
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	ໜ້າ {pages} ມີພື້ນສີຂາວຂອງມັນເອງ ເຊິ່ງຈະບັງພື້ນຫຼັງ. ປ່ຽນແທນ
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	ໜ້າ {pages} ມີພື້ນສີຂາວຂອງພວກມັນເອງ ເຊິ່ງຈະບັງພື້ນຫຼັງ. ປ່ຽນແທນ
 	Removing the background puts the page's own backdrop back.	ການລຶບພື້ນຫຼັງຈະເອົາພື້ນສີຂາວເດີມຂອງໜ້າກັບຄືນມາ.
-	A picture covers this page (a scan?), so the background won't show there.	ມີຮູບພາບປົກໜ້ານີ້ຢູ່ (ພາບສະແກນ?), ສະນັ້ນພື້ນຫຼັງຈະບໍ່ສະແດງຢູ່ບ່ອນນັ້ນ.
-	A picture covers {n} pages (scans?), so the background won't show there.	ມີຮູບພາບປົກ {n} ໜ້າຢູ່ (ພາບສະແກນ?), ສະນັ້ນພື້ນຫຼັງຈະບໍ່ສະແດງຢູ່ບ່ອນນັ້ນ.
+	A picture covers page {pages} (a scan?), so the background won't show there.	ມີຮູບພາບປົກໜ້າ {pages} ຢູ່ (ພາບສະແກນ?), ສະນັ້ນພື້ນຫຼັງຈະບໍ່ສະແດງຢູ່ບ່ອນນັ້ນ.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	ມີຮູບພາບຫຼາຍຮູບປົກໜ້າ {pages} ຢູ່ (ພາບສະແກນ?), ສະນັ້ນພື້ນຫຼັງຈະບໍ່ສະແດງຢູ່ບ່ອນນັ້ນ.
 	PDF or image	PDF ຫຼື ຮູບພາບ
 	No file chosen	ຍັງບໍ່ໄດ້ເລືອກໄຟລ໌
 	Page number	ໝາຍເລກໜ້າ
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index f0839dc9d5..86242b6f41 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -997,11 +997,11 @@
 	Replacement: pages of {name}	Pakaitinis dokumentas: {name} puslapiai
 	Replaces the existing one on those pages.	Tuose puslapiuose pakeičia esamą.
 	Checking pages…	Tikrinami puslapiai…
-	This page paints its own white backdrop, which would hide the background. Replace it	Šis puslapis turi savo baltą užpildą, kuris paslėptų foną. Pakeisti
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Puslapiai su savo baltu užpildu, kuris paslėptų foną: {n}. Pakeisti
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Puslapis su savo baltu užpildu, kuris paslėptų foną: {pages}. Pakeisti
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Puslapiai su savo baltu užpildu, kuris paslėptų foną: {pages}. Pakeisti
 	Removing the background puts the page's own backdrop back.	Pašalinus foną, grąžinamas paties puslapio baltas užpildas.
-	A picture covers this page (a scan?), so the background won't show there.	Šį puslapį dengia paveikslėlis (nuskaitytas?), todėl fonas ten nesimatys.
-	A picture covers {n} pages (scans?), so the background won't show there.	Paveikslėliais padengti puslapiai (nuskaityti?): {n}; fonas ten nesimatys.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Paveikslėliu padengtas puslapis (nuskaitytas?): {pages}; fonas ten nesimatys.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Paveikslėliais padengti puslapiai (nuskaityti?): {pages}; fonas ten nesimatys.
 	Report	Ataskaita
 	Report…	Ataskaita…
 	Requires user to enter a password for:	Naudotojas turi įvesti slaptažodį, kad galėtų:
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index 6391c16a9a..54bafb923a 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -954,11 +954,11 @@
 	Replacement: pages of {name}	Erstatning: sider fra {name}
 	Replaces the existing one on those pages.	Erstatter den eksisterende på disse sidene.
 	Checking pages…	Kontrollerer sidene…
-	This page paints its own white backdrop, which would hide the background. Replace it	Denne siden maler sin egen hvite flate, som ville skjult bakgrunnen. Erstatt den
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} sider maler sin egen hvite flate, som ville skjult bakgrunnen. Erstatt den
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Side {pages} maler sin egen hvite flate, som ville skjult bakgrunnen. Erstatt den
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Sidene {pages} maler sine egne hvite flater, som ville skjult bakgrunnen. Erstatt dem
 	Removing the background puts the page's own backdrop back.	Når bakgrunnen fjernes, kommer sidens egen hvite flate tilbake.
-	A picture covers this page (a scan?), so the background won't show there.	Et bilde dekker denne siden (en skanning?), så bakgrunnen vises ikke der.
-	A picture covers {n} pages (scans?), so the background won't show there.	Bilder dekker {n} sider (skanninger?), så bakgrunnen vises ikke der.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Et bilde dekker side {pages} (en skanning?), så bakgrunnen vises ikke der.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Bilder dekker sidene {pages} (skanninger?), så bakgrunnen vises ikke der.
 	Report	Rapport
 	Report…	Rapport…
 	Requires user to enter a password for:	Krever at brukeren skriver inn et passord for:
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 3b732fd4d6..d3b5abf68c 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -849,11 +849,11 @@
 	Applies to {n} pages	Liczba objętych stron: {n}
 	Replaces the existing one on those pages.	Zastępuje istniejący element na tych stronach.
 	Checking pages…	Sprawdzanie stron…
-	This page paints its own white backdrop, which would hide the background. Replace it	Ta strona ma własne białe wypełnienie, które zasłoniłoby tło. Zastąp
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Strony z własnym białym wypełnieniem, które zasłoniłoby tło: {n}. Zastąp
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Strona z własnym białym wypełnieniem, które zasłoniłoby tło: {pages}. Zastąp
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Strony z własnym białym wypełnieniem, które zasłoniłoby tło: {pages}. Zastąp
 	Removing the background puts the page's own backdrop back.	Usunięcie tła przywraca własne białe wypełnienie strony.
-	A picture covers this page (a scan?), so the background won't show there.	Tę stronę zakrywa obraz (skan?), więc tło nie będzie tam widoczne.
-	A picture covers {n} pages (scans?), so the background won't show there.	Strony zakryte obrazami (skany?): {n}; tło nie będzie tam widoczne.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Strona zakryta obrazem (skan?): {pages}; tło nie będzie tam widoczne.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Strony zakryte obrazami (skany?): {pages}; tło nie będzie tam widoczne.
 	PDF or image	PDF lub obraz
 	No file chosen	Nie wybrano pliku
 	Page number	Numer strony
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index b2dce497ad..53c2d8461d 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -483,11 +483,11 @@
 	Applies to {n} pages	Aplica-se a {n} páginas
 	Replaces the existing one on those pages.	Substitui o existente nessas páginas.
 	Checking pages…	Verificando páginas…
-	This page paints its own white backdrop, which would hide the background. Replace it	Esta página tem um preenchimento branco próprio, que esconderia o plano de fundo. Substituí-lo
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} páginas têm um preenchimento branco próprio, que esconderia o plano de fundo. Substituí-lo
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	A página {pages} tem um preenchimento branco próprio, que esconderia o plano de fundo. Substituí-lo
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	As páginas {pages} têm um preenchimento branco próprio, que esconderia o plano de fundo. Substituí-lo
 	Removing the background puts the page's own backdrop back.	Remover o plano de fundo restaura o preenchimento branco da página.
-	A picture covers this page (a scan?), so the background won't show there.	Uma imagem cobre esta página (uma digitalização?), então o plano de fundo não aparecerá nela.
-	A picture covers {n} pages (scans?), so the background won't show there.	Imagens cobrem {n} páginas (digitalizações?), então o plano de fundo não aparecerá nelas.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Uma imagem cobre a página {pages} (uma digitalização?), então o plano de fundo não aparecerá nela.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Imagens cobrem as páginas {pages} (digitalizações?), então o plano de fundo não aparecerá nelas.
 	PDF or image	PDF ou imagem
 	No file chosen	Nenhum arquivo escolhido
 	Page number	Número da página
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index 643f39538b..5eb10620fb 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -954,11 +954,11 @@
 	Replacement: pages of {name}	Înlocuire: pagini din {name}
 	Replaces the existing one on those pages.	Înlocuiește-l pe cel existent pe acele pagini.
 	Checking pages…	Se verifică paginile…
-	This page paints its own white backdrop, which would hide the background. Replace it	Această pagină are o umplere albă proprie, care ar ascunde fundalul. Înlocuiește-o
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} pagini au o umplere albă proprie, care ar ascunde fundalul. Înlocuiește-o
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Pagina {pages} are o umplere albă proprie, care ar ascunde fundalul. Înlocuiește-o
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Paginile {pages} au o umplere albă proprie, care ar ascunde fundalul. Înlocuiește-o
 	Removing the background puts the page's own backdrop back.	Eliminarea fundalului readuce umplerea albă proprie a paginii.
-	A picture covers this page (a scan?), so the background won't show there.	O imagine acoperă această pagină (o scanare?), deci fundalul nu se va vedea acolo.
-	A picture covers {n} pages (scans?), so the background won't show there.	Imagini acoperă {n} pagini (scanări?), deci fundalul nu se va vedea acolo.
+	A picture covers page {pages} (a scan?), so the background won't show there.	O imagine acoperă pagina {pages} (o scanare?), deci fundalul nu se va vedea acolo.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Imagini acoperă paginile {pages} (scanări?), deci fundalul nu se va vedea acolo.
 	Report	Raport
 	Report…	Raport…
 	Requires user to enter a password for:	Utilizatorul trebuie să introducă o parolă pentru:
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index a5c23bbe93..c3eaea9ba3 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -851,11 +851,11 @@
 	Applies to {n} pages	Применяется к {n} страницам
 	Replaces the existing one on those pages.	Заменяет существующий на этих страницах.
 	Checking pages…	Проверка страниц…
-	This page paints its own white backdrop, which would hide the background. Replace it	На этой странице есть собственная белая заливка, которая скроет фон. Заменить
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Страницы с собственной белой заливкой, которая скроет фон: {n}. Заменить
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Страница с собственной белой заливкой, которая скроет фон: {pages}. Заменить
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Страницы с собственной белой заливкой, которая скроет фон: {pages}. Заменить
 	Removing the background puts the page's own backdrop back.	При удалении фона собственная белая заливка страницы возвращается.
-	A picture covers this page (a scan?), so the background won't show there.	Эту страницу закрывает изображение (скан?), поэтому фон там не будет виден.
-	A picture covers {n} pages (scans?), so the background won't show there.	Страницы, закрытые изображениями (сканы?): {n}; фон там не будет виден.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Страница, закрытая изображением (скан?): {pages}; фон там не будет виден.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Страницы, закрытые изображениями (сканы?): {pages}; фон там не будет виден.
 	PDF or image	PDF или изображение
 	No file chosen	Файл не выбран
 	Page number	Номер страницы
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 5fcbdb1268..d81b47794c 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -1523,11 +1523,11 @@
 	Replacement: pages of {name}	Zamenjava: strani datoteke {name}
 	Replaces the existing one on those pages.	Nadomesti obstoječe na teh straneh.
 	Checking pages…	Preverjanje strani…
-	This page paints its own white backdrop, which would hide the background. Replace it	Ta stran ima lastno belo polnilo, ki bi skrilo ozadje. Zamenjaj
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Strani z lastnim belim polnilom, ki bi skrilo ozadje: {n}. Zamenjaj
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Stran z lastnim belim polnilom, ki bi skrilo ozadje: {pages}. Zamenjaj
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Strani z lastnim belim polnilom, ki bi skrilo ozadje: {pages}. Zamenjaj
 	Removing the background puts the page's own backdrop back.	Odstranitev ozadja povrne lastno belo polnilo strani.
-	A picture covers this page (a scan?), so the background won't show there.	To stran prekriva slika (skeniranje?), zato ozadje tam ne bo vidno.
-	A picture covers {n} pages (scans?), so the background won't show there.	Strani, ki jih prekrivajo slike (skeniranja?): {n}; ozadje tam ne bo vidno.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Stran, ki jo prekriva slika (skeniranje?): {pages}; ozadje tam ne bo vidno.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Strani, ki jih prekrivajo slike (skeniranja?): {pages}; ozadje tam ne bo vidno.
 	Replacing images arrives on the web with image file pickers	Zamenjava slik bo v spletni različici na voljo z izbirniki slikovnih datotek
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Zamenjava slik na strani {p} bo v spletni različici na voljo z izbirniki slik ({i})
 	Reply	Odgovori
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index c2fb7fd029..e0b8e0e726 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -1476,11 +1476,11 @@
 	Replacement: pages of {name}	Zëvendësimi: faqet e {name}
 	Replaces the existing one on those pages.	Zëvendëson atë ekzistues në ato faqe.
 	Checking pages…	Po kontrollohen faqet…
-	This page paints its own white backdrop, which would hide the background. Replace it	Kjo faqe ka mbushjen e vet të bardhë, e cila do ta fshihte sfondin. Zëvendësoje
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} faqe kanë mbushjen e tyre të bardhë, e cila do ta fshihte sfondin. Zëvendësoje
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Faqja {pages} ka mbushjen e vet të bardhë, e cila do ta fshihte sfondin. Zëvendësoje
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Faqet {pages} kanë mbushjen e tyre të bardhë, e cila do ta fshihte sfondin. Zëvendësoje
 	Removing the background puts the page's own backdrop back.	Heqja e sfondit e rikthen mbushjen e bardhë të faqes.
-	A picture covers this page (a scan?), so the background won't show there.	Një imazh e mbulon këtë faqe (skanim?), prandaj sfondi nuk do të duket aty.
-	A picture covers {n} pages (scans?), so the background won't show there.	Imazhe mbulojnë {n} faqe (skanime?), prandaj sfondi nuk do të duket aty.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Një imazh e mbulon faqen {pages} (skanim?), prandaj sfondi nuk do të duket aty.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Imazhe mbulojnë faqet {pages} (skanime?), prandaj sfondi nuk do të duket aty.
 	Replacing images arrives on the web with image file pickers	Zëvendësimi i imazheve vjen në ueb me zgjedhësit e skedarëve të imazhit
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Zëvendësimi i imazheve në faqen {p} vjen në ueb me zgjedhësit e imazhit ({i})
 	Reply	Përgjigju
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 0d745bbd97..adaefdbedf 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -831,11 +831,11 @@ comment menu	Edit	సవరించు
 	Applies to {n} pages	{n} పేజీలకు వర్తిస్తుంది
 	Replaces the existing one on those pages.	ఆ పేజీలలో ఇప్పటికే ఉన్నదాన్ని భర్తీ చేస్తుంది.
 	Checking pages…	పేజీలను తనిఖీ చేస్తోంది…
-	This page paints its own white backdrop, which would hide the background. Replace it	ఈ పేజీకి సొంత తెల్లని నింపు ఉంది, అది నేపథ్యాన్ని దాచేస్తుంది. భర్తీ చేయండి
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} పేజీలకు సొంత తెల్లని నింపు ఉంది, అది నేపథ్యాన్ని దాచేస్తుంది. భర్తీ చేయండి
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	పేజీ {pages}కి సొంత తెల్లని నింపు ఉంది, అది నేపథ్యాన్ని దాచేస్తుంది. భర్తీ చేయండి
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	పేజీలు {pages}కి సొంత తెల్లని నింపు ఉంది, అది నేపథ్యాన్ని దాచేస్తుంది. భర్తీ చేయండి
 	Removing the background puts the page's own backdrop back.	నేపథ్యాన్ని తీసివేస్తే పేజీ సొంత తెల్లని నింపు తిరిగి వస్తుంది.
-	A picture covers this page (a scan?), so the background won't show there.	ఈ పేజీని ఒక చిత్రం కప్పుతోంది (స్కాన్?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
-	A picture covers {n} pages (scans?), so the background won't show there.	{n} పేజీలను చిత్రాలు కప్పుతున్నాయి (స్కాన్‌లు?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
+	A picture covers page {pages} (a scan?), so the background won't show there.	పేజీ {pages}ని ఒక చిత్రం కప్పుతోంది (స్కాన్?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	పేజీలు {pages}ని చిత్రాలు కప్పుతున్నాయి (స్కాన్‌లు?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
 	PDF or image	PDF లేదా చిత్రం
 	No file chosen	ఫైల్ ఏదీ ఎంచుకోలేదు
 	Page number	పేజీ సంఖ్య
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index aaaaff4858..2740313342 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -810,11 +810,11 @@
 	Applies to {n} pages	มีผลกับ {n} หน้า
 	Replaces the existing one on those pages.	แทนที่ของเดิมในหน้าเหล่านั้น
 	Checking pages…	กำลังตรวจสอบหน้า…
-	This page paints its own white backdrop, which would hide the background. Replace it	หน้านี้มีพื้นสีขาวของตัวเองซึ่งจะบังพื้นหลัง แทนที่
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} หน้ามีพื้นสีขาวของตัวเองซึ่งจะบังพื้นหลัง แทนที่
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	หน้า {pages} มีพื้นสีขาวของตัวเองซึ่งจะบังพื้นหลัง แทนที่
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	หน้า {pages} มีพื้นสีขาวของตัวเองซึ่งจะบังพื้นหลัง แทนที่ทั้งหมด
 	Removing the background puts the page's own backdrop back.	การเอาพื้นหลังออกจะคืนพื้นสีขาวเดิมของหน้า
-	A picture covers this page (a scan?), so the background won't show there.	มีรูปภาพปิดหน้านี้อยู่ (ภาพสแกน?) จึงจะมองไม่เห็นพื้นหลังที่นั่น
-	A picture covers {n} pages (scans?), so the background won't show there.	มีรูปภาพปิด {n} หน้าอยู่ (ภาพสแกน?) จึงจะมองไม่เห็นพื้นหลังที่นั่น
+	A picture covers page {pages} (a scan?), so the background won't show there.	มีรูปภาพปิดหน้า {pages} อยู่ (ภาพสแกน?) จึงจะมองไม่เห็นพื้นหลังที่นั่น
+	Pictures cover pages {pages} (scans?), so the background won't show there.	มีรูปภาพหลายรูปปิดหน้า {pages} อยู่ (ภาพสแกน?) จึงจะมองไม่เห็นพื้นหลังที่นั่น
 	PDF or image	PDF หรือรูปภาพ
 	No file chosen	ยังไม่ได้เลือกไฟล์
 	Page number	เลขหน้า
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index 53fb666bb5..a31216ca53 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -812,11 +812,11 @@
 	Applies to {n} pages	{n} sayfaya uygulanır
 	Replaces the existing one on those pages.	Bu sayfalardaki mevcut olanın yerini alır.
 	Checking pages…	Sayfalar denetleniyor…
-	This page paints its own white backdrop, which would hide the background. Replace it	Bu sayfanın arka planı gizleyecek kendi beyaz dolgusu var. Değiştir
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} sayfanın arka planı gizleyecek kendi beyaz dolgusu var. Değiştir
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Arka planı gizleyecek kendi beyaz dolgusu olan sayfa: {pages}. Değiştir
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Arka planı gizleyecek kendi beyaz dolgusu olan sayfalar: {pages}. Değiştir
 	Removing the background puts the page's own backdrop back.	Arka planı kaldırmak, sayfanın kendi beyaz dolgusunu geri getirir.
-	A picture covers this page (a scan?), so the background won't show there.	Bu sayfayı bir resim kaplıyor (tarama mı?), bu yüzden arka plan orada görünmez.
-	A picture covers {n} pages (scans?), so the background won't show there.	{n} sayfayı resimler kaplıyor (tarama mı?), bu yüzden arka plan orada görünmez.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Resimle kaplı sayfa (tarama mı?): {pages}; arka plan orada görünmez.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Resimlerle kaplı sayfalar (tarama mı?): {pages}; arka plan orada görünmez.
 	PDF or image	PDF veya resim
 	No file chosen	Dosya seçilmedi
 	Page number	Sayfa numarası
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 3672b982dd..c1f294dfd1 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -855,11 +855,11 @@
 	Applies to {n} pages	Застосовується до {n} сторінок
 	Replaces the existing one on those pages.	Замінює наявний елемент на цих сторінках.
 	Checking pages…	Перевірка сторінок…
-	This page paints its own white backdrop, which would hide the background. Replace it	Ця сторінка має власну білу заливку, яка приховає тло. Замінити
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Сторінки з власною білою заливкою, яка приховає тло: {n}. Замінити
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Сторінка з власною білою заливкою, яка приховає тло: {pages}. Замінити
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Сторінки з власною білою заливкою, яка приховає тло: {pages}. Замінити
 	Removing the background puts the page's own backdrop back.	Вилучення тла повертає власну білу заливку сторінки.
-	A picture covers this page (a scan?), so the background won't show there.	Цю сторінку закриває зображення (скан?), тому тло там не буде видно.
-	A picture covers {n} pages (scans?), so the background won't show there.	Сторінки, закриті зображеннями (скани?): {n}; тло там не буде видно.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Сторінка, закрита зображенням (скан?): {pages}; тло там не буде видно.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Сторінки, закриті зображеннями (скани?): {pages}; тло там не буде видно.
 	PDF or image	PDF або зображення
 	No file chosen	Файл не вибрано
 	Page number	Номер сторінки
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 5d300e8aef..526fbac0b1 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -991,11 +991,11 @@ theme	Appearance	Giao diện
 	Replacement: pages of {name}	Thay thế: các trang của {name}
 	Replaces the existing one on those pages.	Thay thế cái hiện có trên các trang đó.
 	Checking pages…	Đang kiểm tra các trang…
-	This page paints its own white backdrop, which would hide the background. Replace it	Trang này có lớp tô trắng riêng, sẽ che mất nền. Thay thế
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} trang có lớp tô trắng riêng, sẽ che mất nền. Thay thế
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Trang {pages} có lớp tô trắng riêng, sẽ che mất nền. Thay thế
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Các trang {pages} có lớp tô trắng riêng, sẽ che mất nền. Thay thế
 	Removing the background puts the page's own backdrop back.	Gỡ nền sẽ khôi phục lớp tô trắng riêng của trang.
-	A picture covers this page (a scan?), so the background won't show there.	Một hình ảnh phủ kín trang này (bản quét?), nên nền sẽ không hiện ở đó.
-	A picture covers {n} pages (scans?), so the background won't show there.	Hình ảnh phủ kín {n} trang (bản quét?), nên nền sẽ không hiện ở đó.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Một hình ảnh phủ kín trang {pages} (bản quét?), nên nền sẽ không hiện ở đó.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Hình ảnh phủ kín các trang {pages} (bản quét?), nên nền sẽ không hiện ở đó.
 	Report	Báo cáo
 	Report…	Báo cáo…
 	Requires user to enter a password for:	Yêu cầu người dùng nhập mật khẩu cho:
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index f07073c1b3..0055556061 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -535,11 +535,11 @@
 	Applies to {n} pages	应用于 {n} 页
 	Replaces the existing one on those pages.	替换这些页面上的现有内容。
 	Checking pages…	正在检查页面…
-	This page paints its own white backdrop, which would hide the background. Replace it	此页面有自己的白色填充，会遮住背景。替换它
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} 个页面有自己的白色填充，会遮住背景。替换它
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	第 {pages} 页有自己的白色填充，会遮住背景。替换它
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	第 {pages} 页各有自己的白色填充，会遮住背景。替换它们
 	Removing the background puts the page's own backdrop back.	移除背景后，页面自己的白色填充会恢复。
-	A picture covers this page (a scan?), so the background won't show there.	此页面被一张图片覆盖（扫描件？），因此那里不会显示背景。
-	A picture covers {n} pages (scans?), so the background won't show there.	{n} 个页面被图片覆盖（扫描件？），因此那里不会显示背景。
+	A picture covers page {pages} (a scan?), so the background won't show there.	第 {pages} 页被一张图片覆盖（扫描件？），因此那里不会显示背景。
+	Pictures cover pages {pages} (scans?), so the background won't show there.	第 {pages} 页被图片覆盖（扫描件？），因此那里不会显示背景。
 	PDF or image	PDF 或图像
 	No file chosen	未选择文件
 	Page number	页码
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index b988a5d8b3..bb42c169a6 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -487,11 +487,11 @@
 	Applies to {n} pages	套用於 {n} 頁
 	Replaces the existing one on those pages.	替換這些頁面上的現有內容。
 	Checking pages…	正在檢查頁面…
-	This page paints its own white backdrop, which would hide the background. Replace it	此頁面有自己的白色填色，會遮住背景。取代它
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} 個頁面有自己的白色填色，會遮住背景。取代它
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	第 {pages} 頁有自己的白色填色，會遮住背景。取代它
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	第 {pages} 頁各有自己的白色填色，會遮住背景。取代它們
 	Removing the background puts the page's own backdrop back.	移除背景後，頁面自己的白色填色會恢復。
-	A picture covers this page (a scan?), so the background won't show there.	此頁面被一張圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
-	A picture covers {n} pages (scans?), so the background won't show there.	{n} 個頁面被圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
+	A picture covers page {pages} (a scan?), so the background won't show there.	第 {pages} 頁被一張圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
+	Pictures cover pages {pages} (scans?), so the background won't show there.	第 {pages} 頁被圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
 	PDF or image	PDF 或圖片
 	No file chosen	未選擇檔案
 	Page number	頁碼
diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index 8a445544be..2cf2450336 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -85,18 +85,18 @@ pub struct BackdropCheck {
 }
 
 /// What the check found among the pages a background goes on.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct BackdropCount {
-    /// Pages with a white backdrop that can be replaced.
-    pub fills: usize,
-    /// Pages covered by a picture (scans): the background stays hidden there.
-    pub images: usize,
+    /// Pages (0-based, ascending) with a white backdrop that can be replaced.
+    pub fills: Vec<usize>,
+    /// Pages (0-based, ascending) covered by a picture (scans): the background stays hidden there.
+    pub images: Vec<usize>,
     /// Pages not checked yet.
     pub pending: usize,
 }
 
 impl BackdropCheck {
-    /// Check up to [`BACKDROP_PAGES_PER_FRAME`] more of `pages` (0-based) and count them.
+    /// Check up to [`BACKDROP_PAGES_PER_FRAME`] more of `pages` (0-based) and sort them.
     pub fn update(&mut self, doc: &pdfcraft_engine::Document, pages: &[usize]) -> BackdropCount {
         let key = (doc.id, doc.edit_generation());
         let count = doc.info.pages.len();
@@ -126,11 +126,15 @@ impl BackdropCheck {
             let Some(slot) = self.pages.get(p) else { continue };
             match slot {
                 None => n.pending += 1,
-                Some(Some(Backdrop::Fill)) => n.fills += 1,
-                Some(Some(Backdrop::Image)) => n.images += 1,
+                Some(Some(Backdrop::Fill)) => n.fills.push(p),
+                Some(Some(Backdrop::Image)) => n.images.push(p),
                 Some(None) => {}
             }
         }
+        for list in [&mut n.fills, &mut n.images] {
+            list.sort_unstable();
+            list.dedup();
+        }
         n
     }
 }
@@ -147,9 +151,21 @@ impl MarksDraft {
     }
 }
 
-/// "1 page" or "{n} pages", in a message.
-fn pages_phrase(n: usize, one: &str, many: &str) -> String {
-    if n == 1 { one.to_string() } else { crate::i18n::fmt(many, &[("n", &n.to_string())]) }
+/// How many runs of pages a message lists before it stops with "…".
+const LISTED_PAGE_RUNS: usize = 8;
+
+/// `one` or `many` with `{pages}` replaced by `pages` (0-based, ascending) as 1-based runs
+/// ("1-3, 6"), so the message says which pages it means.
+fn pages_phrase(pages: &[usize], one: &str, many: &str) -> String {
+    // `count` 0 never matches a list that isn't empty, so the list is always written out.
+    let runs = crate::combine_ui::range_of(pages, 0);
+    let mut parts: Vec<&str> = runs.split(", ").take(LISTED_PAGE_RUNS + 1).collect();
+    if parts.len() > LISTED_PAGE_RUNS {
+        parts.truncate(LISTED_PAGE_RUNS);
+        parts.push("…");
+    }
+    let template = if pages.len() == 1 { one } else { many };
+    crate::i18n::fmt(template, &[("pages", &parts.join(", "))])
 }
 
 #[derive(Clone, Debug, PartialEq)]
@@ -599,22 +615,22 @@ fn backdrop_options(ui: &mut egui::Ui, t: &Tokens, d: &mut MarksDraft, doc: &pdf
         ui.label(egui::RichText::new(tl!("Checking pages…")).small().color(t.text_faint));
         ui.ctx().request_repaint();
     }
-    if n.fills > 0 {
+    if !n.fills.is_empty() {
         ui.add_space(4.0);
         let label = pages_phrase(
-            n.fills,
-            tl!("This page paints its own white backdrop, which would hide the background. Replace it"),
-            tl!("{n} pages paint their own white backdrop, which would hide the background. Replace it"),
+            &n.fills,
+            tl!("Page {pages} paints its own white backdrop, which would hide the background. Replace it"),
+            tl!("Pages {pages} paint their own white backdrop, which would hide the background. Replace it"),
         );
         ui.add(widgets::checkbox(&mut d.bg.replace_backdrop, &label));
         ui.label(egui::RichText::new(tl!("Removing the background puts the page's own backdrop back.")).small().color(t.text_faint));
     }
-    if n.images > 0 {
+    if !n.images.is_empty() {
         ui.add_space(4.0);
         let text = pages_phrase(
-            n.images,
-            tl!("A picture covers this page (a scan?), so the background won't show there."),
-            tl!("A picture covers {n} pages (scans?), so the background won't show there."),
+            &n.images,
+            tl!("A picture covers page {pages} (a scan?), so the background won't show there."),
+            tl!("Pictures cover pages {pages} (scans?), so the background won't show there."),
         );
         ui.label(egui::RichText::new(text).small().color(crate::content_ui::UNDRAWABLE));
     }
@@ -654,6 +670,18 @@ mod tests {
         assert_eq!(undrawable(MarkKind::Background, &d), None);
     }
 
+    #[test]
+    fn backdrop_messages_name_their_pages() {
+        let phrase = |pages: &[usize]| pages_phrase(pages, "Page {pages}", "Pages {pages}");
+        assert_eq!(phrase(&[2]), "Page 3");
+        assert_eq!(phrase(&[0, 1, 2, 5]), "Pages 1-3, 6");
+        assert_eq!(phrase(&[0, 1]), "Pages 1-2", "a whole document is still listed");
+        let every_other: Vec<usize> = (0..40).step_by(2).collect();
+        assert_eq!(phrase(&every_other), "Pages 1, 3, 5, 7, 9, 11, 13, 15, …", "a long list stops");
+        let runs: Vec<usize> = (0..LISTED_PAGE_RUNS * 2).step_by(2).collect();
+        assert_eq!(phrase(&runs), "Pages 1, 3, 5, 7, 9, 11, 13, 15", "exactly the limit: no …");
+    }
+
     #[test]
     fn page_ranges_with_subsets() {
         let r = PageRange::default();
diff --git a/crates/ui-egui/tests/it/marks.rs b/crates/ui-egui/tests/it/marks.rs
index 9887589119..8edc9e3ce6 100644
--- a/crates/ui-egui/tests/it/marks.rs
+++ b/crates/ui-egui/tests/it/marks.rs
@@ -179,8 +179,8 @@ fn the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scan
     assert_eq!(backdrop(&h, 0), Some(pdfcraft_engine::Backdrop::Fill));
     h.state_mut().execute("edit.background");
     h.run_steps(3);
-    let replace = "This page paints its own white backdrop, which would hide the background. Replace it";
-    h.get_by_label("A picture covers this page (a scan?), so the background won't show there.");
+    let replace = "Page 1 paints its own white backdrop, which would hide the background. Replace it";
+    h.get_by_label("A picture covers page 2 (a scan?), so the background won't show there.");
     assert!(h.state().marks_draft.bg.replace_backdrop, "on by default");
     // Left unticked, the backdrop stays and still hides the background.
     h.get_by_label(replace).click();

From b4fcf2009e35137a4c855bd81826a0c58b97b8ca Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Fri, 23 Oct 2026 20:43:55 +0200
Subject: [PATCH 057/270] fix(assets): refresh the catalogue hashes for the
 page-naming messages

c7715a09 rewrote the Add Background strings in all 33 catalogues; their
SHA-256 entries in ATTRIBUTION.toml still named the old files, which
the_real_manifest_passes rejects. Provenance is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ATTRIBUTION.toml | 66 ++++++++++++++++++++++++------------------------
 1 file changed, 33 insertions(+), 33 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index e3063a82ed..aa35ebee0b 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -7,7 +7,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Greek UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "746ab724111dc0538cb5821aaa12a27b278fd4fa2a3565c37fd9172f8a3a2465"
+sha256 = "c5692e17e4dba75cda1e082aa35dcc6ab552861c614eb98e7aef5d021737a14b"
 
 # ATTRIBUTION.toml: one entry per asset (AGENTS.md §1). The source of truth for provenance and licences.
 # ATTRIBUTION.md is generated from this file: `cargo xtask assets --write`. Checked by `cargo xtask assets` (part of `xtask ci`).
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "4ec959260c8dc24b26b150008119061896796cb849e15ef8f85ef2950ab7ca6f"
+sha256 = "e5787d93660ce25ca8ba5055d601f0c132b905cb726d0523b370c44c52928129"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "faac9e5e31340425a5e110ff0b3c54bdae8dec2842e69c827bad8b5291d8a2ce"
+sha256 = "ba079e3ead466d611171e98986b689473c7645146435f13710d9ed0190f1860a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "58180ff4dbc8482d3dcbba356f9024be094b49e2fe9732b0aec575d72a0c4bf9"
+sha256 = "77a1171f3a88d0ecd6313a5b642463ec4d4f879fef41fe155c640a8f32317f91"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "3e4b99a9a565fdb96f497e4bcbe93189effcd50a04cc26fafa8715c8702d6333"
+sha256 = "95a201a467b7cc0c458b12374f328f99819b5eb56a498cb4cf1cf2e786988779"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "ef9df3df27f9de594da1cecc0e33914f86a4a1af6492af27ebd3f6895bf05489"
+sha256 = "587f3b492901e4f8b6c86feb6a7d9ab32bb3b705500c4acffc97ffe41e993f9e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2456ba17cf6cb3a15210b6492d30a0057b7f518eee72dab3833bc77d8477d56e"
+sha256 = "ca614672786c2ba2e77f23cfe9086fc37ccbc046025ba4112f8c2fc970f123e9"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8f3a4e543ac8c54adcb5f16f89749f3d835e2ad7b9554f6edc22572b3a923a4d"
+sha256 = "1caa7048aee0fe8f0072890bff5abb2492e092221ab5d5a0693a397c6b92a583"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/lo.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Lao UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "44a7d31238fbbede2ac5b2f33b1f77b9d8916a4e4af9a03a4bec863338987af0"
+sha256 = "7cf8d8389296cbc1403b581c5988af649f795f2561b08651925bb0a8d08ee399"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8403d18d064ce676bd1ac7609956b15062aadeebc0bb262cad8103a0d6e4a43c"
+sha256 = "39b3af8c1c46d3344694505e7c36afa6f67032fff96530d363707e42bba0510b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/it.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Italian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e9e0abfa57671c41875adffef7eaf8d8e6b15ffc8ffbd8385dafa3db1d89abe2"
+sha256 = "e4baa759322a6d40689cea9782d518bbad5268a74b5c7d9b41741d9d9c44fd92"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pl.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Polish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "0f3232031495a5c2b6f450b235198c22567cc79a9c8d573c32c25e5d83face72"
+sha256 = "548bd98cc3c62b5e3861c14039668c79b3dec7c055a879591afad4b279e94d4d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e4bef8e7bf98d78151df2db59abfba5e1a955b248e5dfd5402aef12c24731108"
+sha256 = "ad35fe52dc926e11ef49ad82d92a42853a6c94e5724ec426c8ab8cc55609bc31"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -162,7 +162,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b0962e829fc149cf18cd84fecdf787bf6f3b5ce0f97e61fcdfe4a0321512f6e6"
+sha256 = "d324d91664e1846bd05aa433763f0fd16acbb815479b0e7a520e187de885232e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -173,7 +173,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "1df8919d17ba42a1768a04e2b11558f47be23c63756473cafa1cc7dd3aaf7564"
+sha256 = "3363b19abe2bb38956799b8451d381e0778a3a835c92ff8c1140c1274c7b259b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/kk.tsv"
@@ -184,7 +184,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Kazakh UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e6870037279668a53cde6d1a7eae8d61c1002990d122e1d390e1057f13316200"
+sha256 = "b3307ea848e8f1676f8b95a0cb0cb0a68cf2762b8eca59ebb80cc7780a1cc364"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -195,7 +195,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "cf84bfcfe361a3d5133b5de7cfd788f1f4c2b5a1969d9aefe6ec3e5749372123"
+sha256 = "2f01d6fe013487a5baed976d7f98cf89d60755dd00bba53dd42c79848f2b781b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -206,7 +206,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d25bc5760f1a4ca6f50712f242d7a7989351d42019af761db83ec702605c1d16"
+sha256 = "b2eafb2fbef3153b2b06a612605ddb7d3e6c9c66422f05147a1be5cb9ce652f6"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ar.tsv"
@@ -217,7 +217,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Arabic UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "9b89aa34aaafa8ce0a9e1e98e9be7dc69835b38101c315ce8f7c7ebcf7f96b83"
+sha256 = "c1afb46d732705d96d4b1ed2c375faf8102001a60ae48607dd8b605078994aa8"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ckb.tsv"
@@ -228,7 +228,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Central Kurdish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "62981ff0ce56a46fbd5a11ef65c7a0a6898fd9ca9cd9a424daf48e059cd42bd3"
+sha256 = "7fee1bb00cd7f4ab3366bc2190cee18edf1f6708a270dcdaa467c73feb0ce22c"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/tr.tsv"
@@ -239,7 +239,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Turkish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "27eacc541e08224ce5f52c90541cc8374c8c31c72746c6f32c9052fb5588d44a"
+sha256 = "0ec370727a8c4e4623f7ce35cd69612eb0a8a2b88acbdc931b94a999addf2d8b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/lt.tsv"
@@ -250,7 +250,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Lithuanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "cbdc4c994fb652b9081aa2ebfc06a7e4a18f0838f6af68b2d68d278c74d404df"
+sha256 = "ebce98f72db3b90ba8860982126d4492d61d0a2c8bcf1c45da21a5546bc2f076"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hi.tsv"
@@ -261,7 +261,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hindi UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "475a0094dd78dcdf74a8b30260765ea9695591b9d90d84a7e5736cbe24c82a21"
+sha256 = "c128079b905b2d48c923e437fc1d1a4864a49c18d074446bc0845d6590bb462e"
 [[asset]]
 path = "crates/ui-egui/src/i18n/id.tsv"
 title = "Indonesian interface translation catalog"
@@ -271,7 +271,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Indonesian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f6a513a55e97df333b258decf5f9d28b42cb28a0533fd85234d5c12c4bb77d4a"
+sha256 = "51d7e93a72f58dacfa3027f5f8bbeaee988787ea6497cd38cfd4282a359a4517"
 [[asset]]
 path = "crates/ui-egui/src/i18n/ko.tsv"
 title = "Korean interface translation catalog"
@@ -281,7 +281,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Korean UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "def6155d2bdc7ff2a384330e65428d4352d3122a145113e6bd54282a1bd9b64f"
+sha256 = "78499f116a6929187477c82bd42767cfb150d16f76c94df4758f6b5ae82b17be"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ro.tsv"
@@ -292,7 +292,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Romanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "524d37d0ffb574189e6b2316e78342bc31a206749e5db8b218f5dd588f8c2906"
+sha256 = "6a6d0999907a755ceeab5e66893381c57dd6252dd83049ee0eacb0f07a23e044"
 
 
 [[asset]]
@@ -304,7 +304,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Finnish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "7dbd6269e82cfbfc002c236d4cb4252bfc879ef04466f8226ae630b66d1eec07"
+sha256 = "c23be7138d1d1258f95739d097759d6b633bac65d4fe619c1ef81c92b035938e"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
@@ -3426,7 +3426,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Vietnamese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "ccc96b3b0e5cf14e88c20312e05dbbb4b08271b6bf40d932f9e5c9b81f8e0d7e"
+sha256 = "7893330225e617c2debb63a2bbaa47d85befe207833a150ec7e9c1dda9ed8fdc"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/sl.tsv"
@@ -3437,7 +3437,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Slovene UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "58590297c84a7b606f45e92b3ae0ad1ded5eef528898c02436515f8dc8e317ff"
+sha256 = "4fb04ace2319ed505779c3a0d8e63b07f886ba6414ea065dfa98ca6f46f71757"
 
 [[asset]]
 
@@ -3460,7 +3460,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Norwegian Bokmål UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "3acc16cae1c2ec53da247086cc05ec67cc349bafdffd2a18738e2d2ccc0da68d"
+sha256 = "bd27598a0cdd37331ff31b63a2974392c3ed61144da1cc9cdbc5b1acd11900d1"
 
 [[asset]]
 path = "assets/icons/superscript.svg"
@@ -3515,7 +3515,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Albanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "5bf431406a85508f86114d6c2da9e9a0a06ee5bd262c144d4575312608f2a860"
+sha256 = "7e0f5a65b7f3d4a0b79b3f27d26e52f85f0dd21bf1fb47b824d22ef3e80395f4"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/th.tsv"
@@ -3526,7 +3526,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Thai UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "00db9fa3069b3dbaf42c3e7464b36c5c5cd4a636fdb26da843cdf3fa1f50cb3e"
+sha256 = "0a448b5ae556fb575c1183d169a46a19d4339060315665e992403eac9fb48c6e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ca.tsv"
@@ -3537,4 +3537,4 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Catalan UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "712221c2439f61e3eca0932d17b144cae4a50c1c87b48225bf2496edf91be784"
+sha256 = "38188d69f1af9badfb5c1c0e988854b9da546b76de850c9ecb5f759759013ecb"

From 30438bf595904d7d39b22986dc364943d89b9040 Mon Sep 17 00:00:00 2001
From: srt8hellcat2-ui <srt8hellcat2@gmail.com>
Date: Fri, 23 Oct 2026 16:23:04 -0400
Subject: [PATCH 058/270] Format the nested batch the way rustfmt wants

---
 crates/engine/src/tests.rs | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 6b64952e13..624079ca44 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -545,10 +545,7 @@ fn saving_after_a_batch_that_deletes_pages_rewrites_the_file() {
     let batch = Edit::Batch {
         label: "Delete and rotate".into(),
         edits: vec![
-            Edit::Batch {
-                label: "Delete pages".into(),
-                edits: vec![Edit::DeletePages { pages: vec![1, 2, 3, 4] }],
-            },
+            Edit::Batch { label: "Delete pages".into(), edits: vec![Edit::DeletePages { pages: vec![1, 2, 3, 4] }] },
             Edit::RotatePages { pages: vec![0], degrees: 90 },
         ],
     };

From 3485e92a95de7865077857deafb20bc590a17a1c Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Fri, 23 Oct 2026 23:58:42 +0200
Subject: [PATCH 059/270] fix(edit): backdrop copies keep no reference that
 outlives a redaction

The tag on a page's backdrop copy, `/PCBackdrop << /Original ref /At /Len >>`, kept the
page's original content stream reachable. After Add background, then Redact (or Remove
Hidden Information, or Edit text) and a full save, the text taken off the page was still in
the file, in the original stream the tag pointed at. Text extraction didn't show it; reading
the file's bytes did. Restore also gave up after any edit, so the fill stayed off without a
word.

The tag is now `/PCBackdrop << /Index n /Op (f) /Before <SHA-256> /Was [num gen] >>`: how many
of the copy's operators come before the `n`, the fill it stands in for, a hash of those
operators by value (redaction writes the stream out again with other spacing), and the
original's number as two integers, which keep nothing alive.

Remove background turns the fill back on in the copy when the operators before it still
hash the same and a scan with the fill restored finds it painted first, covering the page.
Edits and redactions after the fill are kept. When the original stream is still there with
the same bytes, the page points at it again. Otherwise the copy stays as it is, and
Remove background says which pages keep their own backdrop off: `EditNotice::BackdropsLeftOff`
(engine), a toast in the app, `warnings` from `doc_remove_marks`. `edit_notices` holds
`EditNotice` now, with the undrawn-text notice as one of its kinds. The two new UI strings
are in all 33 catalogues.

`sha2` (already in the lock file) becomes a dependency of `pdfcraft-edit`.

Tests, each seen failing with its piece of the fix reverted:
- `the_tag_holds_no_reference_and_a_full_save_keeps_no_second_copy_of_the_page` and
  `removed_text_leaves_the_file_when_a_background_replaced_the_pages_backdrop` (automation,
  redaction and Remove Hidden Information through a full save): fail with `/Original` back.
- `a_fill_that_would_cover_content_painted_before_it_stays_off`: fails without the re-scan.
- `a_copy_written_out_again_with_other_spacing_still_comes_back` and the automation test:
  fail when the raw bytes are hashed instead of the operators.
- `an_edit_after_the_fill_is_kept_and_the_backdrop_still_comes_back`: fails under the old
  rule (only an unchanged copy comes back).
- `remove_background_names_the_pages_whose_own_backdrop_stays_off` (engine),
  `remove_background_warns_about_pages_whose_own_backdrop_stays_off` (automation),
  `remove_background_says_which_pages_keep_their_own_backdrop_off` (UI): fail without the
  notice.
- `a_change_before_the_fill_leaves_it_off_and_names_the_page`,
  `a_tag_that_does_not_add_up_is_left_alone` (hostile and old-format tags, never a panic),
  `operators_hash_by_value_not_by_spelling`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                             |   1 +
 ROADMAP.md                             |   2 +-
 crates/automation/src/tools.rs         |   2 +-
 crates/automation/tests/it/backdrop.rs | 117 ++++++++++-
 crates/edit/Cargo.toml                 |   2 +
 crates/edit/src/backdrop.rs            | 270 ++++++++++++++++++++-----
 crates/edit/src/backdrop_tests.rs      | 167 ++++++++++++++-
 crates/edit/src/lib.rs                 |   8 +-
 crates/engine/src/lib.rs               |  59 +++++-
 crates/engine/src/tests.rs             |  65 +++++-
 crates/ui-egui/src/editing.rs          |  10 +-
 crates/ui-egui/src/i18n/ar.tsv         |   2 +
 crates/ui-egui/src/i18n/bg.tsv         |   2 +
 crates/ui-egui/src/i18n/ca.tsv         |   2 +
 crates/ui-egui/src/i18n/ckb.tsv        |   2 +
 crates/ui-egui/src/i18n/cs.tsv         |   2 +
 crates/ui-egui/src/i18n/de.tsv         |   2 +
 crates/ui-egui/src/i18n/el.tsv         |   2 +
 crates/ui-egui/src/i18n/es.tsv         |   2 +
 crates/ui-egui/src/i18n/fi.tsv         |   2 +
 crates/ui-egui/src/i18n/fr.tsv         |   2 +
 crates/ui-egui/src/i18n/hi.tsv         |   2 +
 crates/ui-egui/src/i18n/hu.tsv         |   2 +
 crates/ui-egui/src/i18n/id.tsv         |   2 +
 crates/ui-egui/src/i18n/it.tsv         |   2 +
 crates/ui-egui/src/i18n/ja.tsv         |   2 +
 crates/ui-egui/src/i18n/kk.tsv         |   2 +
 crates/ui-egui/src/i18n/ko.tsv         |   2 +
 crates/ui-egui/src/i18n/lo.tsv         |   2 +
 crates/ui-egui/src/i18n/lt.tsv         |   2 +
 crates/ui-egui/src/i18n/nb.tsv         |   2 +
 crates/ui-egui/src/i18n/pl.tsv         |   2 +
 crates/ui-egui/src/i18n/pt-br.tsv      |   2 +
 crates/ui-egui/src/i18n/ro.tsv         |   2 +
 crates/ui-egui/src/i18n/ru.tsv         |   2 +
 crates/ui-egui/src/i18n/sl.tsv         |   2 +
 crates/ui-egui/src/i18n/sq.tsv         |   2 +
 crates/ui-egui/src/i18n/te.tsv         |   2 +
 crates/ui-egui/src/i18n/th.tsv         |   2 +
 crates/ui-egui/src/i18n/tr.tsv         |   2 +
 crates/ui-egui/src/i18n/uk.tsv         |   2 +
 crates/ui-egui/src/i18n/vi.tsv         |   2 +
 crates/ui-egui/src/i18n/zh-hans.tsv    |   2 +
 crates/ui-egui/src/i18n/zh-hant.tsv    |   2 +
 crates/ui-egui/src/marks_ui.rs         |  10 +
 crates/ui-egui/tests/it/marks.rs       |  33 +++
 parity/acrobat-features.toml           |   6 +-
 47 files changed, 739 insertions(+), 79 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 496eeab0a4..df78711ad1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4100,6 +4100,7 @@ dependencies = [
  "pdfcraft-cos",
  "pdfcraft-fonts",
  "pdfcraft-model",
+ "sha2 0.11.0",
  "thiserror 2.0.21",
  "unicode-bidi",
 ]
diff --git a/ROADMAP.md b/ROADMAP.md
index 89ce2dadbd..4fd2db9aae 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -265,7 +265,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-19 (M3, #3360):** Switching between Read and the docking workspace retains the current document’s scroll position at fixed zoom, including within-page position; separate tabs retain their own offsets. Estimates unchanged.
 - **2026-10-18 (M8, #1350):** Integrated current main while preserving content-stream comment boundaries. Hidden-text cleanup retires unused named replacement descriptions on rewritten pages and forms, including inherited/shared resource holders, without removing descriptions still used by surviving content. Synthetic saved-byte and preservation regressions cover the cleanup. Estimates unchanged.
 - **2026-10-17 (M4, #2997):** Dragging page thumbnails in the Organize grid with Ctrl held (Option on macOS) drops copies at the gap instead of moving the pages: a "+" badge sits by the pointer, the copies land at the gap selected, and one undo step ("Duplicate pages") takes them out again. `page_duplicate` takes `at` (1-based, where the first copy goes; left out, after the last of them) so agents can drive the same thing, and the UI control channel's `ui.drag` modifiers now reach gestures that read the input state. Estimates unchanged.
-- **2026-10-16 (M7, Add Background):** A background added behind a page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) was hidden completely, so the tool looked broken. The dialog now detects such pages and offers to replace the backdrop (on by default): the one fill becomes `n` in a per-page copy of its stream, and Remove background puts the original back unless the copy was edited since. Scanned pages are warned about, not touched. New `doc_backdrops` tool; `doc_background` takes `replace_backdrop`. The default colour is a visible light yellow and the preview shows text over it. Acrobat's own behaviour on such pages is unobserved. Estimates unchanged.
+- **2026-10-16 (M7, Add Background):** A background added behind a page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) was hidden completely, so the tool looked broken. The dialog now detects such pages and offers to replace the backdrop (on by default): the one fill becomes `n` in a per-page copy of its stream, and Remove background turns the fill back on, after edits and redactions too, unless the operators before it changed or it would no longer be painted first; then it says which pages keep it off. The copy's tag holds no reference to the original stream, which had kept text a redaction or Remove Hidden Information removed in the saved file. Scanned pages are warned about, not touched. New `doc_backdrops` tool; `doc_background` takes `replace_backdrop`. The default colour is a visible light yellow and the preview shows text over it. Acrobat's own behaviour on such pages is unobserved. Estimates unchanged.
 - **2026-10-15 (M6, AcroForm XML text):** Plain AcroForm XML imports retain all direct text around comments and processing instructions, including CDATA and character references. Synthetic regressions verify exact values and unknown catalog data after incremental and full save/reopen. Nested-element and XFA interpretation are unchanged. Estimates unchanged.
 - **2026-10-15 (M6, #1917 refresh):** Integrated upstream `99941daa` while retaining the XML/XFDF attribute whitespace correction and all upstream progress. Only independent documentation conflicts required resolution; focused production and test files are unchanged from the previously green CI head. Estimates unchanged.
 - **2026-10-15 (M1, #2267 refresh):** Integrated upstream `99941daa` while retaining the raw-deflate fallback correction and all upstream progress. Only independent documentation conflicts required resolution; focused production and test files are unchanged from the previously green CI head. Estimates unchanged.
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index f526ffc3d9..19153b1387 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -971,7 +971,7 @@ pub fn tools() -> Vec<ToolDef> {
                 }),
                 &["doc"],
             )),
-        t("doc_background", "Add background", "Fill page backgrounds with a colour, or a picture from `file` (an image, or page `file_page` of a PDF) fitted at `scale` (default 1), behind the content. A page that paints its own opaque white backdrop would hide it, so that backdrop is replaced unless replace_backdrop is false (removing the background puts it back); a scanned page's picture still hides it (doc_backdrops lists both). Undoable.")
+        t("doc_background", "Add background", "Fill page backgrounds with a colour, or a picture from `file` (an image, or page `file_page` of a PDF) fitted at `scale` (default 1), behind the content. A page that paints its own opaque white backdrop would hide it, so that backdrop is replaced unless replace_backdrop is false (removing the background turns it back on where that is still safe, and doc_remove_marks warns about the pages where it isn't); a scanned page's picture still hides it (doc_backdrops lists both). Undoable.")
             .cmd("edit.background")
             .with(schema(
                 json!({ "doc": doc(), "pages": pages("to fill (default: all)"), "color": { "type": "string" }, "file": { "type": "string" }, "file_page": { "type": "integer", "minimum": 1 }, "scale": { "type": "number", "exclusiveMinimum": 0, "maximum": 1 }, "opacity": { "type": "number", "minimum": 0, "maximum": 1 }, "replace": { "type": "boolean" }, "replace_backdrop": { "type": "boolean", "description": "Replace a white backdrop the page paints itself, which would hide the background. Default true." } }),
diff --git a/crates/automation/tests/it/backdrop.rs b/crates/automation/tests/it/backdrop.rs
index 1a8a71eb8e..2f7a002981 100644
--- a/crates/automation/tests/it/backdrop.rs
+++ b/crates/automation/tests/it/backdrop.rs
@@ -40,7 +40,12 @@ fn fixture() -> Vec<u8> {
 }
 
 fn workdir() -> PathBuf {
-    let dir = std::env::temp_dir().join(format!("pdfcraft-automation-backdrop-{}", std::process::id()));
+    named_workdir("main")
+}
+
+/// A folder of its own per test: the tests of this binary run at the same time.
+fn named_workdir(name: &str) -> PathBuf {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-automation-backdrop-{}-{name}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
     std::fs::write(dir.join("a.pdf"), fixture()).unwrap();
@@ -107,3 +112,113 @@ fn a_background_shows_on_a_page_that_paints_its_own_white_backdrop() {
     );
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// One 200 × 100 pt page on a white fill of its own: a line to redact, invisible (`3 Tr`) text
+/// that Remove Hidden Information removes, and a line that stays (`0 Tr` again: the render mode
+/// outlives `ET`). With `tag`, the content is a
+/// backdrop copy carrying that tag, under a background.
+fn secret_pdf(tag: Option<&str>) -> Vec<u8> {
+    let fill = if tag.is_some() { "n" } else { "f" };
+    let content = format!(
+        "1 1 1 rg 0 0 200 100 re {fill} 0 g BT /F1 12 Tf 10 70 Td (SECRET-LINE) Tj ET BT 3 Tr /F1 12 Tf 10 45 Td (HIDDEN-LINE) Tj ET BT 0 Tr /F1 12 Tf 10 20 Td (KEEP) Tj ET"
+    );
+    let bg = "q 1 0 0 rg 0 0 200 100 re f Q";
+    let (contents, extra) = match tag {
+        Some(t) => (
+            "[5 0 R 6 0 R]",
+            vec![
+                format!("<< /PCMark /Background /Length {} >>\nstream\n{bg}\nendstream", bg.len()),
+                format!("<< /PCBackdrop {t} /Length {} >>\nstream\n{content}\nendstream", content.len()),
+            ],
+        ),
+        None => ("[5 0 R]", vec![format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len())]),
+    };
+    let mut objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 100] >>".into(),
+        format!("<< /Type /Page /Parent 2 0 R /Contents {contents} /Resources << /Font << /F1 4 0 R >> >> >>"),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+    ];
+    objs.extend(extra);
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// Every stream of a saved file, decoded, joined: what anyone reading the file can recover.
+fn every_stream(path: &std::path::Path) -> String {
+    let doc = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(path).unwrap())).unwrap();
+    doc.scan_objects()
+        .filter_map(|(_, o)| match &*o {
+            pdfcraft_cos::Object::Stream(s) => Some(String::from_utf8_lossy(&s.decoded().unwrap_or_default()).into_owned()),
+            _ => None,
+        })
+        .collect::<Vec<_>>()
+        .join("\n")
+}
+
+/// Text a redaction or Remove Hidden Information took off a page whose backdrop a background
+/// replaced is gone from the saved file. The backdrop copy's tag used to keep a reference to the
+/// page's original content stream, and with it the removed text. Removing the background
+/// afterwards still turns the page's white fill back on.
+#[test]
+fn removed_text_leaves_the_file_when_a_background_replaced_the_pages_backdrop() {
+    for (remove, gone) in [
+        (vec![("redact_mark", json!({ "find": "SECRET-LINE" })), ("redact_apply", json!({}))], "SECRET-LINE"),
+        (vec![("doc_remove_hidden", json!({ "categories": ["hidden-text"] }))], "HIDDEN-LINE"),
+    ] {
+        let dir = named_workdir(gone);
+        std::fs::write(dir.join("s.pdf"), secret_pdf(None)).unwrap();
+        let mut a = Automation::new().with_root(&dir).unwrap();
+        let doc = ok(&mut a, "doc_open", json!({ "path": "s.pdf" }))["doc"].as_u64().unwrap();
+        ok(&mut a, "doc_background", json!({ "doc": doc, "color": "#FF0000" }));
+        for (tool, args) in &remove {
+            let mut args = args.clone();
+            args["doc"] = json!(doc);
+            ok(&mut a, tool, args);
+        }
+        ok(&mut a, "doc_save", json!({ "doc": doc, "path": "out.pdf", "full": true }));
+        let file = every_stream(&dir.join("out.pdf"));
+        assert!(file.contains("(KEEP)"), "{gone}: the page's other text is still there: {file}");
+        assert!(!file.contains(gone), "{gone} is still in the file: {file}");
+
+        let saved = ok(&mut a, "doc_open", json!({ "path": "out.pdf" }))["doc"].as_u64().unwrap();
+        let removed = ok(&mut a, "doc_remove_marks", json!({ "doc": saved, "kind": "background" }));
+        assert!(removed.get("warnings").is_none(), "{gone}: {removed}");
+        assert_eq!(
+            ok(&mut a, "doc_backdrops", json!({ "doc": saved }))["pages"],
+            json!([{ "page": 1, "backdrop": "fill" }]),
+            "{gone}: the fill is back"
+        );
+        assert_eq!(blank_spot(&mut a, saved, 1), WHITE);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
+
+/// When the backdrop can't be turned back on safely, Remove background says which pages keep it
+/// off.
+#[test]
+fn remove_background_warns_about_pages_whose_own_backdrop_stays_off() {
+    let dir = named_workdir("left-off");
+    // A tag whose hash doesn't match the bytes before the fill: they changed since.
+    let tag = format!("<< /Index 2 /Op (f) /Before <{}> >>", "00".repeat(32));
+    std::fs::write(dir.join("t.pdf"), secret_pdf(Some(&tag))).unwrap();
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let doc = ok(&mut a, "doc_open", json!({ "path": "t.pdf" }))["doc"].as_u64().unwrap();
+    let removed = ok(&mut a, "doc_remove_marks", json!({ "doc": doc, "kind": "background" }));
+    let warnings = removed["warnings"].as_array().unwrap_or_else(|| panic!("{removed}"));
+    assert_eq!(warnings.len(), 1, "{removed}");
+    assert!(warnings[0].as_str().unwrap().starts_with("page 1 changed after the background was added"), "{removed}");
+    assert_eq!(ok(&mut a, "doc_backdrops", json!({ "doc": doc }))["pages"], json!([]), "the fill stays off");
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/edit/Cargo.toml b/crates/edit/Cargo.toml
index 4eb2d6132b..89d9387989 100644
--- a/crates/edit/Cargo.toml
+++ b/crates/edit/Cargo.toml
@@ -15,6 +15,8 @@ pdfcraft-content = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 pdfcraft-model = { workspace = true }
 thiserror = { workspace = true }
+# A backdrop copy's tag records a hash of the operators before the fill it turned off (backdrop.rs).
+sha2 = "0.11"
 kurbo = { workspace = true }
 # Display order of right-to-left lines in added text, and reading and writing order in Edit text;
 # already in the tree via the interface.
diff --git a/crates/edit/src/backdrop.rs b/crates/edit/src/backdrop.rs
index 86924b8cb7..d55cb753ba 100644
--- a/crates/edit/src/backdrop.rs
+++ b/crates/edit/src/backdrop.rs
@@ -5,19 +5,34 @@
 //!
 //! A white fill can be replaced: the one fill operator becomes `n` (end the path without
 //! painting), which looks the same on white paper. The page then gets a copy of the content
-//! stream that held it, tagged `/PCBackdrop << /Original ref /At n /Len n >>`, and the stream
-//! itself is left alone (other pages may share it). [`restore`] puts the original back when the
-//! background is removed, unless the copy has been edited since. A picture can't be replaced
-//! without losing it, so it is only reported.
+//! stream that held it, tagged `/PCBackdrop << /Index n /Op (f) /Before <SHA-256> /Was [num gen] >>`:
+//! how many of the copy's operators come before the `n`, the operator it stands in for, a hash of
+//! those operators (their values, not their spacing: redaction writes a stream out again with
+//! other whitespace), and the number of the stream it was copied from. The stream itself is left
+//! alone (other pages may share it). [`restore`] turns the fill back on when the background is
+//! removed, even after the page was edited or redacted, as long as the operators before the fill
+//! are unchanged and the fill would again be the first thing painted, covering the page.
+//! Otherwise the fill stays off, and [`backdrops_left_off`] names those pages. A picture can't be
+//! replaced without losing it, so it is only reported.
+//!
+//! The tag holds no page content and no reference that keeps another object alive (`/Was` is two
+//! numbers, not a reference): a reference to the original stream would keep text in the file
+//! that a redaction, Remove Hidden Information or Edit Text removed from the copy.
 //!
 //! Detection is deliberately strict: only one rectangle (`re`), in DeviceGray, DeviceRGB or
 //! DeviceCMYK, opaque in the graphics state, with an axis-aligned transform, filled before any
 //! other painting, and covering the crop box. Anything else is real content and stays.
 
 use pdfcraft_content::{Matrix, Op, Pieces};
-use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
+use sha2::{Digest, Sha256};
 
-use crate::EditError;
+use crate::{EditError, MarkKind};
+
+/// The dictionary key of a backdrop copy's tag.
+const TAG: &[u8] = b"PCBackdrop";
+/// The fill operators a backdrop can be painted with, and so the only ones a tag may restore.
+const FILLS: [&[u8]; 3] = [b"f", b"F", b"f*"];
 
 /// How much of a page's content is read looking for a backdrop: it has to come first.
 const SCAN_BYTES: usize = 64 * 1024;
@@ -39,13 +54,23 @@ pub enum Backdrop {
 }
 
 /// Where a replaceable fill is: the content streams (references in `/Contents` order, untagged
-/// ones only), their joined bytes, and the fill operator's joined byte range.
+/// ones only), their joined bytes, where each starts in them, and the fill operator's joined
+/// byte range.
 struct Found {
     refs: Vec<(usize, ObjRef)>,
     pieces: Pieces,
+    starts: Vec<usize>,
     op: std::ops::Range<usize>,
 }
 
+impl Found {
+    /// The piece holding the fill operator, and the operator's offset in it.
+    fn place(&self) -> Option<(usize, usize)> {
+        let piece = self.pieces.piece_of(self.op.start);
+        Some((piece, self.op.start.checked_sub(*self.starts.get(piece)?)?))
+    }
+}
+
 #[derive(Clone)]
 struct State {
     ctm: Matrix,
@@ -63,7 +88,7 @@ struct State {
 pub fn page_backdrop(doc: &Document, page: usize) -> Result<Option<Backdrop>, EditError> {
     let all = pdfcraft_model::pages(doc);
     let p = all.get(page).ok_or(EditError::NoSuchPage(page))?;
-    Ok(scan(doc, p).map(|(b, _)| b))
+    Ok(scan(doc, p, None).map(|(b, _)| b))
 }
 
 /// The backdrop each of `pages` (0-based) paints, in the same order, walking the page tree once.
@@ -71,32 +96,56 @@ pub fn page_backdrop(doc: &Document, page: usize) -> Result<Option<Backdrop>, Ed
 /// elsewhere (the viewer's) can disagree with the page tree's on a malformed document.
 pub fn page_backdrops(doc: &Document, pages: &[usize]) -> Vec<Option<Backdrop>> {
     let all = pdfcraft_model::pages(doc);
-    pages.iter().map(|&p| all.get(p).and_then(|page| scan(doc, page)).map(|(b, _)| b)).collect()
+    pages.iter().map(|&p| all.get(p).and_then(|page| scan(doc, page, None)).map(|(b, _)| b)).collect()
+}
+
+/// Pages (0-based, ascending) whose own white backdrop [`replace`] turned off and [`restore`]
+/// couldn't turn back on: a tagged copy is still in their content, with no background over it.
+/// They look the same on white paper.
+pub fn backdrops_left_off(doc: &Document) -> Vec<usize> {
+    let tag_of = |o: &Object| crate::stream_tag(doc, o);
+    let copy = |o: &Object| doc.resolve(o).as_dict().is_some_and(|d| d.get(TAG).is_some());
+    pdfcraft_model::pages(doc)
+        .iter()
+        .enumerate()
+        .filter(|(_, p)| {
+            let list: Vec<Object> = match p.dict.get(b"Contents").map(|c| doc.resolve(c)).as_deref() {
+                Some(Object::Array(a)) => a.clone(),
+                Some(_) => p.dict.get(b"Contents").cloned().into_iter().collect(),
+                None => Vec::new(),
+            };
+            list.iter().any(copy) && !list.iter().any(|o| tag_of(o).as_deref() == Some(MarkKind::Background.tag()))
+        })
+        .map(|(i, _)| i)
+        .collect()
 }
 
 /// Replace `page`'s white backdrop fill, if it has one (see the module doc). Returns whether it
 /// did; when it did, `page` no longer matches the document. A picture backdrop is left alone.
 pub(crate) fn replace(doc: &mut Document, page: &pdfcraft_model::Page) -> Result<bool, EditError> {
-    let Some((Backdrop::Fill, Some(found))) = scan(doc, page) else { return Ok(false) };
+    let Some((Backdrop::Fill, Some(found))) = scan(doc, page, None) else { return Ok(false) };
+    let Some((piece, at)) = found.place() else { return Ok(false) };
+    let op = found.pieces.data().get(found.op.clone()).unwrap_or_default().to_vec();
     let edited = found.pieces.splice([(found.op.clone(), b"n".to_vec())]);
-    let piece = found.pieces.piece_of(found.op.start);
     let (Some(&(_, original)), Some(bytes)) = (found.refs.get(piece), edited.get(piece)) else { return Ok(false) };
-    // Where the operator sits in that piece: the joined offset less the pieces before it.
-    let before: usize = (0..piece).filter_map(|i| edited.get(i)).map(|p| p.len() + 1).sum();
-    let at = found.op.start.saturating_sub(before);
-    let len = found.op.end.saturating_sub(found.op.start);
+    // The `n` among the copy's own operators. A copy whose fill can't be found that way again is
+    // not made: there would be no safe way back.
+    let parsed = pdfcraft_content::parse(head(bytes));
+    let Some(index) = parsed.ops.iter().position(|o| o.span.start == at && o.op == b"n") else { return Ok(false) };
+    let Some(before) = parsed.ops.get(..index) else { return Ok(false) };
     let mut note = Dict::new();
-    note.set(b"Original".to_vec(), Object::Ref(original));
-    note.set(b"At".to_vec(), Object::Int(i64::try_from(at).unwrap_or(i64::MAX)));
-    note.set(b"Len".to_vec(), Object::Int(i64::try_from(len).unwrap_or(i64::MAX)));
+    note.set(b"Index".to_vec(), Object::Int(i64::try_from(index).unwrap_or(i64::MAX)));
+    note.set(b"Op".to_vec(), Object::String(PdfString::literal(op)));
+    note.set(b"Before".to_vec(), Object::String(PdfString { bytes: ops_hash(before), hex: true }));
+    note.set(b"Was".to_vec(), Object::Array(vec![Object::Int(original.num.into()), Object::Int(original.generation.into())]));
     // The copy keeps the original's dictionary (unknown entries included) less what describes
     // the old encoding; `scan` refused streams whose bytes live in an external file (`/F`).
     let Object::Stream(source) = &*doc.get(original) else { return Ok(false) };
     let mut dict = source.dict.clone();
-    for key in [&b"Length"[..], b"DL", b"PCBackdrop"] {
+    for key in [&b"Length"[..], b"DL", TAG] {
         dict.remove(key);
     }
-    dict.set(b"PCBackdrop".to_vec(), Object::Dict(note));
+    dict.set(TAG.to_vec(), Object::Dict(note));
     let copy = doc.add(Object::Stream(Stream::flate(dict, bytes)));
     // Every slot that draws the original: a page may list the same stream twice, and a second
     // copy of the fill would cover the background again.
@@ -112,14 +161,41 @@ pub(crate) fn replace(doc: &mut Document, page: &pdfcraft_model::Page) -> Result
     Ok(replaced)
 }
 
-/// Put back the original content streams [`replace`] copied on `page`, where the copy is still
-/// exactly what it wrote. Returns how many it restored.
+/// Turn the fills [`replace`] turned off on `page` back on, where [`restored_copy`] finds that
+/// safe; a copy listed in several slots is restored in each. Returns how many slots it restored.
+/// A copy it can't restore stays as it is, tag and all, so [`backdrops_left_off`] names its page.
 pub(crate) fn restore(doc: &mut Document, page: &pdfcraft_model::Page) -> Result<usize, EditError> {
     let mut list = crate::contents(doc, page)?;
+    // Per copy: the stream that takes its place, or `None` when it stays.
+    let mut done: Vec<(ObjRef, Option<ObjRef>)> = Vec::new();
     let mut restored = 0;
     for entry in list.iter_mut() {
-        if let Some(original) = unchanged_copy_of(doc, entry) {
-            *entry = Object::Ref(original);
+        let Object::Ref(copy) = *entry else { continue };
+        let with = match done.iter().find(|(c, _)| *c == copy) {
+            Some(&(_, with)) => with,
+            None => {
+                let with = restored_copy(doc, page, copy).map(|(bytes, dict, was)| {
+                    // The stream it was copied from, while that is still here with these bytes
+                    // (other pages may share it): the page is then exactly as it was. `/Was` is
+                    // only a number, and a full save renumbers objects, so the bytes decide.
+                    let same = |w: &ObjRef| match &*doc.get(*w) {
+                        Object::Stream(s) => {
+                            [TAG, &b"PCMark"[..], b"Subtype"].iter().all(|k| s.dict.get(k).is_none())
+                                && s.decoded().ok().as_deref() == Some(bytes.as_slice())
+                        }
+                        _ => false,
+                    };
+                    match was.filter(same) {
+                        Some(w) => w,
+                        None => doc.add(Object::Stream(Stream::flate(dict, &bytes))),
+                    }
+                });
+                done.push((copy, with));
+                with
+            }
+        };
+        if let Some(with) = with {
+            *entry = Object::Ref(with);
             restored += 1;
         }
     }
@@ -129,27 +205,125 @@ pub(crate) fn restore(doc: &mut Document, page: &pdfcraft_model::Page) -> Result
     Ok(restored)
 }
 
-/// The original of a backdrop copy whose bytes are still the original's with the fill turned to
-/// `n`; `None` for anything else (including a copy edited since, which is kept).
-fn unchanged_copy_of(doc: &Document, entry: &Object) -> Option<ObjRef> {
-    let copy = doc.resolve(entry);
-    let Object::Stream(copy) = &*copy else { return None };
-    let note = copy.dict.get(b"PCBackdrop").map(|n| doc.resolve(n))?;
+/// `copy` (a stream [`replace`] wrote for `page`) with its fill turned back on: the bytes, its
+/// dictionary without the tag, and the stream it was copied from. `None` when it isn't such a
+/// copy, or when turning the fill on could paint over something: the operators before the fill
+/// changed since (their hash no longer matches), or the page would no longer paint the fill
+/// first, covering it. What comes after the fill (an edit, a redaction) is kept as it is.
+fn restored_copy(doc: &Document, page: &pdfcraft_model::Page, copy: ObjRef) -> Option<(Vec<u8>, Dict, Option<ObjRef>)> {
+    let obj = doc.get(copy);
+    let Object::Stream(s) = &*obj else { return None };
+    let note = s.dict.get(TAG).map(|n| doc.resolve(n))?;
     let note = note.as_dict()?;
-    let Some(Object::Ref(original)) = note.get(b"Original") else { return None };
-    let at = usize::try_from(note.get(b"At")?.as_int()?).ok()?;
-    let len = usize::try_from(note.get(b"Len")?.as_int()?).ok()?;
-    let orig = doc.get(*original);
-    let Object::Stream(orig) = &*orig else { return None };
-    let source = orig.decoded().ok()?;
-    let mut expect = source.get(..at)?.to_vec();
-    expect.push(b'n');
-    expect.extend_from_slice(source.get(at.checked_add(len)?..)?);
-    (copy.decoded().ok()? == expect).then_some(*original)
+    let index = usize::try_from(note.get(b"Index")?.as_int()?).ok()?;
+    let op = note.get(b"Op")?.as_string()?.bytes.as_slice();
+    if !FILLS.contains(&op) {
+        return None;
+    }
+    let hash = note.get(b"Before")?.as_string()?;
+    let bytes = s.decoded().ok()?;
+    let parsed = pdfcraft_content::parse(head(&bytes));
+    // The `n` standing in for the fill, after exactly the operators that came before it.
+    let fill = parsed.ops.get(index)?;
+    if fill.op != b"n" || !fill.operands.is_empty() || ops_hash(parsed.ops.get(..index)?) != hash.bytes {
+        return None;
+    }
+    let mut out = Vec::with_capacity(bytes.len().saturating_add(op.len()));
+    out.extend_from_slice(bytes.get(..fill.span.start)?);
+    out.extend_from_slice(op);
+    out.extend_from_slice(bytes.get(fill.span.end..)?);
+    let (Backdrop::Fill, Some(found)) = scan(doc, page, Some((copy, &out)))? else { return None };
+    let (piece, offset) = found.place()?;
+    if found.refs.get(piece).map(|&(_, r)| r) != Some(copy) || offset != fill.span.start || found.op.len() != op.len() {
+        return None;
+    }
+    let mut dict = s.dict.clone();
+    for key in [&b"Length"[..], b"DL", TAG] {
+        dict.remove(key);
+    }
+    let was = match note.get(b"Was").and_then(Object::as_array).map(Vec::as_slice) {
+        Some([num, generation]) => Some(ObjRef { num: u32::try_from(num.as_int()?).ok()?, generation: u16::try_from(generation.as_int()?).ok()? }),
+        _ => None,
+    };
+    Some((out, dict, was))
 }
 
-/// Find the backdrop, and for a fill, where it is.
-fn scan(doc: &Document, p: &pdfcraft_model::Page) -> Option<(Backdrop, Option<Found>)> {
+/// As much of a content stream as a backdrop could be in: it has to come first.
+fn head(bytes: &[u8]) -> &[u8] {
+    bytes.get(..bytes.len().min(SCAN_BYTES)).unwrap_or_default()
+}
+
+/// A SHA-256 of what `ops` are, not how they are written: keywords and operand values, with
+/// numbers in one form (`1`, `1.0` and `1.00000` are the same), so a stream written out again
+/// with other spacing or number formatting still matches.
+fn ops_hash(ops: &[Op]) -> Vec<u8> {
+    let mut h = Sha256::new();
+    for op in ops {
+        for o in &op.operands {
+            canonical(o, &mut h, 0);
+        }
+        if let Some((dict, data)) = &op.inline {
+            canonical_dict(dict, &mut h, 0);
+            bytes(b'i', data, &mut h);
+        }
+        bytes(b'k', &op.op, &mut h);
+    }
+    h.finalize().to_vec()
+}
+
+/// How deep [`canonical`] follows nested arrays and dictionaries; deeper ones count as equal.
+const CANONICAL_DEPTH: usize = 32;
+
+fn canonical(o: &Object, h: &mut Sha256, depth: usize) {
+    if depth > CANONICAL_DEPTH {
+        h.update(b"~");
+        return;
+    }
+    match o {
+        Object::Null => h.update(b"z"),
+        Object::Bool(b) => h.update(if *b { b"T" } else { b"F" }),
+        Object::Int(i) => number(&i.to_string(), h),
+        Object::Real(r) if *r == 0.0 => number("0", h),
+        Object::Real(r) => number(&format!("{r:.5}"), h),
+        Object::String(s) => bytes(b's', &s.bytes, h),
+        Object::Name(n) => bytes(b'/', n, h),
+        Object::Array(a) => {
+            h.update(b"[");
+            for x in a {
+                canonical(x, h, depth.saturating_add(1));
+            }
+            h.update(b"]");
+        }
+        Object::Dict(d) => canonical_dict(d, h, depth),
+        Object::Stream(_) | Object::Ref(_) => h.update(b"?"),
+    }
+}
+
+fn canonical_dict(d: &Dict, h: &mut Sha256, depth: usize) {
+    h.update(b"<");
+    for (k, v) in d.iter() {
+        bytes(b'/', k, h);
+        canonical(v, h, depth.saturating_add(1));
+    }
+    h.update(b">");
+}
+
+/// A number written with up to five decimals, without trailing zeros.
+fn number(text: &str, h: &mut Sha256) {
+    let t = if text.contains('.') { text.trim_end_matches('0').trim_end_matches('.') } else { text };
+    bytes(b'#', t.as_bytes(), h);
+}
+
+/// A typed, length-prefixed value, so no two different sequences hash the same way.
+fn bytes(kind: u8, b: &[u8], h: &mut Sha256) {
+    h.update([kind]);
+    h.update(u64::try_from(b.len()).unwrap_or(u64::MAX).to_le_bytes());
+    h.update(b);
+}
+
+/// Find the backdrop, and for a fill, where it is. With `swap`, that stream reads as those bytes
+/// instead of its own (to check a change before making it).
+fn scan(doc: &Document, p: &pdfcraft_model::Page, swap: Option<(ObjRef, &[u8])>) -> Option<(Backdrop, Option<Found>)> {
     let crop = p.crop(doc);
     let c = p.dict.get(b"Contents")?;
     let list: Vec<Object> = match &*doc.resolve(c) {
@@ -160,6 +334,7 @@ fn scan(doc: &Document, p: &pdfcraft_model::Page) -> Option<(Backdrop, Option<Fo
     // only as far as a backdrop could be.
     let mut refs = Vec::new();
     let mut data = Vec::new();
+    let mut starts = Vec::new();
     let mut total = 0usize;
     for (slot, o) in list.iter().enumerate() {
         if total >= SCAN_BYTES {
@@ -175,18 +350,21 @@ fn scan(doc: &Document, p: &pdfcraft_model::Page) -> Option<(Backdrop, Option<Fo
         if s.dict.get(b"F").is_some() {
             return None;
         }
-        let bytes = s.decoded().unwrap_or_default();
+        let bytes = match swap {
+            Some((with, b)) if with == *r => b.to_vec(),
+            _ => s.decoded().unwrap_or_default(),
+        };
+        starts.push(total);
         total = total.saturating_add(bytes.len()).saturating_add(1);
         refs.push((slot, *r));
         data.push(bytes);
     }
     let pieces = Pieces::join(&data);
-    let head = pieces.data().get(..pieces.data().len().min(SCAN_BYTES)).unwrap_or_default();
-    let parsed = pdfcraft_content::parse(head);
+    let parsed = pdfcraft_content::parse(head(pieces.data()));
     let res = resources(doc, &p.dict);
     let found = walk(doc, &res, crop, &parsed.ops);
     found.map(|(b, op)| match (b, op) {
-        (Backdrop::Fill, Some(op)) => (b, Some(Found { refs, pieces, op })),
+        (Backdrop::Fill, Some(op)) => (b, Some(Found { refs, pieces, starts, op })),
         _ => (b, None),
     })
 }
diff --git a/crates/edit/src/backdrop_tests.rs b/crates/edit/src/backdrop_tests.rs
index 1c0744b59c..c7bfcaa8b4 100644
--- a/crates/edit/src/backdrop_tests.rs
+++ b/crates/edit/src/backdrop_tests.rs
@@ -1,6 +1,6 @@
 use std::sync::Arc;
 
-use pdfcraft_cos::{Document, ObjRef, Object, SaveOptions, Stream, write_incremental};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, SaveOptions, Stream, write_full, write_incremental};
 
 use super::*;
 use crate::{Background, MarkKind, add_background, remove_marks};
@@ -188,19 +188,166 @@ fn replacing_can_be_turned_off() {
     assert_eq!(streams(&doc)[1..], before[..]);
 }
 
-#[test]
-fn a_backdrop_copy_edited_since_is_kept_when_the_background_goes() {
-    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
-    add_background(&mut doc, &[0], &red(), false).unwrap();
-    // Something else rewrites the copy (as Edit text does), keeping its dictionary.
-    let p = &pdfcraft_model::pages(&doc)[0];
+/// Rewrite the page's backdrop copy (the stream after the background) as another tool would:
+/// Edit text and redaction keep its dictionary and change its bytes.
+fn rewrite_copy(doc: &mut Document, bytes: &str) -> ObjRef {
+    let p = &pdfcraft_model::pages(doc)[0];
     let Some(Object::Array(list)) = p.dict.get(b"Contents").cloned() else { panic!("contents") };
     let Object::Ref(copy) = list[1] else { panic!("a reference") };
     let Object::Stream(s) = (*doc.get(copy)).clone() else { panic!("a stream") };
-    let edited = "1 g 0 0 300 200 re n BT /F1 24 Tf 40 90 Td (Edited) Tj ET";
-    doc.set(copy, Object::Stream(Stream::flate(s.dict.clone(), edited.as_bytes())));
+    assert!(s.dict.get(b"PCBackdrop").is_some(), "the copy");
+    doc.set(copy, Object::Stream(Stream::flate(s.dict.clone(), bytes.as_bytes())));
+    copy
+}
+
+#[test]
+fn an_edit_after_the_fill_is_kept_and_the_backdrop_still_comes_back() {
+    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    rewrite_copy(&mut doc, "1 g 0 0 300 200 re n BT /F1 24 Tf 40 90 Td (Edited) Tj ET");
     remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
-    assert_eq!(streams(&doc), [edited.to_string()], "the edit survives");
+    assert_eq!(streams(&doc), ["1 g 0 0 300 200 re f BT /F1 24 Tf 40 90 Td (Edited) Tj ET"], "the edit survives, under the fill");
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Fill));
+    assert_eq!(backdrops_left_off(&doc), Vec::<usize>::new());
+}
+
+#[test]
+fn a_change_before_the_fill_leaves_it_off_and_names_the_page() {
+    for edited in [
+        // A different colour before the fill: the hash of what comes before it no longer matches.
+        "0.99 g 0 0 300 200 re n BT /F1 24 Tf 40 90 Td (Edited) Tj ET",
+        // Something painted before it.
+        "BT /F1 9 Tf (x) Tj ET 1 g 0 0 300 200 re n",
+        // The fill is gone.
+        "BT /F1 24 Tf 40 90 Td (Edited) Tj ET",
+    ] {
+        let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+        add_background(&mut doc, &[0], &red(), false).unwrap();
+        assert_eq!(backdrops_left_off(&doc), Vec::<usize>::new(), "a background is over it");
+        rewrite_copy(&mut doc, edited);
+        remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+        assert_eq!(streams(&doc), [edited.to_string()], "{edited}: the copy stays as it is");
+        assert_eq!(backdrops_left_off(&doc), [0], "{edited}");
+    }
+}
+
+#[test]
+fn a_fill_that_would_cover_content_painted_before_it_stays_off() {
+    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    // A tool puts a stream of its own before the copy, untagged: turning the fill back on would
+    // now paint white over that text.
+    let over = doc.add(Object::Stream(Stream::flate(pdfcraft_cos::Dict::new(), b"BT /F1 9 Tf 10 10 Td (Over) Tj ET")));
+    let p = pdfcraft_model::pages(&doc)[0].clone();
+    let Some(Object::Array(mut list)) = p.dict.get(b"Contents").cloned() else { panic!("contents") };
+    list.insert(1, Object::Ref(over));
+    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list))).unwrap();
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    let s = streams(&doc);
+    assert_eq!(s.len(), 2, "{s:?}");
+    assert!(s[1].contains("re n") && !s[1].contains("re f"), "nothing white goes over the text: {s:?}");
+    assert_eq!(backdrops_left_off(&doc), [0]);
+}
+
+#[test]
+fn the_tag_holds_no_reference_and_a_full_save_keeps_no_second_copy_of_the_page() {
+    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+    // Every stream in the file that holds the page's text: only the copy the page draws. A
+    // reference from the tag to the original stream kept a second, which a redaction or Remove
+    // Hidden Information on the copy left in the file.
+    let holding: Vec<(ObjRef, Dict)> = saved
+        .scan_objects()
+        .filter_map(|(r, o)| match &*o {
+            Object::Stream(s) if String::from_utf8_lossy(&s.decoded().unwrap_or_default()).contains("(Hello)") => Some((r, s.dict.clone())),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(holding.len(), 1, "{holding:?}");
+    let Some(Object::Dict(note)) = holding[0].1.get(b"PCBackdrop").map(|n| (*saved.resolve(n)).clone()) else { panic!("the tag") };
+    fn refs(o: &Object) -> bool {
+        match o {
+            Object::Ref(_) => true,
+            Object::Array(a) => a.iter().any(refs),
+            Object::Dict(d) => d.iter().any(|(_, v)| refs(v)),
+            _ => false,
+        }
+    }
+    assert!(!note.iter().any(|(_, v)| refs(v)), "{note:?}");
+    assert_eq!(note.get(b"Op").and_then(Object::as_string).map(|s| s.bytes.clone()), Some(b"f".to_vec()));
+    assert_eq!(note.get(b"Before").and_then(Object::as_string).map(|s| s.bytes.len()), Some(32), "a SHA-256");
+    // The original is gone, so Remove writes the fill back into a stream of its own.
+    let mut saved = saved;
+    remove_marks(&mut saved, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&saved), [format!("1 g 0 0 300 200 re f {TEXT}")]);
+    assert_eq!(page_backdrop(&saved, 0).unwrap(), Some(Backdrop::Fill));
+}
+
+#[test]
+fn a_copy_written_out_again_with_other_spacing_still_comes_back() {
+    // Redaction writes the whole stream out again: one operator a line, numbers its own way.
+    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    rewrite_copy(&mut doc, "1.0 g\n0 0 300.000 200 re\nn\nBT\n/F1 24 Tf\n40 90 Td\n[-6505] TJ\nET");
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&doc), ["1.0 g\n0 0 300.000 200 re\nf\nBT\n/F1 24 Tf\n40 90 Td\n[-6505] TJ\nET"], "the fill is back, the rest as written");
+    assert_eq!(backdrops_left_off(&doc), Vec::<usize>::new());
+}
+
+#[test]
+fn a_tag_that_does_not_add_up_is_left_alone() {
+    let content = format!("1 g 0 0 300 200 re f {TEXT}");
+    let copied = format!("1 g 0 0 300 200 re n {TEXT}");
+    let good = ops_hash(&pdfcraft_content::parse(b"1 g 0 0 300 200 re").ops);
+    let hex = |b: &[u8]| b.iter().map(|x| format!("{x:02x}")).collect::<String>();
+    for tag in [
+        // Not a fill operator, a wrong hash, an index that isn't the `n` or runs past the end.
+        format!("<< /Index 2 /Op (B) /Before <{}> >>", hex(&good)),
+        format!("<< /Index 2 /Op (f) /Before <{}> >>", hex(&[0; 32])),
+        format!("<< /Index 1 /Op (f) /Before <{}> >>", hex(&good)),
+        format!("<< /Index 99999 /Op (f) /Before <{}> >>", hex(&good)),
+        format!("<< /Index -1 /Op (f) /Before <{}> >>", hex(&good)),
+        // Missing entries, wrong types, and the reference earlier test builds wrote.
+        "<< /Index 2 /Op (f) >>".to_string(),
+        "<< /Index (2) /Op /f /Before 3 >>".to_string(),
+        "<< /Original 5 0 R /At 19 /Len 1 >>".to_string(),
+        "(not a dictionary)".to_string(),
+    ] {
+        let mut doc = build(&[
+            "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".into(),
+            "<< /Type /Page /Parent 2 0 R /Contents [4 0 R] >>".into(),
+            stream(&format!("/PCBackdrop {tag}"), &copied),
+            stream("", &content),
+        ]);
+        remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+        assert_eq!(streams(&doc), std::slice::from_ref(&copied), "{tag}");
+        assert_eq!(backdrops_left_off(&doc), [0], "{tag}");
+    }
+    // The same page with an honest tag comes back.
+    let mut doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents [4 0 R] >>".into(),
+        stream(&format!("/PCBackdrop << /Index 2 /Op (f) /Before <{}> >>", hex(&good)), &copied),
+    ]);
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&doc), [content]);
+}
+
+#[test]
+fn operators_hash_by_value_not_by_spelling() {
+    let h = |s: &[u8]| ops_hash(&pdfcraft_content::parse(s).ops);
+    assert_eq!(h(b"1 g 0 0 300 200 re"), h(b"1.0 g\n0  0 300.00000 200 re"));
+    assert_eq!(h(b"0 g"), h(b"-0.0 g"));
+    assert_ne!(h(b"1 g 0 0 300 200 re"), h(b"0.99 g 0 0 300 200 re"));
+    assert_ne!(h(b"(ab) Tj"), h(b"(a) (b) Tj"), "operand boundaries count");
+    assert_ne!(h(b"/a /b BDC"), h(b"/ab BDC"));
+    assert_ne!(h(b""), h(b"q"));
+    // Nesting is bounded: deep arrays hash without running out of stack.
+    let deep = format!("{}{} Tj", "[".repeat(1000), "]".repeat(1000));
+    let _ = h(deep.as_bytes());
 }
 
 #[test]
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 4b524b70ed..99d80e8ae9 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -205,7 +205,8 @@ pub struct Background {
     /// Pictures: size relative to the page (1.0 fits the page).
     pub scale: f64,
     /// Replace a white backdrop the page paints itself, which would hide the background
-    /// ([`backdrop`]). Removing the background puts it back.
+    /// ([`backdrop`]). Removing the background turns it back on where that is still safe
+    /// ([`backdrops_left_off`] are the pages where it isn't).
     pub replace_backdrop: bool,
 }
 
@@ -971,7 +972,8 @@ pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, repl
 /// Remove marks of `kind` from `pages`; returns how many were removed. Wrappers left with
 /// nothing after them go too, restoring the original content list; a wrapper that content
 /// after it still relies on (another tool's appended stream) stays. Removing backgrounds also
-/// puts back a backdrop [`add_background`] replaced, unless it was edited since.
+/// turns a backdrop [`add_background`] replaced back on where that is still safe; the pages where
+/// it isn't are [`backdrops_left_off`].
 pub fn remove_marks(doc: &mut Document, pages: &[usize], kind: MarkKind) -> Result<usize, EditError> {
     let all = page_list(doc);
     check(pages, all.len())?;
@@ -1034,7 +1036,7 @@ pub fn marks_present(doc: &Document) -> Vec<MarkKind> {
 }
 
 pub mod backdrop;
-pub use backdrop::{Backdrop, page_backdrop, page_backdrops};
+pub use backdrop::{Backdrop, backdrops_left_off, page_backdrop, page_backdrops};
 mod background;
 pub use background::page_background;
 pub mod objects;
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 37b1dd2637..b329211129 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -434,9 +434,51 @@ pub struct Document {
     /// XFA forms: what was approximated, rewritten or could not be written to the XFA data
     /// (also in `info.warnings`, kept there when the document is re-read).
     pub xfa_warnings: Vec<String>,
-    /// What the last successful [`Session::apply`] wrote that its fonts can't draw: kept as typed,
-    /// drawn with `?` in its place (see [`TextNotice`]). The interface shows it; tools return it.
-    pub edit_notices: Vec<TextNotice>,
+    /// What the last successful [`Session::apply`] wants said (see [`EditNotice`]): text its fonts
+    /// can't draw, pages whose own backdrop stays off. The interface shows it; tools return it.
+    pub edit_notices: Vec<EditNotice>,
+}
+
+/// Something the last successful edit did that the user should hear about, never left silent
+/// (AGENTS.md §4).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum EditNotice {
+    /// Text stored as typed but drawn with `?`.
+    Undrawn(TextNotice),
+    /// Remove background couldn't turn back on the white backdrop these pages (0-based,
+    /// ascending) paint themselves: their content changed after the background replaced it, so
+    /// turning it on could paint over something (`pdfcraft_edit::backdrops_left_off`). They look
+    /// the same on white paper.
+    BackdropsLeftOff { pages: Vec<usize> },
+}
+
+impl std::fmt::Display for EditNotice {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            EditNotice::Undrawn(n) => n.fmt(f),
+            EditNotice::BackdropsLeftOff { pages } => {
+                let (which, own) = if pages.len() == 1 { ("page", "its") } else { ("pages", "their") };
+                write!(
+                    f,
+                    "{which} {} changed after the background was added, so {own} own white backdrop was not turned back on (it looks the same on white paper)",
+                    page_runs(pages)
+                )
+            }
+        }
+    }
+}
+
+/// 0-based pages as 1-based runs: `[0, 1, 2, 5]` is "1-3, 6".
+fn page_runs(pages: &[usize]) -> String {
+    let mut runs: Vec<(usize, usize)> = Vec::new();
+    for &p in pages {
+        match runs.last_mut() {
+            Some((_, end)) if end.checked_add(1) == Some(p) => *end = p,
+            _ => runs.push((p, p)),
+        }
+    }
+    let one = |p: usize| p.saturating_add(1);
+    runs.iter().map(|&(a, b)| if a == b { one(a).to_string() } else { format!("{}-{}", one(a), one(b)) }).collect::<Vec<_>>().join(", ")
 }
 
 /// Text an edit stored as typed but drew with `?` in place of `ch`, because the font it is drawn
@@ -3965,11 +4007,18 @@ impl Session {
         }
         // What this edit drew with `?` (a value or comment text its font can't draw, stored as
         // typed): reported, never silent (AGENTS.md §4).
-        let notices = if matches!(scope_of(&edit), Scope::Form | Scope::Comments | Scope::Full) {
-            guard(|| undrawn_notices(&editor.cos, &next)).unwrap_or_default()
+        let mut notices: Vec<EditNotice> = if matches!(scope_of(&edit), Scope::Form | Scope::Comments | Scope::Full) {
+            guard(|| undrawn_notices(&editor.cos, &next)).unwrap_or_default().into_iter().map(EditNotice::Undrawn).collect()
         } else {
             Vec::new()
         };
+        // Pages whose own white backdrop Remove background couldn't turn back on: said, not silent.
+        if matches!(edit, Edit::RemoveMarks { kind: MarkKind::Background }) {
+            let pages = guard(|| pdfcraft_edit::backdrops_left_off(&next)).unwrap_or_default();
+            if !pages.is_empty() {
+                notices.push(EditNotice::BackdropsLeftOff { pages });
+            }
+        }
         let previous = std::mem::replace(&mut editor.cos, next);
         let keys = keys_after(&edit).unwrap_or_else(|| editor.keys.clone());
         let previous_keys = std::mem::replace(&mut editor.keys, keys);
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index ed4e6efa1c..9574c49c31 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -2132,10 +2132,10 @@ fn a_value_its_font_cannot_draw_is_reported_by_the_edit_that_drew_it() {
     fill(&mut s, "name", FieldValue::Text("张三".into())).unwrap();
     let d = s.get(id).unwrap();
     assert_eq!(d.form[0].value, ["张三"]);
-    let n = &d.edit_notices;
-    assert_eq!(n.len(), 1, "{n:?}");
-    assert_eq!((n[0].field.as_deref(), n[0].page, n[0].ch, n[0].redrawn_elsewhere), (Some("name"), 0, '张', true));
-    assert!(n[0].to_string().contains("\"张\" (U+5F20)") && n[0].to_string().contains("other PDF viewers redraw"), "{}", n[0]);
+    let [EditNotice::Undrawn(n)] = d.edit_notices.as_slice() else { panic!("{:?}", d.edit_notices) };
+    assert_eq!((n.field.as_deref(), n.page, n.ch, n.redrawn_elsewhere), (Some("name"), 0, '张', true));
+    let said = d.edit_notices[0].to_string();
+    assert!(said.contains("\"张\" (U+5F20)") && said.contains("other PDF viewers redraw"), "{said}");
     fill(&mut s, "ok", FieldValue::Check(true)).unwrap();
     assert!(s.get(id).unwrap().edit_notices.is_empty(), "an unrelated edit reports nothing");
     fill(&mut s, "name", FieldValue::Text("李四".into())).unwrap();
@@ -2681,6 +2681,59 @@ fn headers_footers_watermarks_and_backgrounds_show_update_and_remove() {
     assert_eq!(s.get(id).unwrap().can_undo(), Some("Remove background"));
 }
 
+/// One 100 × 100 page under a background (`/PCMark /Background`), its own content painting a
+/// white backdrop first. With `copy`, that content is a backdrop copy whose tag is `copy`.
+fn backdrop_pdf(copy: Option<&str>) -> Vec<u8> {
+    let bg = "q 1 0 0 rg 0 0 100 100 re f Q";
+    let (tag, fill) = match copy {
+        Some(tag) => (format!("/PCBackdrop {tag} "), "n"),
+        None => (String::new(), "f"),
+    };
+    let content = format!("1 g 0 0 100 100 re {fill} 0 g BT /F1 12 Tf 10 50 Td (Hi) Tj ET");
+    format!(
+        "%PDF-1.7\n\
+         1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+         2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+         3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents [4 0 R 5 0 R] /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> >> >> endobj\n\
+         4 0 obj << /PCMark /Background /Length {} >> stream\n{bg}\nendstream endobj\n\
+         5 0 obj << {tag}/Length {} >> stream\n{content}\nendstream endobj\n\
+         trailer << /Root 1 0 R >>\n%%EOF",
+        bg.len(),
+        content.len()
+    )
+    .into_bytes()
+}
+
+/// Remove background says which pages keep their own white backdrop off (it couldn't be turned
+/// back on safely), and says nothing when every backdrop comes back.
+#[test]
+fn remove_background_names_the_pages_whose_own_backdrop_stays_off() {
+    let mut s = Session::new();
+    // A tag whose hash doesn't match the bytes before the fill: something changed them since.
+    let tag = format!("<< /Index 2 /Op (f) /Before <{}> >>", "00".repeat(32));
+    let id = s.open("a.pdf", None, Arc::new(backdrop_pdf(Some(&tag))), None).unwrap();
+    s.apply(id, Edit::RemoveMarks { kind: MarkKind::Background }).unwrap();
+    let d = s.get(id).unwrap();
+    assert_eq!(d.edit_notices, [EditNotice::BackdropsLeftOff { pages: vec![0] }]);
+    let said = d.edit_notices[0].to_string();
+    assert!(said.starts_with("page 1 changed after the background was added"), "{said}");
+    // An unrelated edit after it says nothing.
+    s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
+    assert!(s.get(id).unwrap().edit_notices.is_empty());
+
+    // Added and removed here: the backdrop comes back, and nothing is said.
+    let id = s.open("b.pdf", None, Arc::new(backdrop_pdf(None)), None).unwrap();
+    s.apply(id, Edit::RemoveMarks { kind: MarkKind::Background }).unwrap();
+    let background = Background { color: [1.0, 0.0, 0.0], ..Background::default() };
+    s.apply(id, Edit::AddBackground { pages: vec![0], settings: background, replace: false, file: None }).unwrap();
+    assert_eq!(s.get(id).unwrap().page_backdrops(&[0]), [None], "replaced");
+    s.apply(id, Edit::RemoveMarks { kind: MarkKind::Background }).unwrap();
+    assert!(s.get(id).unwrap().edit_notices.is_empty());
+    assert_eq!(s.get(id).unwrap().page_backdrops(&[0]), [Some(Backdrop::Fill)], "turned back on");
+    assert_eq!(page_runs(&[0, 1, 2, 5, 7, 8]), "1-3, 6, 8-9");
+    assert_eq!(page_runs(&[]), "");
+}
+
 #[test]
 fn marker_indexes_match_after_open_and_save_when_requested() {
     let (mut source, source_id) = session_with(1);
@@ -7029,11 +7082,11 @@ fn undo_and_redo_roll_back_on_a_refresh_panic_or_error() {
     // 5. Metadata scope: a panic after `doc.info.title` was written rolls back `info.title` and keeps `edit_notices`.
     s.apply(id, Edit::SetInfo { key: "Title".into(), value: "Draft".into() }).unwrap();
     let notice = TextNotice { field: None, page: 0, ch: '☺', redrawn_elsewhere: false };
-    s.doc_mut(id).unwrap().edit_notices.push(notice.clone());
+    s.doc_mut(id).unwrap().edit_notices.push(EditNotice::Undrawn(notice.clone()));
     panic_on_refresh(1);
     assert_eq!(s.undo(id), Err(EditError::Reopen("injected refresh panic".into())));
     assert_eq!(s.get(id).unwrap().info.title.as_deref(), Some("Draft"));
-    assert_eq!(s.get(id).unwrap().edit_notices, [notice]);
+    assert_eq!(s.get(id).unwrap().edit_notices, [EditNotice::Undrawn(notice)]);
     assert_eq!(s.undo(id).unwrap().as_str(), "Change Title");
     assert_eq!(s.get(id).unwrap().info.title, None);
     assert!(s.get(id).unwrap().edit_notices.is_empty());
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 2fdc2e9d02..e03dd52fe2 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -173,10 +173,14 @@ impl PdfCraftApp {
                 if std::mem::take(&mut view.comments.tool_done) && !self.comment_prefs.pinned {
                     self.quick_tool = crate::QuickTool::Select;
                 }
-                // Text saved as typed but drawn with `?` (its font can't draw it): said, not silent.
-                // Before the scripts' output, so an alert they raise still shows.
+                // Text saved as typed but drawn with `?` (its font can't draw it), or pages whose
+                // own backdrop stays off: said, not silent. Before the scripts' output, so an alert
+                // they raise still shows.
                 if let Some(n) = self.session.get(id).and_then(|d| d.edit_notices.first()).cloned() {
-                    self.notify(crate::content_ui::undrawn_message(&n));
+                    self.notify(match &n {
+                        pdfcraft_engine::EditNotice::Undrawn(t) => crate::content_ui::undrawn_message(t),
+                        pdfcraft_engine::EditNotice::BackdropsLeftOff { pages } => crate::marks_ui::backdrops_left_off_message(pages),
+                    });
                 }
                 let out = self.session.take_js_output(id);
                 self.handle_js(id, out);
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index e41a752411..20931ad0bb 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -862,6 +862,8 @@
 	Removing the background puts the page's own backdrop back.	إزالة الخلفية تعيد التعبئة البيضاء الخاصة بالصفحة.
 	A picture covers page {pages} (a scan?), so the background won't show there.	تغطي صورة الصفحة {pages} (مسح ضوئي؟)، لذا لن تظهر الخلفية فيها.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	تغطي صور الصفحات {pages} (مسح ضوئي؟)، لذا لن تظهر الخلفية فيها.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	تغيّرت الصفحة {pages} بعد إضافة الخلفية، لذا تبقى تعبئتها البيضاء الخاصة متوقفة. تبدو كما هي على الورق الأبيض.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	تغيّرت الصفحات {pages} بعد إضافة الخلفية، لذا تبقى تعبئتها البيضاء الخاصة متوقفة. تبدو كما هي على الورق الأبيض.
 	PDF or image	PDF أو صورة
 	No file chosen	لم يُختر ملف
 	Page number	رقم الصفحة
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 1854c469ef..f71d01dc01 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -533,6 +533,8 @@
 	Removing the background puts the page's own backdrop back.	Премахването на фона връща собственото бяло запълване на страницата.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Изображение покрива страница {pages} (сканиране?), затова фонът няма да се вижда там.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Изображения покриват страници {pages} (сканирания?), затова фонът няма да се вижда там.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Страница {pages} е променена след добавянето на фона, затова собственото ѝ бяло запълване остава изключено. На бяла хартия изглежда по същия начин.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Страници {pages} са променени след добавянето на фона, затова собственото им бяло запълване остава изключено. На бяла хартия изглеждат по същия начин.
 	PDF or image	PDF или изображение
 	No file chosen	Не е избран файл
 	Page number	Номер на страница
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 34ea8188e7..5164d43a10 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -821,6 +821,8 @@
 	Removing the background puts the page's own backdrop back.	En eliminar el fons, es restaura el farciment blanc propi de la pàgina.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Una imatge cobreix la pàgina {pages} (un escaneig?), així que el fons no s'hi veurà.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Hi ha imatges que cobreixen les pàgines {pages} (escanejos?), així que el fons no s'hi veurà.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	La pàgina {pages} ha canviat després d'afegir el fons, així que el seu propi farciment blanc continua desactivat. Es veu igual sobre paper blanc.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Les pàgines {pages} han canviat després d'afegir el fons, així que el seu propi farciment blanc continua desactivat. Es veuen igual sobre paper blanc.
 	PDF or image	PDF o imatge
 	No file chosen	Cap fitxer triat
 	Page number	Número de pàgina
diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index 2e7d8f69a9..a87c272310 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -831,6 +831,8 @@
 	Removing the background puts the page's own backdrop back.	لابردنی پاشبنەما پڕکردنەوە سپییەکەی خودی پەڕەکە دەگەڕێنێتەوە.
 	A picture covers page {pages} (a scan?), so the background won't show there.	وێنەیەک پەڕەی {pages} دادەپۆشێت (سکان؟)، بۆیە پاشبنەماکە لەوێ دەرناکەوێت.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	وێنەکان پەڕەکانی {pages} دادەپۆشن (سکان؟)، بۆیە پاشبنەماکە لەوێ دەرناکەوێت.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	پەڕەی {pages} دوای زیادکردنی پاشبنەما گۆڕا، بۆیە پڕکردنەوە سپییەکەی خۆی کوژاوە دەمێنێتەوە. لەسەر کاغەزی سپی هەمان شێوەیە.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	پەڕەکانی {pages} دوای زیادکردنی پاشبنەما گۆڕان، بۆیە پڕکردنەوە سپییەکانی خۆیان کوژاوە دەمێننەوە. لەسەر کاغەزی سپی هەمان شێوەن.
 	PDF or image	PDF یان وێنە
 	No file chosen	هیچ فایلێک هەڵنەبژێردراوە
 	Page number	ژمارەی پەڕە
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index a2d3f1b0e9..10433a6543 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -937,6 +937,8 @@ key	Space	Mezerník
 	Removing the background puts the page's own backdrop back.	Odebráním pozadí se vrátí vlastní bílá výplň stránky.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Stránku {pages} pokrývá obrázek (sken?), takže pozadí na ní nebude vidět.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Stránky {pages} pokrývají obrázky (skeny?), takže pozadí na nich nebude vidět.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Stránka {pages} se po přidání pozadí změnila, proto její vlastní bílá výplň zůstává vypnutá. Na bílém papíře vypadá stejně.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Stránky {pages} se po přidání pozadí změnily, proto jejich vlastní bílá výplň zůstává vypnutá. Na bílém papíře vypadají stejně.
 	PDF or image	PDF nebo obrázek
 	No file chosen	Není vybrán žádný soubor
 	Page number	Číslo stránky
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index f7b6083f6b..4018a19604 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -840,6 +840,8 @@
 	Removing the background puts the page's own backdrop back.	Wird der Hintergrund entfernt, kehrt die eigene weiße Fläche der Seite zurück.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Ein Bild bedeckt Seite {pages} (ein Scan?), daher ist der Hintergrund dort nicht zu sehen.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Bilder bedecken die Seiten {pages} (Scans?), daher ist der Hintergrund dort nicht zu sehen.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Seite {pages} wurde nach dem Hinzufügen des Hintergrunds geändert, daher bleibt ihre eigene weiße Fläche ausgeschaltet. Auf weißem Papier sieht sie gleich aus.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Seiten {pages} wurden nach dem Hinzufügen des Hintergrunds geändert, daher bleiben ihre eigenen weißen Flächen ausgeschaltet. Auf weißem Papier sehen sie gleich aus.
 	PDF or image	PDF oder Bild
 	No file chosen	Keine Datei ausgewählt
 	Page number	Seitenzahl
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 143c915388..bd549327b6 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -444,6 +444,8 @@
 	Removing the background puts the page's own backdrop back.	Η αφαίρεση του φόντου επαναφέρει τη λευκή γέμιση της σελίδας.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Μια εικόνα καλύπτει τη σελίδα {pages} (σάρωση;), οπότε το φόντο δεν θα φαίνεται εκεί.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Εικόνες καλύπτουν τις σελίδες {pages} (σαρώσεις;), οπότε το φόντο δεν θα φαίνεται εκεί.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Η σελίδα {pages} άλλαξε μετά την προσθήκη του φόντου, οπότε η δική της λευκή γέμιση μένει απενεργοποιημένη. Σε λευκό χαρτί φαίνεται ίδια.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Οι σελίδες {pages} άλλαξαν μετά την προσθήκη του φόντου, οπότε οι δικές τους λευκές γεμίσεις μένουν απενεργοποιημένες. Σε λευκό χαρτί φαίνονται ίδιες.
 	PDF or image	PDF ή εικόνα
 	No file chosen	Δεν έχει επιλεγεί αρχείο
 	Scale relative to target page	Κλίμακα ως προς τη σελίδα προορισμού
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 451b0489bc..31af1e9251 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -856,6 +856,8 @@
 	Removing the background puts the page's own backdrop back.	Al quitar el fondo, se restaura el relleno blanco propio de la página.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Una imagen cubre la página {pages} (¿un escaneo?), así que el fondo no se verá ahí.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Hay imágenes que cubren las páginas {pages} (¿escaneos?), así que el fondo no se verá ahí.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	La página {pages} cambió después de añadir el fondo, así que su propio relleno blanco sigue desactivado. Se ve igual sobre papel blanco.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Las páginas {pages} cambiaron después de añadir el fondo, así que sus propios rellenos blancos siguen desactivados. Se ven igual sobre papel blanco.
 	PDF or image	PDF o imagen
 	No file chosen	Ningún archivo elegido
 	Page number	Número de página
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index ba4a72b142..5e7c1ea2d8 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -820,6 +820,8 @@
 	Removing the background puts the page's own backdrop back.	Taustan poistaminen palauttaa sivun oman valkoisen täytön.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Kuva peittää sivun {pages} (skannaus?), joten tausta ei näy siinä.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Kuvat peittävät sivut {pages} (skannauksia?), joten tausta ei näy niissä.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Sivu {pages} muuttui taustan lisäämisen jälkeen, joten sen oma valkoinen täyttö pysyy pois päältä. Valkoisella paperilla se näyttää samalta.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Sivut {pages} muuttuivat taustan lisäämisen jälkeen, joten niiden omat valkoiset täytöt pysyvät pois päältä. Valkoisella paperilla ne näyttävät samalta.
 	PDF or image	PDF tai kuva
 	No file chosen	Tiedostoa ei ole valittu
 	Page number	Sivunumero
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 7eed4b9d4c..c6d2c4090e 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -836,6 +836,8 @@
 	Removing the background puts the page's own backdrop back.	Supprimer l'arrière-plan rétablit le remplissage blanc propre à la page.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Une image couvre la page {pages} (une numérisation ?), l'arrière-plan n'y sera donc pas visible.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Des images couvrent les pages {pages} (des numérisations ?), l'arrière-plan n'y sera donc pas visible.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	La page {pages} a changé après l'ajout de l'arrière-plan, son propre remplissage blanc reste donc désactivé. Elle paraît identique sur papier blanc.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Les pages {pages} ont changé après l'ajout de l'arrière-plan, leurs propres remplissages blancs restent donc désactivés. Elles paraissent identiques sur papier blanc.
 	PDF or image	PDF ou image
 	No file chosen	Aucun fichier choisi
 	Page number	Numéro de page
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index 4a6baf1819..b45b026068 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -804,6 +804,8 @@
 	Removing the background puts the page's own backdrop back.	पृष्ठभूमि हटाने पर पृष्ठ की अपनी सफ़ेद भराई वापस आ जाती है।
 	A picture covers page {pages} (a scan?), so the background won't show there.	एक छवि पृष्ठ {pages} को ढकती है (स्कैन?), इसलिए वहाँ पृष्ठभूमि नहीं दिखेगी।
 	Pictures cover pages {pages} (scans?), so the background won't show there.	छवियाँ पृष्ठ {pages} को ढकती हैं (स्कैन?), इसलिए वहाँ पृष्ठभूमि नहीं दिखेगी।
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	पृष्ठभूमि जोड़ने के बाद पृष्ठ {pages} बदल गया, इसलिए उसकी अपनी सफ़ेद भराई बंद रहती है। सफ़ेद कागज़ पर यह वैसा ही दिखता है।
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	पृष्ठभूमि जोड़ने के बाद पृष्ठ {pages} बदल गए, इसलिए उनकी अपनी सफ़ेद भराई बंद रहती है। सफ़ेद कागज़ पर वे वैसे ही दिखते हैं।
 	PDF or image	पीडीएफ़ या छवि
 	No file chosen	कोई फ़ाइल नहीं चुनी गई
 	Page number	पृष्ठ संख्या
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index f21705c6e1..e67bb6761e 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -833,6 +833,8 @@
 	Removing the background puts the page's own backdrop back.	A háttér eltávolítása visszaállítja az oldal saját fehér kitöltését.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Egy kép fedi le ezt az oldalt: {pages} (szkennelt?), így ott nem látszik a háttér.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Képek fedik le ezeket az oldalakat: {pages} (szkenneltek?), így ott nem látszik a háttér.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Ez az oldal megváltozott a háttér hozzáadása után, ezért a saját fehér kitöltése kikapcsolva marad: {pages}. Fehér papíron ugyanúgy néz ki.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Ezek az oldalak megváltoztak a háttér hozzáadása után, ezért a saját fehér kitöltésük kikapcsolva marad: {pages}. Fehér papíron ugyanúgy néznek ki.
 	PDF or image	PDF vagy kép
 	No file chosen	Nincs fájl kiválasztva
 	Page number	Oldalszám
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 002cd54de7..b96e6fc8cb 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -950,6 +950,8 @@
 	Removing the background puts the page's own backdrop back.	Menghapus latar belakang akan mengembalikan isian putih milik halaman.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Sebuah gambar menutupi halaman {pages} (hasil pindai?), jadi latar belakang tidak akan terlihat di sana.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Gambar menutupi halaman-halaman {pages} (hasil pindai?), jadi latar belakang tidak akan terlihat di sana.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Halaman {pages} berubah setelah latar belakang ditambahkan, jadi isian putihnya sendiri tetap mati. Di kertas putih tampilannya sama.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Halaman {pages} berubah setelah latar belakang ditambahkan, jadi isian putihnya sendiri tetap mati. Di kertas putih tampilannya sama.
 	Report	Laporan
 	Report…	Laporan…
 	Requires user to enter a password for:	Memerlukan pengguna untuk memasukkan kata sandi untuk:
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index fb64615371..8bcfd6da1d 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -859,6 +859,8 @@
 	Removing the background puts the page's own backdrop back.	Rimuovendo lo sfondo, il riempimento bianco della pagina viene ripristinato.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Un'immagine copre la pagina {pages} (una scansione?), quindi lì lo sfondo non sarà visibile.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Delle immagini coprono le pagine {pages} (scansioni?), quindi lì lo sfondo non sarà visibile.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	La pagina {pages} è cambiata dopo l'aggiunta dello sfondo, quindi il suo riempimento bianco resta disattivato. Su carta bianca appare uguale.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Le pagine {pages} sono cambiate dopo l'aggiunta dello sfondo, quindi i loro riempimenti bianchi restano disattivati. Su carta bianca appaiono uguali.
 	PDF or image	PDF o immagine
 	No file chosen	Nessun file scelto
 	Page number	Numero di pagina
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 79b12f015a..47bca878f9 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -863,6 +863,8 @@
 	Removing the background puts the page's own backdrop back.	背景を削除すると、ページ独自の白い塗りが元に戻ります。
 	A picture covers page {pages} (a scan?), so the background won't show there.	{pages} ページは画像（スキャン？）で覆われているため、背景は表示されません。
 	Pictures cover pages {pages} (scans?), so the background won't show there.	{pages} ページが画像（スキャン？）で覆われているため、そこでは背景は表示されません。
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	背景を追加した後に {pages} ページが変更されたため、そのページ独自の白い塗りはオフのままです。白い紙では見た目は変わりません。
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	背景を追加した後に {pages} ページが変更されたため、それらのページ独自の白い塗りはオフのままです。白い紙では見た目は変わりません。
 	PDF or image	PDF または画像
 	No file chosen	ファイルが選択されていません
 	Page number	ページ番号
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index a040c013b5..6953af8a2c 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -818,6 +818,8 @@
 	Removing the background puts the page's own backdrop back.	Фонды жою беттің өз ақ толтыруын қайтарады.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Сурет жауып тұрған бет (сканер ме?): {pages}; онда фон көрінбейді.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Суреттер жауып тұрған беттер (сканер ме?): {pages}; онда фон көрінбейді.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Фон қосылғаннан кейін өзгерген бет, сондықтан оның өз ақ толтыруы өшірулі қалады: {pages}. Ақ қағазда бірдей көрінеді.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Фон қосылғаннан кейін өзгерген беттер, сондықтан олардың өз ақ толтырулары өшірулі қалады: {pages}. Ақ қағазда бірдей көрінеді.
 	PDF or image	PDF немесе сурет
 	No file chosen	Файл таңдалмады
 	Page number	Бет нөмірі
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 873c93b6f9..ab333c55b3 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -804,6 +804,8 @@
 	Removing the background puts the page's own backdrop back.	배경을 제거하면 페이지 자체의 흰색 채우기가 복원됩니다.
 	A picture covers page {pages} (a scan?), so the background won't show there.	이미지가 {pages}페이지를 덮고 있어(스캔본?) 배경이 보이지 않습니다.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	이미지들이 {pages}페이지를 덮고 있어(스캔본?) 배경이 보이지 않습니다.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	배경을 추가한 뒤 {pages}페이지가 바뀌어서 자체 흰색 채우기가 꺼진 채로 남습니다. 흰 종이에서는 똑같이 보입니다.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	배경을 추가한 뒤 {pages}페이지가 바뀌어서 자체 흰색 채우기가 꺼진 채로 남습니다. 흰 종이에서는 똑같이 보입니다.
 	PDF or image	PDF 또는 이미지
 	No file chosen	선택한 파일 없음
 	Page number	페이지 번호
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index 04d5b73d1d..d86deae1cd 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -830,6 +830,8 @@
 	Removing the background puts the page's own backdrop back.	ການລຶບພື້ນຫຼັງຈະເອົາພື້ນສີຂາວເດີມຂອງໜ້າກັບຄືນມາ.
 	A picture covers page {pages} (a scan?), so the background won't show there.	ມີຮູບພາບປົກໜ້າ {pages} ຢູ່ (ພາບສະແກນ?), ສະນັ້ນພື້ນຫຼັງຈະບໍ່ສະແດງຢູ່ບ່ອນນັ້ນ.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	ມີຮູບພາບຫຼາຍຮູບປົກໜ້າ {pages} ຢູ່ (ພາບສະແກນ?), ສະນັ້ນພື້ນຫຼັງຈະບໍ່ສະແດງຢູ່ບ່ອນນັ້ນ.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	ໜ້າ {pages} ປ່ຽນໄປຫຼັງຈາກເພີ່ມພື້ນຫຼັງ, ສະນັ້ນພື້ນສີຂາວຂອງມັນເອງຍັງປິດຢູ່. ເທິງເຈ້ຍສີຂາວມັນເບິ່ງຄືເກົ່າ.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	ໜ້າ {pages} ປ່ຽນໄປຫຼັງຈາກເພີ່ມພື້ນຫຼັງ, ສະນັ້ນພື້ນສີຂາວຂອງພວກມັນເອງຍັງປິດຢູ່. ເທິງເຈ້ຍສີຂາວພວກມັນເບິ່ງຄືເກົ່າ.
 	PDF or image	PDF ຫຼື ຮູບພາບ
 	No file chosen	ຍັງບໍ່ໄດ້ເລືອກໄຟລ໌
 	Page number	ໝາຍເລກໜ້າ
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 86242b6f41..30c15f1d1e 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -1002,6 +1002,8 @@
 	Removing the background puts the page's own backdrop back.	Pašalinus foną, grąžinamas paties puslapio baltas užpildas.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Paveikslėliu padengtas puslapis (nuskaitytas?): {pages}; fonas ten nesimatys.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Paveikslėliais padengti puslapiai (nuskaityti?): {pages}; fonas ten nesimatys.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Puslapis pasikeitė po fono pridėjimo, todėl jo baltas užpildas lieka išjungtas: {pages}. Ant balto popieriaus jis atrodo taip pat.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Puslapiai pasikeitė po fono pridėjimo, todėl jų balti užpildai lieka išjungti: {pages}. Ant balto popieriaus jie atrodo taip pat.
 	Report	Ataskaita
 	Report…	Ataskaita…
 	Requires user to enter a password for:	Naudotojas turi įvesti slaptažodį, kad galėtų:
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index 54bafb923a..f128c21a03 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -959,6 +959,8 @@
 	Removing the background puts the page's own backdrop back.	Når bakgrunnen fjernes, kommer sidens egen hvite flate tilbake.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Et bilde dekker side {pages} (en skanning?), så bakgrunnen vises ikke der.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Bilder dekker sidene {pages} (skanninger?), så bakgrunnen vises ikke der.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Side {pages} ble endret etter at bakgrunnen ble lagt til, så sidens egen hvite flate forblir slått av. På hvitt papir ser den lik ut.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Sidene {pages} ble endret etter at bakgrunnen ble lagt til, så sidenes egne hvite flater forblir slått av. På hvitt papir ser de like ut.
 	Report	Rapport
 	Report…	Rapport…
 	Requires user to enter a password for:	Krever at brukeren skriver inn et passord for:
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index d3b5abf68c..6567745a04 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -854,6 +854,8 @@
 	Removing the background puts the page's own backdrop back.	Usunięcie tła przywraca własne białe wypełnienie strony.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Strona zakryta obrazem (skan?): {pages}; tło nie będzie tam widoczne.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Strony zakryte obrazami (skany?): {pages}; tło nie będzie tam widoczne.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Strona zmieniona po dodaniu tła, więc jej własne białe wypełnienie pozostaje wyłączone: {pages}. Na białym papierze wygląda tak samo.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Strony zmienione po dodaniu tła, więc ich własne białe wypełnienia pozostają wyłączone: {pages}. Na białym papierze wyglądają tak samo.
 	PDF or image	PDF lub obraz
 	No file chosen	Nie wybrano pliku
 	Page number	Numer strony
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 53c2d8461d..5dfb7470c3 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -488,6 +488,8 @@
 	Removing the background puts the page's own backdrop back.	Remover o plano de fundo restaura o preenchimento branco da página.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Uma imagem cobre a página {pages} (uma digitalização?), então o plano de fundo não aparecerá nela.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Imagens cobrem as páginas {pages} (digitalizações?), então o plano de fundo não aparecerá nelas.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	A página {pages} mudou depois que o plano de fundo foi adicionado, então seu preenchimento branco próprio continua desligado. Em papel branco ela parece igual.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	As páginas {pages} mudaram depois que o plano de fundo foi adicionado, então seus preenchimentos brancos próprios continuam desligados. Em papel branco elas parecem iguais.
 	PDF or image	PDF ou imagem
 	No file chosen	Nenhum arquivo escolhido
 	Page number	Número da página
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index 5eb10620fb..a4200b7836 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -959,6 +959,8 @@
 	Removing the background puts the page's own backdrop back.	Eliminarea fundalului readuce umplerea albă proprie a paginii.
 	A picture covers page {pages} (a scan?), so the background won't show there.	O imagine acoperă pagina {pages} (o scanare?), deci fundalul nu se va vedea acolo.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Imagini acoperă paginile {pages} (scanări?), deci fundalul nu se va vedea acolo.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Pagina {pages} s-a schimbat după adăugarea fundalului, așa că umplerea ei albă proprie rămâne oprită. Pe hârtie albă arată la fel.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Paginile {pages} s-au schimbat după adăugarea fundalului, așa că umplerile lor albe proprii rămân oprite. Pe hârtie albă arată la fel.
 	Report	Raport
 	Report…	Raport…
 	Requires user to enter a password for:	Utilizatorul trebuie să introducă o parolă pentru:
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index c3eaea9ba3..357ff1aa8b 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -856,6 +856,8 @@
 	Removing the background puts the page's own backdrop back.	При удалении фона собственная белая заливка страницы возвращается.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Страница, закрытая изображением (скан?): {pages}; фон там не будет виден.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Страницы, закрытые изображениями (сканы?): {pages}; фон там не будет виден.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Страница изменена после добавления фона, поэтому её собственная белая заливка остаётся выключенной: {pages}. На белой бумаге она выглядит так же.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Страницы изменены после добавления фона, поэтому их собственные белые заливки остаются выключенными: {pages}. На белой бумаге они выглядят так же.
 	PDF or image	PDF или изображение
 	No file chosen	Файл не выбран
 	Page number	Номер страницы
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index d81b47794c..f899f273a9 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -1528,6 +1528,8 @@
 	Removing the background puts the page's own backdrop back.	Odstranitev ozadja povrne lastno belo polnilo strani.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Stran, ki jo prekriva slika (skeniranje?): {pages}; ozadje tam ne bo vidno.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Strani, ki jih prekrivajo slike (skeniranja?): {pages}; ozadje tam ne bo vidno.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Stran se je spremenila po dodajanju ozadja, zato njeno lastno belo polnilo ostane izklopljeno: {pages}. Na belem papirju je videti enako.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Strani so se spremenile po dodajanju ozadja, zato njihova lastna bela polnila ostanejo izklopljena: {pages}. Na belem papirju so videti enako.
 	Replacing images arrives on the web with image file pickers	Zamenjava slik bo v spletni različici na voljo z izbirniki slikovnih datotek
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Zamenjava slik na strani {p} bo v spletni različici na voljo z izbirniki slik ({i})
 	Reply	Odgovori
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index e0b8e0e726..2c638a388d 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -1481,6 +1481,8 @@
 	Removing the background puts the page's own backdrop back.	Heqja e sfondit e rikthen mbushjen e bardhë të faqes.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Një imazh e mbulon faqen {pages} (skanim?), prandaj sfondi nuk do të duket aty.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Imazhe mbulojnë faqet {pages} (skanime?), prandaj sfondi nuk do të duket aty.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Faqja {pages} ndryshoi pasi u shtua sfondi, ndaj mbushja e saj e bardhë mbetet e fikur. Në letër të bardhë duket njësoj.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Faqet {pages} ndryshuan pasi u shtua sfondi, ndaj mbushjet e tyre të bardha mbeten të fikura. Në letër të bardhë duken njësoj.
 	Replacing images arrives on the web with image file pickers	Zëvendësimi i imazheve vjen në ueb me zgjedhësit e skedarëve të imazhit
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Zëvendësimi i imazheve në faqen {p} vjen në ueb me zgjedhësit e imazhit ({i})
 	Reply	Përgjigju
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index adaefdbedf..78a7e72189 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -836,6 +836,8 @@ comment menu	Edit	సవరించు
 	Removing the background puts the page's own backdrop back.	నేపథ్యాన్ని తీసివేస్తే పేజీ సొంత తెల్లని నింపు తిరిగి వస్తుంది.
 	A picture covers page {pages} (a scan?), so the background won't show there.	పేజీ {pages}ని ఒక చిత్రం కప్పుతోంది (స్కాన్?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	పేజీలు {pages}ని చిత్రాలు కప్పుతున్నాయి (స్కాన్‌లు?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	నేపథ్యాన్ని జోడించిన తర్వాత పేజీ {pages} మారింది, కాబట్టి దాని సొంత తెల్లని నింపు ఆపివేయబడే ఉంటుంది. తెల్ల కాగితంపై అది అలాగే కనిపిస్తుంది.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	నేపథ్యాన్ని జోడించిన తర్వాత పేజీలు {pages} మారాయి, కాబట్టి వాటి సొంత తెల్లని నింపులు ఆపివేయబడే ఉంటాయి. తెల్ల కాగితంపై అవి అలాగే కనిపిస్తాయి.
 	PDF or image	PDF లేదా చిత్రం
 	No file chosen	ఫైల్ ఏదీ ఎంచుకోలేదు
 	Page number	పేజీ సంఖ్య
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index 2740313342..857ff8be03 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -815,6 +815,8 @@
 	Removing the background puts the page's own backdrop back.	การเอาพื้นหลังออกจะคืนพื้นสีขาวเดิมของหน้า
 	A picture covers page {pages} (a scan?), so the background won't show there.	มีรูปภาพปิดหน้า {pages} อยู่ (ภาพสแกน?) จึงจะมองไม่เห็นพื้นหลังที่นั่น
 	Pictures cover pages {pages} (scans?), so the background won't show there.	มีรูปภาพหลายรูปปิดหน้า {pages} อยู่ (ภาพสแกน?) จึงจะมองไม่เห็นพื้นหลังที่นั่น
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	หน้า {pages} เปลี่ยนไปหลังจากเพิ่มพื้นหลัง พื้นสีขาวของตัวเองจึงยังปิดอยู่ บนกระดาษสีขาวจะดูเหมือนเดิม
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	หน้า {pages} เปลี่ยนไปหลังจากเพิ่มพื้นหลัง พื้นสีขาวของหน้าเหล่านั้นจึงยังปิดอยู่ บนกระดาษสีขาวจะดูเหมือนเดิม
 	PDF or image	PDF หรือรูปภาพ
 	No file chosen	ยังไม่ได้เลือกไฟล์
 	Page number	เลขหน้า
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index a31216ca53..cf27544d3b 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -817,6 +817,8 @@
 	Removing the background puts the page's own backdrop back.	Arka planı kaldırmak, sayfanın kendi beyaz dolgusunu geri getirir.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Resimle kaplı sayfa (tarama mı?): {pages}; arka plan orada görünmez.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Resimlerle kaplı sayfalar (tarama mı?): {pages}; arka plan orada görünmez.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Arka plan eklendikten sonra değişen sayfa, bu yüzden kendi beyaz dolgusu kapalı kalıyor: {pages}. Beyaz kâğıtta aynı görünür.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Arka plan eklendikten sonra değişen sayfalar, bu yüzden kendi beyaz dolguları kapalı kalıyor: {pages}. Beyaz kâğıtta aynı görünürler.
 	PDF or image	PDF veya resim
 	No file chosen	Dosya seçilmedi
 	Page number	Sayfa numarası
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index c1f294dfd1..265c8f9dbc 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -860,6 +860,8 @@
 	Removing the background puts the page's own backdrop back.	Вилучення тла повертає власну білу заливку сторінки.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Сторінка, закрита зображенням (скан?): {pages}; тло там не буде видно.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Сторінки, закриті зображеннями (скани?): {pages}; тло там не буде видно.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Сторінка змінена після додавання тла, тому її власна біла заливка залишається вимкненою: {pages}. На білому папері вона виглядає так само.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Сторінки змінені після додавання тла, тому їхні власні білі заливки залишаються вимкненими: {pages}. На білому папері вони виглядають так само.
 	PDF or image	PDF або зображення
 	No file chosen	Файл не вибрано
 	Page number	Номер сторінки
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 526fbac0b1..2b9189c02c 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -996,6 +996,8 @@ theme	Appearance	Giao diện
 	Removing the background puts the page's own backdrop back.	Gỡ nền sẽ khôi phục lớp tô trắng riêng của trang.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Một hình ảnh phủ kín trang {pages} (bản quét?), nên nền sẽ không hiện ở đó.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Hình ảnh phủ kín các trang {pages} (bản quét?), nên nền sẽ không hiện ở đó.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Trang {pages} đã thay đổi sau khi thêm nền, nên lớp tô trắng riêng của nó vẫn tắt. Trên giấy trắng trông vẫn như cũ.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Các trang {pages} đã thay đổi sau khi thêm nền, nên lớp tô trắng riêng của chúng vẫn tắt. Trên giấy trắng trông vẫn như cũ.
 	Report	Báo cáo
 	Report…	Báo cáo…
 	Requires user to enter a password for:	Yêu cầu người dùng nhập mật khẩu cho:
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 0055556061..5b13735333 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -540,6 +540,8 @@
 	Removing the background puts the page's own backdrop back.	移除背景后，页面自己的白色填充会恢复。
 	A picture covers page {pages} (a scan?), so the background won't show there.	第 {pages} 页被一张图片覆盖（扫描件？），因此那里不会显示背景。
 	Pictures cover pages {pages} (scans?), so the background won't show there.	第 {pages} 页被图片覆盖（扫描件？），因此那里不会显示背景。
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	第 {pages} 页在添加背景后有改动，因此其自身的白色填充保持关闭。在白纸上看起来一样。
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	第 {pages} 页在添加背景后有改动，因此它们自身的白色填充保持关闭。在白纸上看起来一样。
 	PDF or image	PDF 或图像
 	No file chosen	未选择文件
 	Page number	页码
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index bb42c169a6..292d9d0e5e 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -492,6 +492,8 @@
 	Removing the background puts the page's own backdrop back.	移除背景後，頁面自己的白色填色會恢復。
 	A picture covers page {pages} (a scan?), so the background won't show there.	第 {pages} 頁被一張圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
 	Pictures cover pages {pages} (scans?), so the background won't show there.	第 {pages} 頁被圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	第 {pages} 頁在加入背景後有變更，因此其本身的白色填色維持關閉。在白紙上看起來一樣。
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	第 {pages} 頁在加入背景後有變更，因此它們本身的白色填色維持關閉。在白紙上看起來一樣。
 	PDF or image	PDF 或圖片
 	No file chosen	未選擇檔案
 	Page number	頁碼
diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index 2cf2450336..e9652be1a6 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -154,6 +154,16 @@ impl MarksDraft {
 /// How many runs of pages a message lists before it stops with "…".
 const LISTED_PAGE_RUNS: usize = 8;
 
+/// After Remove background: the pages (0-based, ascending) whose own white backdrop stays off,
+/// because they changed after the background was added (`pdfcraft_engine::EditNotice`).
+pub(crate) fn backdrops_left_off_message(pages: &[usize]) -> String {
+    pages_phrase(
+        pages,
+        tl!("Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper."),
+        tl!("Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper."),
+    )
+}
+
 /// `one` or `many` with `{pages}` replaced by `pages` (0-based, ascending) as 1-based runs
 /// ("1-3, 6"), so the message says which pages it means.
 fn pages_phrase(pages: &[usize], one: &str, many: &str) -> String {
diff --git a/crates/ui-egui/tests/it/marks.rs b/crates/ui-egui/tests/it/marks.rs
index 8edc9e3ce6..aaeddfd7ec 100644
--- a/crates/ui-egui/tests/it/marks.rs
+++ b/crates/ui-egui/tests/it/marks.rs
@@ -212,6 +212,39 @@ fn the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scan
     assert_eq!(backdrop(&h, 0), None, "Update keeps the backdrop replaced");
 }
 
+/// Remove background says which pages keep their own white backdrop off: here one whose
+/// backdrop copy changed before the fill since the background replaced it.
+#[test]
+fn remove_background_says_which_pages_keep_their_own_backdrop_off() {
+    let copy = "1 1 1 rg 0 0 300 400 re n 0 g 20 20 50 50 re f";
+    let bg = "q 1 0 0 rg 0 0 300 400 re f Q";
+    let fixture = format!(
+        "%PDF-1.7\n\
+         1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+         2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj\n\
+         3 0 obj << /Type /Page /Parent 2 0 R /Contents [4 0 R 5 0 R] >> endobj\n\
+         4 0 obj << /PCMark /Background /Length {} >> stream\n{bg}\nendstream endobj\n\
+         5 0 obj << /PCBackdrop << /Index 2 /Op (f) /Before <{}> >> /Length {} >> stream\n{copy}\nendstream endobj\n\
+         trailer << /Root 1 0 R >>\n%%EOF",
+        bg.len(),
+        "00".repeat(32),
+        copy.len()
+    );
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, fixture.into_bytes()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert_eq!(marks(&h), [MarkKind::Background]);
+    h.state_mut().execute("edit.background.remove");
+    h.run_steps(2);
+    assert!(marks(&h).is_empty());
+    let toast = h.state().toast.as_ref().map(|(t, _)| t.clone()).unwrap_or_default();
+    assert_eq!(toast, "Page 1 changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.");
+}
+
 /// Pages from 1 to 1 stays one page: the dialog used to turn "to" back into the last page on
 /// every frame while both were 1, so only page 1 could not be chosen alone. The field starts on
 /// the last page.
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index ac21f74bf4..98b5096c6c 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2509,7 +2509,7 @@ status = "shipped"
 commands = ["edit.background"]
 tools = ["doc_background", "doc_backdrops"]
 evidence = ["crates/ui-egui/tests/it/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/it/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright", "crates/automation/tests/it/backdrop.rs::a_background_shows_on_a_page_that_paints_its_own_white_backdrop", "crates/ui-egui/tests/it/marks.rs::the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scans", "crates/edit/src/backdrop_tests.rs::content_that_is_not_a_page_backdrop_is_left_alone"]
-notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove puts it back unless the content was edited since). Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space; the dialog preview is a schematic, not the page"
+notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove turns it back on, after edits and redactions too, unless the operators before it changed or it would no longer be painted first, and then says which pages keep it off). The replaced copy's tag holds no page content or reference, so text a redaction or Remove Hidden Information takes off such a page leaves the file. Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space; the dialog preview is a schematic, not the page"
 
 [[feature]]
 id = "edit.background-update-remove"
@@ -2520,8 +2520,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.background.update", "edit.background.remove"]
 tools = ["doc_background", "doc_remove_marks"]
-evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/edit/src/backdrop_tests.rs::a_white_fill_backdrop_is_replaced_and_put_back_when_the_background_goes", "crates/edit/src/backdrop_tests.rs::a_backdrop_copy_edited_since_is_kept_when_the_background_goes"]
-notes = "Remove also restores a page backdrop Add replaced"
+evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/edit/src/backdrop_tests.rs::a_white_fill_backdrop_is_replaced_and_put_back_when_the_background_goes", "crates/edit/src/backdrop_tests.rs::an_edit_after_the_fill_is_kept_and_the_backdrop_still_comes_back", "crates/edit/src/backdrop_tests.rs::a_copy_written_out_again_with_other_spacing_still_comes_back", "crates/edit/src/backdrop_tests.rs::a_change_before_the_fill_leaves_it_off_and_names_the_page", "crates/edit/src/backdrop_tests.rs::a_fill_that_would_cover_content_painted_before_it_stays_off", "crates/engine/src/tests.rs::remove_background_names_the_pages_whose_own_backdrop_stays_off", "crates/automation/tests/it/backdrop.rs::removed_text_leaves_the_file_when_a_background_replaced_the_pages_backdrop"]
+notes = "Remove also turns back on a page backdrop Add replaced, keeping edits made after it; where that isn't safe it says which pages keep it off"
 
 [[feature]]
 id = "edit.decoration-profiles"

From 632ba10ed5c8b41d9f53a0385514aeadeb4b4b31 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sat, 24 Oct 2026 18:17:48 +1100
Subject: [PATCH 060/270] fix(ui): Redo from the menu with typing in a page box
 stays in the box

Redo from the menu or toolbar closed the box first, which applied its
typing: a new edit that dropped the document's waiting Redo, and the
Redo itself then failed. The step was gone. Redo now goes to the box as
the key does: what Undo took back there comes back, and typing the page
doesn't have yet stays as it is, with the document's Redo waiting.

A new text box the document refused was put back without the request
to select the item once it exists, which stayed behind. It is put back
with the box.
---
 crates/ui-egui/src/editing.rs      | 78 ++++++++++++++++++++++++++++--
 crates/ui-egui/tests/it/content.rs | 33 +++++++++++++
 crates/ui-egui/tests/it/editing.rs | 40 +++++++++++++++
 3 files changed, 148 insertions(+), 3 deletions(-)

diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 39e0fd1adf..99cd53eff4 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -222,11 +222,31 @@ impl PdfCraftApp {
     pub fn redo(&mut self) {
         if self.combine_showing() {
             self.combine_history_step(false);
-        } else {
+        } else if !self.redo_in_page_box() {
             self.history_step(false);
         }
     }
 
+    /// Redo from the menu or toolbar while a box on the page has typing of its own: the step is
+    /// the box's, as the key's is. What Undo took back in the box comes back; typing the page
+    /// doesn't have yet stays as it is, since applying it first is a new edit, which drops the
+    /// document's Redo. True when the box took the step.
+    fn redo_in_page_box(&mut self) -> bool {
+        let Some(ctx) = self.ctx.clone() else { return false };
+        let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
+        if let Some(ed) = view.line_editor.as_mut() {
+            let Some(text) = redo_typing(&ctx, crate::edit_text_ui::input_id(), &ed.text) else { return ed.has_unsaved_text() };
+            ed.text = text;
+            return true;
+        }
+        if let Some(d) = view.content.draft.as_mut() {
+            let Some(text) = redo_typing(&ctx, crate::content_ui::input_id(), &d.text) else { return d.has_unapplied_typing() };
+            d.text = text;
+            return true;
+        }
+        false
+    }
+
     fn history_step(&mut self, undo: bool) {
         let Some((i, id)) = self.active_ids() else { return };
         if !self.close_text_editors(i, id) {
@@ -274,12 +294,13 @@ impl PdfCraftApp {
         }
         let added = self.session.get(id).map(|d| d.added().to_vec()).unwrap_or_default();
         let Some(view) = self.views.get_mut(i) else { return true };
-        let draft = view.content.draft.clone();
+        // Finishing new text also asks for it to be selected once it exists: put that back too.
+        let (draft, select_added) = (view.content.draft.clone(), view.content.select_added);
         if let Some(edit) = view.content.finish_draft(&added)
             && !self.apply_edit(edit)
         {
             if let Some(view) = self.views.get_mut(i) {
-                view.content.draft = draft;
+                (view.content.draft, view.content.select_added) = (draft, select_added);
             }
             return false;
         }
@@ -1217,6 +1238,18 @@ fn bookmark_at<'a>(items: &'a [pdfcraft_render::OutlineItem], path: &[usize]) ->
     if rest.is_empty() { Some(item) } else { bookmark_at(&item.children, rest) }
 }
 
+/// The box's own Redo, as the key does it: the typing Undo took back, put back in the box's text,
+/// with the box's history and cursor moved along. None when the box has nothing to redo.
+fn redo_typing(ctx: &egui::Context, id: egui::Id, text: &str) -> Option<String> {
+    let mut state = egui::TextEdit::load_state(ctx, id)?;
+    let mut undoer = state.undoer();
+    let (range, redone) = undoer.redo(&(state.cursor.char_range()?, text.to_owned()))?.clone();
+    state.set_undoer(undoer);
+    state.cursor.set_char_range(Some(range));
+    egui::TextEdit::store_state(ctx, id, state);
+    Some(redone)
+}
+
 #[cfg(test)]
 mod tests {
     use super::{SaveTarget, is_mail_temp_copy, write_atomically, write_atomically_syncing, write_atomically_with};
@@ -1493,6 +1526,45 @@ mod tests {
         out
     }
 
+    /// `one_page_pdf`, opening without a password, whose permissions refuse changes.
+    fn no_changes_pdf() -> Vec<u8> {
+        let mut doc = pdfcraft_cos::Document::open(std::sync::Arc::new(one_page_pdf())).unwrap();
+        let encryption = pdfcraft_cos::NewEncryption {
+            algorithm: pdfcraft_cos::Algorithm::Aes256,
+            user_password: "",
+            owner_password: "owner",
+            permissions: -1 ^ 8,
+            encrypt_metadata: true,
+            seed: [4; 32],
+        };
+        doc.set_encryption(&encryption).unwrap();
+        pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
+    }
+
+    /// Undo with a new text box open on a document that refuses changes: the box is put back as
+    /// it was. Finishing it had asked for the new item to be selected, and that request stayed
+    /// behind once the add was refused.
+    #[test]
+    fn a_refused_text_box_is_put_back_whole() {
+        let mut app = crate::PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("a.pdf", None, no_changes_pdf()).unwrap();
+        let style = crate::content_ui::default_style();
+        app.views[0].content.draft = Some(crate::content_ui::TextDraft {
+            page: 0,
+            index: None,
+            rect: [20.0, 20.0, 120.0, 40.0],
+            text: "Typed".into(),
+            style,
+            focus: false,
+            typing_from: None,
+        });
+        app.undo();
+        let content = &app.views[0].content;
+        assert_eq!(content.draft.as_ref().map(|d| d.text.as_str()), Some("Typed"), "the refused box stays open");
+        assert_eq!(content.select_added, None, "nothing was added to select");
+    }
+
     #[test]
     fn save_asks_where_to_keep_an_email_attachment_and_leaves_the_temporary_copy_alone() {
         let dir = staging_dir("mail-temp");
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 41957e6f69..81d6e00049 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -892,6 +892,39 @@ fn redo_after_undoing_typing_in_added_text_puts_it_back() {
     assert_eq!(doc.can_redo(), Some("Edit content"), "the document's Redo still waits");
 }
 
+/// Redo from the menu with retyping the page doesn't have yet in an added text box: the typing
+/// stays in the box and the document's Redo waits (closing the box first wrote the typing, which
+/// dropped that Redo). After Undo in the box, Redo from the menu puts the typing back there.
+#[test]
+fn redo_from_the_menu_with_retyping_in_the_box_keeps_the_documents_redo() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    let bold = pdfcraft_engine::AddedText { bold: true, ..text };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::UpdateContent { page: 0, index: 0, content: pdfcraft_engine::AddedContent::Text(bold) }));
+    assert!(h.state_mut().execute("edit.undo"));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "the typing stays in the box");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes it back in the box");
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "Redo from the menu puts it back");
+    let s = h.state();
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit content"), "the document's Redo still waits");
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index e87697403f..dd63003653 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6068,6 +6068,46 @@ fn redo_after_undoing_typing_puts_the_typing_back() {
     assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
 }
 
+/// Redo from the menu or toolbar with typing in the box the page doesn't have yet. Closing the
+/// box first applied the typing, a new edit that dropped the document's waiting Redo, and the
+/// Redo itself then failed: the step was gone. The typing now stays in the box and the Redo
+/// waits; once Undo in the box takes the typing back, Redo from the menu puts it back there.
+#[test]
+fn redo_from_the_menu_with_typing_in_the_box_keeps_the_documents_redo() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    // Undo the bold (closing the editor), so the document has it to redo.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    let typed = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    {
+        let s = h.state();
+        let ed = s.views[0].line_editor.as_ref().expect("the box stays open");
+        assert_eq!(ed.text, typed, "the typing stays in the box, unapplied");
+        let doc = s.session.get(s.views[0].id).unwrap();
+        assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
+    }
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "Undo takes the typing back in the box");
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    let s = h.state();
+    assert_eq!(s.views[0].line_editor.as_ref().expect("still open").text, typed, "Redo from the menu puts the typing back");
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
+}
+
 /// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
 /// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
 /// Typing in one tab, taken back with Undo, then came back with Redo in the other tab.

From dce32fb2ab6cc6d2acb55cfecd99fa6be8e4a335 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sat, 24 Oct 2026 18:17:48 +1100
Subject: [PATCH 061/270] fix(ui): Redo from the menu with typing in a page box
 stays in the box

Redo from the menu or toolbar closed the box first, which applied its
typing: a new edit that dropped the document's waiting Redo, and the
Redo itself then failed. The step was gone. Redo now goes to the box as
the key does: what Undo took back there comes back, and typing the page
doesn't have yet stays as it is, with the document's Redo waiting.

A new text box the document refused was put back without the request
to select the item once it exists, which stayed behind. It is put back
with the box.

Carried from #4179 (632ba10e). This branch already routed the menu's
Redo to the box; the test from #4179 covers what its own
redo_from_the_menu_puts_the_typing_back_in_the_box did, so that one
goes.
---
 crates/ui-egui/src/editing.rs      | 45 ++++++++++++++++++++++++++++--
 crates/ui-egui/tests/it/content.rs | 33 ++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 26 +++++++++++------
 3 files changed, 93 insertions(+), 11 deletions(-)

diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index b7109b9c50..7b65592c1d 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -296,12 +296,13 @@ impl PdfCraftApp {
         }
         let added = self.session.get(id).map(|d| d.added().to_vec()).unwrap_or_default();
         let Some(view) = self.views.get_mut(i) else { return true };
-        let draft = view.content.draft.clone();
+        // Finishing new text also asks for it to be selected once it exists: put that back too.
+        let (draft, select_added) = (view.content.draft.clone(), view.content.select_added);
         if let Some(edit) = view.content.finish_draft(&added)
             && !self.apply_edit(edit)
         {
             if let Some(view) = self.views.get_mut(i) {
-                view.content.draft = draft;
+                (view.content.draft, view.content.select_added) = (draft, select_added);
             }
             return false;
         }
@@ -1583,6 +1584,46 @@ mod tests {
         out
     }
 
+    /// `one_page_pdf`, opening without a password, whose permissions refuse changes.
+    fn no_changes_pdf() -> Vec<u8> {
+        let mut doc = pdfcraft_cos::Document::open(std::sync::Arc::new(one_page_pdf())).unwrap();
+        let encryption = pdfcraft_cos::NewEncryption {
+            algorithm: pdfcraft_cos::Algorithm::Aes256,
+            user_password: "",
+            owner_password: "owner",
+            permissions: -1 ^ 8,
+            encrypt_metadata: true,
+            seed: [4; 32],
+        };
+        doc.set_encryption(&encryption).unwrap();
+        pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
+    }
+
+    /// Undo with a new text box open on a document that refuses changes: the box is put back as
+    /// it was. Finishing it had asked for the new item to be selected, and that request stayed
+    /// behind once the add was refused.
+    #[test]
+    fn a_refused_text_box_is_put_back_whole() {
+        let mut app = crate::PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("a.pdf", None, no_changes_pdf()).unwrap();
+        let style = crate::content_ui::default_style();
+        app.views[0].content.draft = Some(crate::content_ui::TextDraft {
+            page: 0,
+            index: None,
+            rect: [20.0, 20.0, 120.0, 40.0],
+            text: "Typed".into(),
+            style,
+            focus: false,
+            selection: None,
+            typing_from: None,
+        });
+        app.undo();
+        let content = &app.views[0].content;
+        assert_eq!(content.draft.as_ref().map(|d| d.text.as_str()), Some("Typed"), "the refused box stays open");
+        assert_eq!(content.select_added, None, "nothing was added to select");
+    }
+
     #[test]
     fn save_asks_where_to_keep_an_email_attachment_and_leaves_the_temporary_copy_alone() {
         let dir = staging_dir("mail-temp");
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 18e3144f83..8fefd84ecd 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1008,6 +1008,39 @@ fn redo_after_undoing_typing_in_added_text_puts_it_back() {
     assert_eq!(doc.can_redo(), Some("Edit content"), "the document's Redo still waits");
 }
 
+/// Redo from the menu with retyping the page doesn't have yet in an added text box: the typing
+/// stays in the box and the document's Redo waits (closing the box first wrote the typing, which
+/// dropped that Redo). After Undo in the box, Redo from the menu puts the typing back there.
+#[test]
+fn redo_from_the_menu_with_retyping_in_the_box_keeps_the_documents_redo() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    let bold = pdfcraft_engine::AddedText { bold: true, ..text };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::UpdateContent { page: 0, index: 0, content: pdfcraft_engine::AddedContent::Text(bold) }));
+    assert!(h.state_mut().execute("edit.undo"));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "the typing stays in the box");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes it back in the box");
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "Redo from the menu puts it back");
+    let s = h.state();
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit content"), "the document's Redo still waits");
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index f68f997a16..ae33cfd23a 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6202,11 +6202,12 @@ fn a_second_alignment_for_a_selected_row_stays_on_that_row() {
     assert!((mid - centre).abs() < 1.0, "the last row is centred: {last:?} in {wide:?}");
 }
 
-/// Redo from the menu (not the key) after Undo in the box took the typing back: the typing comes
-/// back in the box, and the document's own Redo (a formatting change) still waits. The menu went
-/// to the document, which applied the box first: a new edit, which dropped that Redo.
+/// Redo from the menu or toolbar with typing in the box the page doesn't have yet. Closing the
+/// box first applied the typing, a new edit that dropped the document's waiting Redo, and the
+/// Redo itself then failed: the step was gone. The typing now stays in the box and the Redo
+/// waits; once Undo in the box takes the typing back, Redo from the menu puts it back there.
 #[test]
-fn redo_from_the_menu_puts_the_typing_back_in_the_box() {
+fn redo_from_the_menu_with_typing_in_the_box_keeps_the_documents_redo() {
     let mut h = harness(1, |_| {});
     assert!(h.state_mut().execute("edit.edit_text"));
     h.run_steps(2);
@@ -6222,16 +6223,23 @@ fn redo_from_the_menu_puts_the_typing_back_in_the_box() {
     h.event(egui::Event::Text(" more".into()));
     h.run_steps(2);
     let typed = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    {
+        let s = h.state();
+        let ed = s.views[0].line_editor.as_ref().expect("the box stays open");
+        assert_eq!(ed.text, typed, "the typing stays in the box, unapplied");
+        let doc = s.session.get(s.views[0].id).unwrap();
+        assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
+    }
     h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
     h.run_steps(3);
-    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the typing is taken back");
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "Undo takes the typing back in the box");
     assert!(h.state_mut().execute("edit.redo"));
     h.run_steps(3);
     let s = h.state();
-    let ed = s.views[0].line_editor.as_ref().expect("still typing");
-    assert_eq!(ed.text, typed, "Redo puts the typing back");
-    let doc = s.session.get(s.views[0].id).unwrap();
-    assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
+    assert_eq!(s.views[0].line_editor.as_ref().expect("still open").text, typed, "Redo from the menu puts the typing back");
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
 }
 
 /// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text

From 4f9b17165d2827d6638e6d2ebe583a18a5c59b58 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 01:23:16 +1100
Subject: [PATCH 062/270] fix(ui): menu Redo is enabled for the open text box's
 own Redo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Edit ▸ Redo and the toolbar button followed only the document's Redo.
After Undo in a paragraph or added text box took the typing back, with
no document step to redo, they stayed disabled and only the key could
put the typing back. Redo is now also enabled when the box open on the
page has a Redo of its own: the step redo_in_page_box takes. It doesn't
ask for the box's focus, which the menu has taken by then.
---
 crates/ui-egui/src/commands.rs     |  4 +++-
 crates/ui-egui/src/editing.rs      | 22 ++++++++++++++++++++--
 crates/ui-egui/tests/it/content.rs | 25 +++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 23 +++++++++++++++++++++++
 4 files changed, 71 insertions(+), 3 deletions(-)

diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 2ac0f82022..25cb73beba 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -84,7 +84,9 @@ impl PdfCraftApp {
         if self.combine_showing() && matches!(spec.needs, commands::Needs::Undo | commands::Needs::Redo) {
             return self.combine_can_undo(spec.needs == commands::Needs::Undo);
         }
-        commands::is_enabled(spec, &self.session, self.active_ids().map(|(_, id)| id))
+        // Redo also takes back what Undo took in a box open on the page, with no document step.
+        (commands::is_enabled(spec, &self.session, self.active_ids().map(|(_, id)| id))
+            || spec.needs == commands::Needs::Redo && self.open_box_can_redo())
             && (spec.id != "edit.copy"
                 || self
                     .active
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 455f8db4cc..207a3f4830 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -331,8 +331,19 @@ impl PdfCraftApp {
         } else {
             return false;
         };
-        egui::TextEdit::load_state(ctx, id)
-            .is_some_and(|state| state.cursor.char_range().is_some_and(|range| state.undoer().has_redo(&(range, text.clone()))))
+        has_typing_to_redo(ctx, id, text)
+    }
+
+    /// Whether the box open on the page has a Redo of its own, the step
+    /// [`Self::redo_in_page_box`] takes for Redo from the menu or toolbar: focus has moved to the
+    /// menu by then, so unlike [`Self::page_box_can_redo`] this doesn't ask for it.
+    pub(crate) fn open_box_can_redo(&self) -> bool {
+        let Some(ctx) = &self.ctx else { return false };
+        let Some(view) = self.active.and_then(|i| self.views.get(i)) else { return false };
+        if let Some(ed) = &view.line_editor {
+            return has_typing_to_redo(ctx, crate::edit_text_ui::input_id(), &ed.text);
+        }
+        view.content.draft.as_ref().is_some_and(|d| has_typing_to_redo(ctx, crate::content_ui::input_id(), &d.text))
     }
 
     /// Typing in a box on the page (a paragraph being edited, added text) that the page doesn't
@@ -1329,6 +1340,13 @@ fn bookmark_at<'a>(items: &'a [pdfcraft_render::OutlineItem], path: &[usize]) ->
     if rest.is_empty() { Some(item) } else { bookmark_at(&item.children, rest) }
 }
 
+/// Whether the page text box `id`, showing `text`, has typing its own Redo would put back: the
+/// test egui makes when it handles the key.
+fn has_typing_to_redo(ctx: &egui::Context, id: egui::Id, text: &str) -> bool {
+    egui::TextEdit::load_state(ctx, id)
+        .is_some_and(|state| state.cursor.char_range().is_some_and(|range| state.undoer().has_redo(&(range, text.to_owned()))))
+}
+
 /// The box's own Redo, as the key does it: the typing Undo took back, put back in the box's text,
 /// with the box's history and cursor moved along. None when the box has nothing to redo.
 fn redo_typing(ctx: &egui::Context, id: egui::Id, text: &str) -> Option<String> {
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 8abf757570..c2edfb8336 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -971,6 +971,31 @@ fn redo_from_the_menu_with_retyping_in_the_box_keeps_the_documents_redo() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit content"), "the document's Redo still waits");
 }
 
+/// Redo from the menu after Undo in an added text box, with nothing for the document to redo: the
+/// menu item follows the box's own Redo too, and puts the typing back.
+#[test]
+fn redo_from_the_menu_is_enabled_for_the_added_text_boxs_own_typing() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes it back in the box");
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), None, "the document has nothing to redo");
+    assert!(h.state_mut().execute("edit.redo"), "Redo is enabled for the box's own step");
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "Redo puts it back");
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 4b26d26d21..8ce8073285 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6383,6 +6383,29 @@ fn redo_from_the_menu_with_typing_in_the_box_keeps_the_documents_redo() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
 }
 
+/// Redo from the menu after Undo in the box took the typing back, with nothing for the document
+/// to redo: the menu item follows the box's own Redo too, and puts the typing back. It was
+/// disabled, as it followed only the document's Redo, and only the key could do it.
+#[test]
+fn redo_from_the_menu_is_enabled_for_the_boxs_own_typing() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    let typed = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the typing is taken back");
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), None, "the document has nothing to redo");
+    assert!(h.state_mut().execute("edit.redo"), "Redo is enabled for the box's own step");
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().expect("still open").text, typed, "Redo puts the typing back");
+}
+
 /// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
 /// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
 /// Typing in one tab, taken back with Undo, then came back with Redo in the other tab.

From f5e4b8e5709856d3dc5b6ff8e0f716eab7f8fd6e Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 01:23:16 +1100
Subject: [PATCH 063/270] fix(ui): menu Redo is enabled for the open text box's
 own Redo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Edit ▸ Redo and the toolbar button followed only the document's Redo.
After Undo in a paragraph or added text box took the typing back, with
no document step to redo, they stayed disabled and only the key could
put the typing back. Redo is now also enabled when the box open on the
page has a Redo of its own: the step redo_in_page_box takes. It doesn't
ask for the box's focus, which the menu has taken by then.
---
 crates/ui-egui/src/commands.rs     |  4 +++-
 crates/ui-egui/src/editing.rs      | 21 +++++++++++++++++++--
 crates/ui-egui/tests/it/content.rs | 25 +++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 23 +++++++++++++++++++++++
 4 files changed, 70 insertions(+), 3 deletions(-)

diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 2ac0f82022..25cb73beba 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -84,7 +84,9 @@ impl PdfCraftApp {
         if self.combine_showing() && matches!(spec.needs, commands::Needs::Undo | commands::Needs::Redo) {
             return self.combine_can_undo(spec.needs == commands::Needs::Undo);
         }
-        commands::is_enabled(spec, &self.session, self.active_ids().map(|(_, id)| id))
+        // Redo also takes back what Undo took in a box open on the page, with no document step.
+        (commands::is_enabled(spec, &self.session, self.active_ids().map(|(_, id)| id))
+            || spec.needs == commands::Needs::Redo && self.open_box_can_redo())
             && (spec.id != "edit.copy"
                 || self
                     .active
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 6040b5c76f..cba20e76bc 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -333,8 +333,19 @@ impl PdfCraftApp {
         } else {
             return false;
         };
-        egui::TextEdit::load_state(ctx, id)
-            .is_some_and(|state| state.cursor.char_range().is_some_and(|range| state.undoer().has_redo(&(range, text.clone()))))
+        has_typing_to_redo(ctx, id, text)
+    }
+
+    /// Whether the box open on the page has a Redo of its own, the step
+    /// [`Self::redo_in_page_box`] takes for Redo from the menu or toolbar: focus has moved to the
+    /// menu by then, so unlike [`Self::page_box_can_redo`] this doesn't ask for it.
+    pub(crate) fn open_box_can_redo(&self) -> bool {
+        let Some(ctx) = &self.ctx else { return false };
+        let Some(view) = self.active.and_then(|i| self.views.get(i)) else { return false };
+        if let Some(ed) = &view.line_editor {
+            return has_typing_to_redo(ctx, crate::edit_text_ui::input_id(), &ed.text);
+        }
+        view.content.draft.as_ref().is_some_and(|d| has_typing_to_redo(ctx, crate::content_ui::input_id(), &d.text))
     }
 
     /// Typing in a box on the page (a paragraph being edited, added text) that the page doesn't
@@ -1343,6 +1354,12 @@ fn bookmark_at<'a>(items: &'a [pdfcraft_render::OutlineItem], path: &[usize]) ->
     if rest.is_empty() { Some(item) } else { bookmark_at(&item.children, rest) }
 }
 
+/// Whether the page text box `id`, showing `text`, has typing its own Redo would put back: the
+/// test egui makes when it handles the key.
+fn has_typing_to_redo(ctx: &egui::Context, id: egui::Id, text: &str) -> bool {
+    egui::TextEdit::load_state(ctx, id)
+        .is_some_and(|state| state.cursor.char_range().is_some_and(|range| state.undoer().has_redo(&(range, text.to_owned()))))
+}
 #[cfg(test)]
 mod tests {
     use super::{SaveTarget, is_mail_temp_copy, save_dialog_folder, write_atomically, write_atomically_syncing, write_atomically_with};
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index f8e93ecd28..592981acb7 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1038,6 +1038,31 @@ fn redo_from_the_menu_with_retyping_in_the_box_keeps_the_documents_redo() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit content"), "the document's Redo still waits");
 }
 
+/// Redo from the menu after Undo in an added text box, with nothing for the document to redo: the
+/// menu item follows the box's own Redo too, and puts the typing back.
+#[test]
+fn redo_from_the_menu_is_enabled_for_the_added_text_boxs_own_typing() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes it back in the box");
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), None, "the document has nothing to redo");
+    assert!(h.state_mut().execute("edit.redo"), "Redo is enabled for the box's own step");
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "Redo puts it back");
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 671d3d12b5..cae884622f 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6478,6 +6478,29 @@ fn redo_from_the_menu_with_typing_in_the_box_keeps_the_documents_redo() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
 }
 
+/// Redo from the menu after Undo in the box took the typing back, with nothing for the document
+/// to redo: the menu item follows the box's own Redo too, and puts the typing back. It was
+/// disabled, as it followed only the document's Redo, and only the key could do it.
+#[test]
+fn redo_from_the_menu_is_enabled_for_the_boxs_own_typing() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    let typed = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the typing is taken back");
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), None, "the document has nothing to redo");
+    assert!(h.state_mut().execute("edit.redo"), "Redo is enabled for the box's own step");
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().expect("still open").text, typed, "Redo puts the typing back");
+}
+
 /// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
 /// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
 /// Typing in one tab, taken back with Undo, then came back with Redo (the key or the menu) in the

From 80f919977b1e31ef830dcbfb21be51a71426f944 Mon Sep 17 00:00:00 2001
From: Lcoding15 <125505497+Lcoding15@users.noreply.github.com>
Date: Sat, 24 Oct 2026 17:10:22 +0200
Subject: [PATCH 064/270] M2: page_render and render_preview report the render
 warnings next to the PNG (#4340)

The renderer reports when a page's picture is incomplete or approximate
(content cut at the page's safety budget, a colour painted in a fallback
colour), but only `pdfcraft-cli render` showed it. `page_render` and
`render_preview` returned the PNG alone, so a script or MCP client could
not tell that the image was not the whole page.

Both tools now return a JSON part after the PNG when the page has
warnings: `{ "page": 1, "warnings": [...] }`, with the sentences the CLI
prints. Warnings are strings, like every other tool's `warnings`, so
`command_run` can add its own to the same list. A page without warnings
still returns the PNG alone, so existing callers see no change.

The viewer notice the issue also asks for is left for a separate change.
---
 crates/automation/README.md                   |   6 +
 crates/automation/src/conventions.rs          |   8 +-
 crates/automation/src/lib.rs                  |  34 ++++-
 crates/automation/src/tools.rs                |   4 +-
 crates/automation/tests/it/main.rs            |   1 +
 crates/automation/tests/it/render_warnings.rs | 119 ++++++++++++++++++
 6 files changed, 161 insertions(+), 11 deletions(-)
 create mode 100644 crates/automation/tests/it/render_warnings.rs

diff --git a/crates/automation/README.md b/crates/automation/README.md
index cdaaa13e64..2b36242e53 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -181,6 +181,12 @@ working document unchanged.
 `content_list` or `object_list`. It removes only that item in a read-only preview and is
 mutually exclusive with `hide_text_block`.
 
+When the renderer reports a warning for the page, `page_render` and `render_preview` return a
+JSON part after the PNG, `{ "page": 1, "warnings": [...] }`, with the sentences
+`pdfcraft-cli render` prints: "content past the page's safety budget was skipped" and "a colour
+that could not be computed was painted in a fallback colour". A page without warnings returns
+the PNG alone.
+
 
 ## Existing text and document fonts
 
diff --git a/crates/automation/src/conventions.rs b/crates/automation/src/conventions.rs
index ac670109fb..a84c6488a4 100644
--- a/crates/automation/src/conventions.rs
+++ b/crates/automation/src/conventions.rs
@@ -1,7 +1,7 @@
 //! Shared command/inspection/preview entry points, using the existing confined tool path.
 use serde_json::{Value, json};
 
-use crate::{Args, Automation, Content, Result, ToolError, encode_png, failed, info, tools};
+use crate::{Args, Automation, Content, Result, ToolError, failed, info, rendered_content, tools};
 use pdfcraft_engine::commands;
 use pdfcraft_render::{RenderRequest, RequestKind};
 
@@ -108,7 +108,8 @@ impl Automation {
         Ok(json!({"documents":self.session.docs().iter().map(info).collect::<Vec<_>>()}))
     }
 
-    pub(crate) fn render_preview(&mut self, args: &Args) -> Result<Content> {
+    /// A bounded PNG of the page, with its render warnings after it as `page_render` gives them.
+    pub(crate) fn render_preview(&mut self, args: &Args) -> Result<Vec<Content>> {
         let id = if args.opt_int("doc")?.is_some() {
             self.doc(args)?.id
         } else {
@@ -134,7 +135,6 @@ impl Automation {
         if let Some(error) = out.error {
             return Err(failed(error));
         }
-        let data = encode_png(out.width, out.height, &out.rgba)?;
-        Ok(Content::Png { data, width: out.width, height: out.height })
+        rendered_content(&out, page)
     }
 }
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index e94354021f..5b6a0219fb 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -225,7 +225,7 @@ impl Automation {
                 let edit = Edit::SetInfo { key: a.str("key")?.into(), value: a.str("value")?.into() };
                 self.apply(&a, edit)?
             }
-            "page_render" => return self.page_render(&a).map(|c| vec![c]),
+            "page_render" => return self.page_render(&a),
             "comment_image_preview" => return self.comment_image_preview(&a),
             "text_extract" => self.text_extract(&a)?,
             "text_word_count" => self.text_word_count(&a)?,
@@ -329,7 +329,7 @@ impl Automation {
             "command_run" => return self.command_run(&a),
             "command_batch" => self.command_batch(&a)?,
             "doc_inspect" => self.doc_inspect(&a)?,
-            "render_preview" => return self.render_preview(&a).map(|c| vec![c]),
+            "render_preview" => return self.render_preview(&a),
             "page_number" => {
                 use pdfcraft_organize::LabelStyle as L;
                 let n = self.doc(&a)?.info.pages.len();
@@ -2023,7 +2023,9 @@ impl Automation {
         Ok(&mut entry.1)
     }
 
-    fn page_render(&mut self, a: &Args) -> Result<Content> {
+    /// The page as a PNG, followed by a JSON part listing the render warnings when there are any,
+    /// so a caller can tell that the picture is incomplete, as `pdfcraft-cli render` does (#4340).
+    fn page_render(&mut self, a: &Args) -> Result<Vec<Content>> {
         let id = self.doc(a)?.id;
         let page = self.page(a)?;
         let dpi = a.opt_num("dpi")?.unwrap_or(DEFAULT_DPI);
@@ -2056,8 +2058,7 @@ impl Automation {
         if let Some(e) = out.error {
             return Err(failed(format!("page {} could not be rendered: {e}", page + 1)));
         }
-        let data = encode_png(out.width, out.height, &out.rgba)?;
-        Ok(Content::Png { data, width: out.width, height: out.height })
+        rendered_content(&out, page)
     }
 
     /// A page as RGBA pixels, without encoding a PNG. `page` is 1-based and `scale` is pixels
@@ -2733,6 +2734,29 @@ fn encode_png(width: u32, height: u32, premultiplied: &[u8]) -> Result<Vec<u8>>
     pdfcraft_engine::export::encode_png(width, height, premultiplied).map_err(failed)
 }
 
+/// The output of a page-rendering tool: the PNG of the 0-based `page`, followed by a JSON part
+/// listing its render warnings when there are any. Without warnings it is the PNG alone, as it
+/// always was.
+fn rendered_content(out: &pdfcraft_render::RenderedPage, page: usize) -> Result<Vec<Content>> {
+    let data = encode_png(out.width, out.height, &out.rgba)?;
+    let mut content = vec![Content::Png { data, width: out.width, height: out.height }];
+    if !out.warnings.is_empty() {
+        // Sentences, like the other tools' `warnings`, so command_run can add its own to the list.
+        let warnings: Vec<&str> = out.warnings.iter().map(|&w| render_warning_text(w)).collect();
+        content.push(Content::Json(json!({ "page": page.saturating_add(1), "warnings": warnings })));
+    }
+    Ok(content)
+}
+
+/// What a render warning means, in the words `pdfcraft-cli render` prints for it.
+fn render_warning_text(warning: pdfcraft_render::RenderWarning) -> &'static str {
+    use pdfcraft_render::RenderWarning;
+    match warning {
+        RenderWarning::ContentTruncated => "content past the page's safety budget was skipped",
+        RenderWarning::ColourFallback => "a colour that could not be computed was painted in a fallback colour",
+    }
+}
+
 /// Extract the text of `pages` (0-based) with one renderer per worker thread.
 fn extract_parallel(bytes: &Arc<Vec<u8>>, password: Option<Arc<str>>, pages: &[usize]) -> PageTexts {
     let extract = |r: &mut PageRenderer, p: usize| {
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 1bfcc77984..e78930e880 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -164,7 +164,7 @@ pub fn tools() -> Vec<ToolDef> {
         )),
         t("doc_set_info", "Set document metadata", "Set a document information entry such as Title, Author, Subject or Keywords, or a custom property under any other name (no spaces, delimiters, / or #; at most 127 bytes; doc_info lists them under custom); an empty value removes it. When the file has XMP metadata, the matching XMP property (dc:title, dc:creator, dc:description, pdf:Keywords, xmp:CreatorTool, pdf:Producer) is changed too, so viewers that read XMP first show the new value. Undoable.")
             .with(schema(json!({ "doc": doc(), "key": { "type": "string" }, "value": { "type": "string" } }), &["doc", "key", "value"])),
-        t("page_render", "Render a page", "Render one page to a PNG image (default 96 dpi, at most 600).")
+        t("page_render", "Render a page", "Render one page to a PNG image (default 96 dpi, at most 600). When the picture is incomplete or approximate (content cut at the page's safety budget, a colour painted in a fallback colour), a JSON part follows the image: { page, warnings: [sentence, ...] }.")
             .ro()
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 }, "dpi": { "type": "number", "minimum": 1, "maximum": 600 },
                 "hide_text_block": { "type": "integer", "minimum": 1, "description": "Render an inline editor background without this paragraph (number from text_paragraphs, resolved as text_edit does: refused once an edit merged that paragraph into a neighbour). Does not modify the document." },
@@ -1442,7 +1442,7 @@ pub fn tools() -> Vec<ToolDef> {
             .destructive().with(schema(json!({"steps":{"type":"array","items":schema(json!({"id":{"type":"string"},"params":{"type":"object"}}), &["id"])},"stop_on_error":{"type":"boolean"}}), &["steps"])),
         t("doc_inspect", "Inspect open documents", "With doc, return doc_info; otherwise return information for every open document (empty documents array when none are open).")
             .ro().with(schema(json!({"doc":doc()}), &[])),
-        t("render_preview", "Render a preview", "Render a PNG bounded by max_side (default 1024), without changing or saving the document. Page defaults to 1; doc may be omitted when exactly one document is open.")
+        t("render_preview", "Render a preview", "Render a PNG bounded by max_side (default 1024), without changing or saving the document. Page defaults to 1; doc may be omitted when exactly one document is open. Render warnings follow the image as page_render gives them.")
             .ro().with(schema(json!({"doc":doc(),"page":{"type":"integer","minimum":1},"max_side":{"type":"integer","minimum":1,"maximum":4096}}), &[])),
     ]
 }
diff --git a/crates/automation/tests/it/main.rs b/crates/automation/tests/it/main.rs
index d94aa9f7c4..f38c8599a3 100644
--- a/crates/automation/tests/it/main.rs
+++ b/crates/automation/tests/it/main.rs
@@ -8,3 +8,4 @@ mod button_caption;
 mod form_bulk;
 mod hostile_args;
 mod optimize_content_boundaries;
+mod render_warnings;
diff --git a/crates/automation/tests/it/render_warnings.rs b/crates/automation/tests/it/render_warnings.rs
new file mode 100644
index 0000000000..ff50c11e16
--- /dev/null
+++ b/crates/automation/tests/it/render_warnings.rs
@@ -0,0 +1,119 @@
+//! `page_render` reports the renderer's warnings next to the PNG, so a headless caller can tell
+//! that a picture is incomplete or approximate, as `pdfcraft-cli render` can (#4340).
+
+use std::path::PathBuf;
+
+use pdfcraft_automation::{Automation, Content};
+use serde_json::{Value, json};
+
+/// The warning a colour that falls back gives, worded as `pdfcraft-cli render` prints it.
+const FALLBACK: &str = "a colour that could not be computed was painted in a fallback colour";
+
+/// A one-page 200 × 200 pt PDF that draws `content`, with the colour space `CS1` defined as
+/// `[/DeviceN [/Spot1 /Spot2] /DeviceRGB 5 0 R]` and object 5 a calculator function `program`.
+fn devicen_pdf(content: &str, program: &str) -> Vec<u8> {
+    format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+         2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+         3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /CS1 [/DeviceN [/Spot1 /Spot2] /DeviceRGB 5 0 R] >> >> /Contents 4 0 R >> endobj\n\
+         4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+         5 0 obj << /FunctionType 4 /Domain [0 1 0 1] /Range [0 1 0 1 0 1] /Length {} >> stream\n{program}\nendstream endobj\n\
+         trailer << /Root 1 0 R >>\n%%EOF",
+        content.len(),
+        program.len()
+    )
+    .into_bytes()
+}
+
+/// A page whose colour falls back: the tint transform pops more than it is given, so it can't be
+/// evaluated (the renderer's own test of the warning uses the same function).
+fn fallback_pdf() -> Vec<u8> {
+    devicen_pdf("/CS1 cs 0.5 0.5 scn 0 0 100 100 re f", "{ pop pop pop }")
+}
+
+/// The same page with a tint transform that works: nothing to warn about.
+fn clean_pdf() -> Vec<u8> {
+    devicen_pdf("/CS1 cs 0.5 0.5 scn 0 0 100 100 re f", "{ pop pop 0 0 0 }")
+}
+
+/// A fresh folder holding `fallback.pdf` and `clean.pdf`, and an automation rooted there.
+fn setup(test: &str) -> (PathBuf, Automation) {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-render-warnings-{test}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("fallback.pdf"), fallback_pdf()).unwrap();
+    std::fs::write(dir.join("clean.pdf"), clean_pdf()).unwrap();
+    let a = Automation::new().with_root(&dir).unwrap();
+    (dir, a)
+}
+
+fn open(a: &mut Automation, path: &str) -> u64 {
+    match a.call("doc_open", &json!({ "path": path })).unwrap().remove(0) {
+        Content::Json(v) => v["doc"].as_u64().unwrap(),
+        other => panic!("expected JSON: {other:?}"),
+    }
+}
+
+#[test]
+fn page_render_lists_the_warnings_after_the_png() {
+    let (dir, mut a) = setup("fallback");
+    let doc = open(&mut a, "fallback.pdf");
+    let out = a.call("page_render", &json!({ "doc": doc, "page": 1, "dpi": 72 })).unwrap();
+    assert_eq!(out.len(), 2, "the PNG and the warnings: {out:?}");
+    assert!(matches!(out[0], Content::Png { width: 200, height: 200, .. }), "the image comes first, as before");
+    let Content::Json(report) = &out[1] else { panic!("expected the warnings as JSON: {:?}", out[1]) };
+    assert_eq!(report["page"], 1, "the page is 1-based, like the argument");
+    assert_eq!(report["warnings"], json!([FALLBACK]));
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+#[test]
+fn render_preview_lists_the_warnings_after_the_png_too() {
+    let (dir, mut a) = setup("preview");
+    let doc = open(&mut a, "fallback.pdf");
+    let out = a.call("render_preview", &json!({ "doc": doc, "max_side": 64 })).unwrap();
+    assert!(matches!(out.first(), Some(Content::Png { width: 64, height: 64, .. })), "{out:?}");
+    let Some(Content::Json(report)) = out.get(1) else { panic!("expected the warnings as JSON: {out:?}") };
+    assert_eq!(report["page"], 1, "the page defaults to the first");
+    assert_eq!(report["warnings"], json!([FALLBACK]));
+    let clean = open(&mut a, "clean.pdf");
+    assert_eq!(a.call("render_preview", &json!({ "doc": clean })).unwrap().len(), 1, "a clean page gives the PNG alone");
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+#[test]
+fn a_clean_page_renders_to_the_png_alone() {
+    let (dir, mut a) = setup("clean");
+    let fallback = open(&mut a, "fallback.pdf");
+    let clean = open(&mut a, "clean.pdf");
+    // The warning of one render doesn't carry over to the next, nor to another document.
+    a.call("page_render", &json!({ "doc": fallback, "page": 1, "dpi": 72 })).unwrap();
+    let out = a.call("page_render", &json!({ "doc": clean, "page": 1, "dpi": 72 })).unwrap();
+    assert_eq!(out.len(), 1, "no warnings, no extra part: {out:?}");
+    assert!(matches!(out[0], Content::Png { .. }));
+    let again = a.call("page_render", &json!({ "doc": fallback, "page": 1, "dpi": 72 })).unwrap();
+    assert_eq!(again.len(), 2, "a cached renderer still reports the page's warning: {again:?}");
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+/// Over MCP the warnings are a text block after the image and the call's `structuredContent`.
+#[cfg(feature = "mcp")]
+#[test]
+fn mcp_page_render_carries_the_warnings_as_structured_content() {
+    use pdfcraft_automation::mcp::McpServer;
+    let (dir, a) = setup("mcp");
+    let mut s = McpServer::new(a);
+    let mut rpc = |id: u64, method: &str, params: Value| -> Value {
+        let line = json!({ "jsonrpc": "2.0", "id": id, "method": method, "params": params }).to_string();
+        serde_json::from_str(&s.handle_line(&line).expect("a reply")).unwrap()
+    };
+    rpc(1, "initialize", json!({}));
+    rpc(2, "tools/call", json!({ "name": "doc_open", "arguments": { "path": "fallback.pdf" } }));
+    let reply = rpc(3, "tools/call", json!({ "name": "page_render", "arguments": { "doc": 1, "page": 1 } }));
+    let result = &reply["result"];
+    assert_eq!(result["isError"], false, "{reply}");
+    assert_eq!(result["content"][0]["type"], "image");
+    assert_eq!(result["content"][1]["type"], "text");
+    assert_eq!(result["structuredContent"]["warnings"], json!([FALLBACK]));
+    let _ = std::fs::remove_dir_all(dir);
+}

From ac868f6e2989a91c2888c82136619fda1c4d9ee3 Mon Sep 17 00:00:00 2001
From: aiongg <aiongtaigi@gmail.com>
Date: Sat, 24 Oct 2026 18:58:44 +0000
Subject: [PATCH 065/270] Tests: new text box drafts set typing_from (main's
 #4441 tests)

---
 crates/ui-egui/src/editing.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 83c6d2d229..759065e9f2 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -1872,7 +1872,7 @@ mod revert_draft_tests {
     fn text_typed_into_a_new_text_box_counts_as_unsaved_work() {
         use crate::content_ui::{TextDraft, default_style};
         let mut app = app();
-        let draft = |text: &str| TextDraft { page: 0, index: None, rect: [0.0; 4], text: text.into(), style: default_style(), focus: true };
+        let draft = |text: &str| TextDraft { page: 0, index: None, rect: [0.0; 4], text: text.into(), style: default_style(), focus: true, typing_from: None };
         assert!(!app.has_unsaved_work(0));
         app.views[0].content.draft = Some(draft("  \n"));
         assert!(!app.has_unsaved_work(0));
@@ -1897,7 +1897,7 @@ mod revert_draft_tests {
             let mut app = PdfCraftApp::new();
             app.open_bytes("source.pdf", Some(path.clone()), bytes).unwrap();
             let rect = [72.0, 72.0, 272.0, 92.0];
-            app.views[0].content.draft = Some(TextDraft { page: 0, index: None, rect, text: "Typed".into(), style: default_style(), focus: true });
+            app.views[0].content.draft = Some(TextDraft { page: 0, index: None, rect, text: "Typed".into(), style: default_style(), focus: true, typing_from: None });
             let ctx = egui::Context::default();
             if quit {
                 assert!(!app.request_quit(&ctx));

From 120de553ab7d834de12e957627e68b0c1f183393 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Sat, 24 Oct 2026 23:06:34 +0200
Subject: [PATCH 066/270] fix(ui): the Background preview follows the Replace
 checkbox

The dialog previews a colour as a tint of the page's thumbnail (main's #3009). It tinted every
page, so with Replace unticked a page that keeps its own white backdrop previewed coloured,
though OK leaves it white. A page a picture covers (a scan) previewed coloured too.

background_tint() now shows no colour where the page will still hide the background after OK:
a scan, or a white backdrop with Replace unticked. It reads the page from the dialog's backdrop
check (BackdropCheck::found, for the current version of the document only); a page the check
hasn't reached yet previews coloured, as before.

Tests, both seen failing with the fix reverted:
- marks_ui::tests::the_preview_shows_a_background_only_where_ok_lets_it_show (the rule);
- it::marks::the_background_preview_follows_the_replace_checkbox (what the dialog paints, per
  page, ticked and unticked).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/marks_ui.rs   | 38 +++++++++++++++++++++++++++++++-
 crates/ui-egui/tests/it/marks.rs | 32 +++++++++++++++++++++++++++
 parity/acrobat-features.toml     |  4 ++--
 3 files changed, 71 insertions(+), 3 deletions(-)

diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index b4c930e624..a075814aa2 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -138,6 +138,15 @@ impl BackdropCheck {
         }
         n
     }
+
+    /// What the check found on `page` (0-based) of this version of `doc`: `None` until it has
+    /// looked, `Some(None)` for a page with no backdrop of its own.
+    pub fn found(&self, doc: &pdfcraft_engine::Document, page: usize) -> Option<Option<Backdrop>> {
+        if self.key != Some((doc.id, doc.edit_generation())) {
+            return None;
+        }
+        self.pages.get(page).copied().flatten()
+    }
 }
 
 impl MarksDraft {
@@ -279,6 +288,19 @@ fn behind(color: [f64; 3], opacity: f64) -> Color32 {
     rgb32(color.map(|c| 1.0 - a * (1.0 - c)))
 }
 
+/// The preview's tint for a background colour on a page whose own backdrop is `found` (`None`
+/// when it has none, or the check hasn't reached it): no colour where the page will still hide
+/// the background after OK, because a picture covers it (a scan) or it keeps its white backdrop
+/// with Replace unticked.
+fn background_tint(d: &MarksDraft, found: Option<Backdrop>) -> Color32 {
+    let hidden = match found {
+        Some(Backdrop::Image) => true,
+        Some(Backdrop::Fill) => !d.bg.replace_backdrop,
+        None => false,
+    };
+    if hidden { Color32::WHITE } else { behind(d.bg.color, d.bg.opacity) }
+}
+
 /// The page (0-based) the preview shows: the current one when the range selects it, otherwise the
 /// first page the range selects (the current one again when it selects none).
 fn preview_page(range: &PageRange, current: usize, count: usize) -> usize {
@@ -487,7 +509,8 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
         view.need_thumbnail(target, true);
         view.thumb_id(target)
     });
-    let tint = if kind == MarkKind::Background && !d.use_file { behind(d.bg.color, d.bg.opacity) } else { Color32::WHITE };
+    let tint =
+        if kind == MarkKind::Background && !d.use_file { background_tint(d, d.backdrops.found(doc, target).flatten()) } else { Color32::WHITE };
     let hf = d.hf.clone();
     let size_h = page.1.max(1.0);
     let (wm, fit) = (d.wm.clone(), d.fit);
@@ -825,6 +848,19 @@ mod tests {
         assert_eq!(behind([0.2, 0.4, 0.6], f64::NAN), behind([0.2, 0.4, 0.6], 1.0), "opaque, as the engine has it");
     }
 
+    #[test]
+    fn the_preview_shows_a_background_only_where_ok_lets_it_show() {
+        let mut d = MarksDraft::default();
+        let colour = behind(d.bg.color, d.bg.opacity);
+        assert_ne!(colour, Color32::WHITE);
+        assert_eq!(background_tint(&d, None), colour, "no backdrop of its own");
+        assert_eq!(background_tint(&d, Some(Backdrop::Fill)), colour, "its white backdrop is replaced");
+        assert_eq!(background_tint(&d, Some(Backdrop::Image)), Color32::WHITE, "a picture covers it");
+        d.bg.replace_backdrop = false;
+        assert_eq!(background_tint(&d, Some(Backdrop::Fill)), Color32::WHITE, "its white backdrop stays and hides it");
+        assert_eq!(background_tint(&d, None), colour, "unticked changes nothing without a backdrop");
+    }
+
     #[test]
     fn the_watermark_edit_carries_the_offset() {
         let mut d = MarksDraft::default();
diff --git a/crates/ui-egui/tests/it/marks.rs b/crates/ui-egui/tests/it/marks.rs
index 2c8b39d558..f518dcd1c7 100644
--- a/crates/ui-egui/tests/it/marks.rs
+++ b/crates/ui-egui/tests/it/marks.rs
@@ -216,6 +216,38 @@ fn the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scan
     assert_eq!(backdrop(&h, 0), None, "Update keeps the backdrop replaced");
 }
 
+/// The preview shows what OK will do to each page: the colour on bare paper and on a page whose
+/// white backdrop is replaced, none on a scan, and none on that page with Replace unticked.
+#[test]
+fn the_background_preview_follows_the_replace_checkbox() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, backdrop_fixture()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.background"));
+    h.run_steps(3);
+    let replace = "Page 1 paints its own white backdrop, which would hide the background. Replace it";
+    h.get_by_label(replace);
+    let [red, green, blue] = pdfcraft_engine::Background::default().color.map(|c| (c * 255.0).round() as u8);
+    let colour = egui::Color32::from_rgb(red, green, blue);
+    let tint = |h: &mut Harness<'static, PdfCraftApp>, page: usize| {
+        h.state_mut().marks_draft.preview = Some(page);
+        h.run_steps(2);
+        wait_for_picture(h, page).2
+    };
+    assert_eq!(tint(&mut h, 0), colour, "page 1's backdrop is replaced, so the colour shows");
+    assert_eq!(tint(&mut h, 1), egui::Color32::WHITE, "a picture covers page 2");
+    assert_eq!(tint(&mut h, 2), colour, "page 3 is bare paper");
+    h.get_by_label(replace).click();
+    h.run_steps(2);
+    assert!(!h.state().marks_draft.bg.replace_backdrop);
+    assert_eq!(tint(&mut h, 0), egui::Color32::WHITE, "unticked, page 1 keeps its backdrop, which hides the colour");
+    assert_eq!(tint(&mut h, 2), colour, "page 3 has no backdrop to keep");
+}
+
 /// Remove background says which pages keep their own white backdrop off: here one whose
 /// backdrop copy changed before the fill since the background replaced it.
 #[test]
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index ae5e6a510f..46e10e8b81 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2531,8 +2531,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.background"]
 tools = ["doc_background", "doc_backdrops"]
-evidence = ["crates/ui-egui/tests/it/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/it/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright", "crates/automation/tests/it/backdrop.rs::a_background_shows_on_a_page_that_paints_its_own_white_backdrop", "crates/ui-egui/tests/it/marks.rs::the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scans", "crates/edit/src/backdrop_tests.rs::content_that_is_not_a_page_backdrop_is_left_alone", "crates/ui-egui/tests/it/marks.rs::the_preview_shows_the_page_the_range_selects_under_the_marks"]
-notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove turns it back on, after edits and redactions too, unless the operators before it changed or it would no longer be painted first, and then says which pages keep it off). The replaced copy's tag holds no page content or reference, so text a redaction or Remove Hidden Information takes off such a page leaves the file. Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space. The dialog previews a colour as a tint of the page's own thumbnail (opaque pictures on the page are tinted there too, not in the result), a file as its frame and name"
+evidence = ["crates/ui-egui/tests/it/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/it/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright", "crates/automation/tests/it/backdrop.rs::a_background_shows_on_a_page_that_paints_its_own_white_backdrop", "crates/ui-egui/tests/it/marks.rs::the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scans", "crates/ui-egui/tests/it/marks.rs::the_background_preview_follows_the_replace_checkbox", "crates/edit/src/backdrop_tests.rs::content_that_is_not_a_page_backdrop_is_left_alone", "crates/ui-egui/tests/it/marks.rs::the_preview_shows_the_page_the_range_selects_under_the_marks"]
+notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove turns it back on, after edits and redactions too, unless the operators before it changed or it would no longer be painted first, and then says which pages keep it off). The replaced copy's tag holds no page content or reference, so text a redaction or Remove Hidden Information takes off such a page leaves the file. Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space. The dialog previews a colour as a tint of the page's own thumbnail (opaque pictures on the page are tinted there too, not in the result), a file as its frame and name; a page that will still hide the background (a scan, or a white backdrop with Replace unticked) previews without the colour"
 
 [[feature]]
 id = "edit.background-update-remove"

From b9035271b0a8c773b8caede56ee435a574ff0997 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 08:36:17 +1100
Subject: [PATCH 067/270] fix(ui): menu Undo takes back typing in the open text
 box first
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Edit ▸ Undo with typing in a paragraph or added text box that the page
doesn't have yet applied the typing (a new edit, which dropped the
document's waiting Redo), closed the box and undid the typing all at
once; the key takes it back a step at a time in the box. Menu Undo now
goes to the box first, as Redo does, and is enabled while the box holds
such typing. Undo and Redo share typing_step for the box's own history.
---
 crates/ui-egui/src/commands.rs     |  4 +++-
 crates/ui-egui/src/editing.rs      | 37 +++++++++++++++++++++++-------
 crates/ui-egui/tests/it/content.rs | 26 +++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 29 +++++++++++++++++++++++
 4 files changed, 87 insertions(+), 9 deletions(-)

diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 25cb73beba..d1ef7a4505 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -84,8 +84,10 @@ impl PdfCraftApp {
         if self.combine_showing() && matches!(spec.needs, commands::Needs::Undo | commands::Needs::Redo) {
             return self.combine_can_undo(spec.needs == commands::Needs::Undo);
         }
-        // Redo also takes back what Undo took in a box open on the page, with no document step.
+        // Undo also takes back typing in a box open on the page, and Redo what Undo took there,
+        // with no document step.
         (commands::is_enabled(spec, &self.session, self.active_ids().map(|(_, id)| id))
+            || spec.needs == commands::Needs::Undo && self.page_typing_unapplied()
             || spec.needs == commands::Needs::Redo && self.open_box_can_redo())
             && (spec.id != "edit.copy"
                 || self
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 207a3f4830..d495a52a46 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -214,11 +214,31 @@ impl PdfCraftApp {
         }
         if self.combine_showing() {
             self.combine_history_step(true);
-        } else {
+        } else if !self.undo_in_page_box() {
             self.history_step(true);
         }
     }
 
+    /// Undo from the menu or toolbar while a box on the page holds typing the page doesn't have
+    /// yet: the box takes the step, as it does for the key, one step of its typing at a time.
+    /// Applying the typing first was a new edit, which dropped the document's Redo, and then the
+    /// typing was taken back all at once. True when the box took the step.
+    fn undo_in_page_box(&mut self) -> bool {
+        let Some(ctx) = self.ctx.clone() else { return false };
+        let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
+        if let Some(ed) = view.line_editor.as_mut().filter(|ed| ed.has_unsaved_text()) {
+            let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, true) else { return false };
+            ed.text = text;
+            return true;
+        }
+        if let Some(d) = view.content.draft.as_mut().filter(|d| d.has_unapplied_typing()) {
+            let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, true) else { return false };
+            d.text = text;
+            return true;
+        }
+        false
+    }
+
     pub fn redo(&mut self) {
         if self.combine_showing() {
             self.combine_history_step(false);
@@ -235,12 +255,12 @@ impl PdfCraftApp {
         let Some(ctx) = self.ctx.clone() else { return false };
         let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
         if let Some(ed) = view.line_editor.as_mut() {
-            let Some(text) = redo_typing(&ctx, crate::edit_text_ui::input_id(), &ed.text) else { return ed.has_unsaved_text() };
+            let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, false) else { return ed.has_unsaved_text() };
             ed.text = text;
             return true;
         }
         if let Some(d) = view.content.draft.as_mut() {
-            let Some(text) = redo_typing(&ctx, crate::content_ui::input_id(), &d.text) else { return d.has_unapplied_typing() };
+            let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, false) else { return d.has_unapplied_typing() };
             d.text = text;
             return true;
         }
@@ -1347,16 +1367,17 @@ fn has_typing_to_redo(ctx: &egui::Context, id: egui::Id, text: &str) -> bool {
         .is_some_and(|state| state.cursor.char_range().is_some_and(|range| state.undoer().has_redo(&(range, text.to_owned()))))
 }
 
-/// The box's own Redo, as the key does it: the typing Undo took back, put back in the box's text,
-/// with the box's history and cursor moved along. None when the box has nothing to redo.
-fn redo_typing(ctx: &egui::Context, id: egui::Id, text: &str) -> Option<String> {
+/// The box's own Undo (or Redo), as the key does it: the box's text one step back (or forward) in
+/// its typing, with the box's history and cursor moved along. None when there is no such step.
+fn typing_step(ctx: &egui::Context, id: egui::Id, text: &str, undo: bool) -> Option<String> {
     let mut state = egui::TextEdit::load_state(ctx, id)?;
     let mut undoer = state.undoer();
-    let (range, redone) = undoer.redo(&(state.cursor.char_range()?, text.to_owned()))?.clone();
+    let current = (state.cursor.char_range()?, text.to_owned());
+    let (range, stepped) = if undo { undoer.undo(&current) } else { undoer.redo(&current) }?.clone();
     state.set_undoer(undoer);
     state.cursor.set_char_range(Some(range));
     egui::TextEdit::store_state(ctx, id, state);
-    Some(redone)
+    Some(stepped)
 }
 
 #[cfg(test)]
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index c2edfb8336..a17d0793ea 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -971,6 +971,32 @@ fn redo_from_the_menu_with_retyping_in_the_box_keeps_the_documents_redo() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit content"), "the document's Redo still waits");
 }
 
+/// Undo from the menu with retyping the page doesn't have yet in an added text box: the box takes
+/// it back and stays open, and the document's waiting Redo stays.
+#[test]
+fn undo_from_the_menu_takes_back_retyping_in_the_added_text_box() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    let bold = pdfcraft_engine::AddedText { bold: true, ..text };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::UpdateContent { page: 0, index: 0, content: pdfcraft_engine::AddedContent::Text(bold) }));
+    assert!(h.state_mut().execute("edit.undo"));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes it back in the box");
+    let s = h.state();
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit content"), "the document's Redo still waits");
+}
+
 /// Redo from the menu after Undo in an added text box, with nothing for the document to redo: the
 /// menu item follows the box's own Redo too, and puts the typing back.
 #[test]
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 8ce8073285..841633005e 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6383,6 +6383,35 @@ fn redo_from_the_menu_with_typing_in_the_box_keeps_the_documents_redo() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
 }
 
+/// Undo from the menu or toolbar with typing in the box the page doesn't have yet: the box takes
+/// the typing back, as the key does, and stays open, and the document's waiting Redo stays. The
+/// menu applied the typing first (a new edit, which dropped that Redo), closed the box and undid
+/// the typing all at once.
+#[test]
+fn undo_from_the_menu_takes_back_typing_in_the_box() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    // Undo the bold (closing the editor), so the document has it to redo and nothing to undo.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.undo"), "Undo is enabled for the box's typing");
+    h.run_steps(3);
+    let s = h.state();
+    let ed = s.views[0].line_editor.as_ref().expect("the box stays open");
+    assert_eq!(ed.text, original, "the typing is taken back in the box");
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!((doc.can_redo(), doc.can_undo()), (Some("Edit text"), None), "the document is untouched");
+}
+
 /// Redo from the menu after Undo in the box took the typing back, with nothing for the document
 /// to redo: the menu item follows the box's own Redo too, and puts the typing back. It was
 /// disabled, as it followed only the document's Redo, and only the key could do it.

From f3b61b73b0284ee02c6276b7452e7daa4f25a4e2 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 08:41:17 +1100
Subject: [PATCH 068/270] style: rustfmt the two TextDraft test literals that
 took typing_from

---
 crates/ui-egui/src/editing.rs | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index c5964a98c8..5793d13194 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -1893,7 +1893,15 @@ mod revert_draft_tests {
     fn text_typed_into_a_new_text_box_counts_as_unsaved_work() {
         use crate::content_ui::{TextDraft, default_style};
         let mut app = app();
-        let draft = |text: &str| TextDraft { page: 0, index: None, rect: [0.0; 4], text: text.into(), style: default_style(), focus: true, typing_from: None };
+        let draft = |text: &str| TextDraft {
+            page: 0,
+            index: None,
+            rect: [0.0; 4],
+            text: text.into(),
+            style: default_style(),
+            focus: true,
+            typing_from: None,
+        };
         assert!(!app.has_unsaved_work(0));
         app.views[0].content.draft = Some(draft("  \n"));
         assert!(!app.has_unsaved_work(0));
@@ -1918,7 +1926,8 @@ mod revert_draft_tests {
             let mut app = PdfCraftApp::new();
             app.open_bytes("source.pdf", Some(path.clone()), bytes).unwrap();
             let rect = [72.0, 72.0, 272.0, 92.0];
-            app.views[0].content.draft = Some(TextDraft { page: 0, index: None, rect, text: "Typed".into(), style: default_style(), focus: true, typing_from: None });
+            app.views[0].content.draft =
+                Some(TextDraft { page: 0, index: None, rect, text: "Typed".into(), style: default_style(), focus: true, typing_from: None });
             let ctx = egui::Context::default();
             if quit {
                 assert!(!app.request_quit(&ctx));

From dd47c4f9e1a2e69657ced00785b934419bdd90d6 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 08:56:55 +1100
Subject: [PATCH 069/270] test(ui): the two-tab Redo test checks the copy's
 paragraph stays open

If the copy's editor had closed before or during Redo, the check for the
other tab's typing passed on an empty text. It now requires the editor
to be open before Redo and after it.
---
 crates/ui-egui/tests/it/editing.rs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index b941857f07..c22ce087f2 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6675,11 +6675,12 @@ fn typing_in_one_tab_never_reaches_another_tabs_paragraph() {
     // The copy, its paragraph still open: Redo there has nothing of its own to put back.
     h.state_mut().active = Some(1);
     h.run_steps(3);
+    assert!(h.state().views[1].line_editor.is_some(), "the copy's paragraph is still open");
     h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
     h.run_steps(3);
     let s = h.state();
-    let text = s.views[1].line_editor.as_ref().map(|ed| ed.text.clone());
-    assert!(!text.as_deref().unwrap_or_default().contains("secret"), "the other tab's typing came in: {text:?}");
+    let text = &s.views[1].line_editor.as_ref().expect("the copy's paragraph stays open through Redo").text;
+    assert!(!text.contains("secret"), "the other tab's typing came in: {text:?}");
     assert_eq!(s.session.get(s.views[1].id).unwrap().text_blocks(0)[0].text, s.session.get(s.views[0].id).unwrap().text_blocks(0)[0].text);
 }
 

From 522653d6b1c8fc1e9973308889296a016de75ea3 Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Sun, 25 Oct 2026 12:03:40 +0800
Subject: [PATCH 070/270] fix(organize,print): join /Contents array pieces with
 a space (#3502)

---
 crates/organize/src/prune.rs |  9 ++--
 crates/organize/src/tests.rs | 46 ++++++++++++++++++++
 crates/print/src/lib.rs      |  7 +--
 crates/print/src/tests.rs    | 82 ++++++++++++++++++++++++++++++++++++
 4 files changed, 137 insertions(+), 7 deletions(-)

diff --git a/crates/organize/src/prune.rs b/crates/organize/src/prune.rs
index d8db2f7ac4..5a2a319fb4 100644
--- a/crates/organize/src/prune.rs
+++ b/crates/organize/src/prune.rs
@@ -231,14 +231,15 @@ impl Pruner<'_> {
     }
 }
 
-/// The page's content, concatenated (`/Contents` may be one stream or an array), decoded
-/// against one page's [`DecodeBudget`]. An error when a stream can't be decoded or the budget
-/// runs out: the page may draw names that can't be seen.
+/// The page's content, concatenated (`/Contents` may be one stream or an array) with a space
+/// between pieces as the renderer joins them, decoded against one page's [`DecodeBudget`]. An
+/// error when a stream can't be decoded or the budget runs out: the page may draw names that
+/// can't be seen.
 pub(crate) fn content_bytes(doc: &Document, contents: &Object) -> Result<Vec<u8>, CosError> {
     let mut out = Vec::new();
     for data in DecodeBudget::page().decode_contents(doc, contents) {
         out.extend(data?);
-        out.push(b'\n');
+        out.push(b' ');
     }
     Ok(out)
 }
diff --git a/crates/organize/src/tests.rs b/crates/organize/src/tests.rs
index 1ba8861cbe..0d5417f9de 100644
--- a/crates/organize/src/tests.rs
+++ b/crates/organize/src/tests.rs
@@ -3688,3 +3688,49 @@ fn bookmark_style_and_colour_are_set_as_the_table_says() {
     let got: Vec<_> = bookmarks(&saved).into_iter().map(|b| (b.color, b.bold, b.italic)).collect();
     assert_eq!(got, [(Some([0.0, 0.0, 1.0]), true, true), (None, false, false)]);
 }
+
+/// #3502: a `/Contents` array's pieces are joined with a space, as the renderer joins them, so a
+/// `%` comment at the end of a piece without a line break continues through the first line of the
+/// next piece in both resource pruning (`extract_pages`) and `page_as_form`.
+#[test]
+fn contents_pieces_join_with_a_space_across_a_trailing_comment() {
+    let build_doc = |first_piece: &str| {
+        let b: Vec<String> = vec![
+            "<< /Type /Catalog /Pages 2 0 R >>".into(),                                        // 1
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 200] >>".into(),        // 2
+            "<< /Type /Page /Parent 2 0 R /Contents [4 0 R 5 0 R] /Resources 6 0 R >>".into(), // 3
+            raw(first_piece),                                                                  // 4
+            raw("/ImHidden Do\n/ImShown Do"),                                                  // 5
+            "<< /XObject << /ImHidden 7 0 R /ImShown 8 0 R >> >>".into(),                      // 6
+            image(1, 1, 1),                                                                    // 7
+            image(1, 1, 1),                                                                    // 8
+        ];
+        open(build(&b, "/Root 1 0 R"))
+    };
+
+    // Without a trailing newline in piece 1, `% comment` swallows `/ImHidden Do` on the first
+    // line of piece 2; only `/ImShown` is drawn.
+    let commented = build_doc("q Q % comment without newline");
+    let extracted = full_roundtrip(&extract_pages(&commented, &[0]).unwrap());
+    assert_eq!(xobject_names(&extracted, 0), [b"ImShown".to_vec()], "commented-out Do across piece boundary is pruned");
+
+    let mut form_dst = Document::new_empty();
+    let (form_ref, _) = crate::page_as_form(&mut form_dst, &commented, 0).unwrap();
+    let Object::Stream(form_stream) = &*form_dst.get(form_ref) else { panic!("form stream") };
+    let form_bytes = form_stream.decoded().unwrap();
+    let drawn: Vec<Vec<u8>> = pdfcraft_content::parse(&form_bytes)
+        .ops
+        .into_iter()
+        .filter(|op| op.op == b"Do")
+        .filter_map(|op| op.operands.first().and_then(Object::as_name).map(|n| n.to_vec()))
+        .collect();
+    assert_eq!(drawn, [b"ImShown".to_vec()], "page_as_form keeps the first line of piece 2 inside the comment");
+
+    // Control: when piece 1 ends the comment with a newline, `/ImHidden Do` on piece 2's first
+    // line is a real operator and stays in both the extracted page and the form XObject.
+    let newline_ended = build_doc("q Q % comment with newline\n");
+    let extracted_ctrl = full_roundtrip(&extract_pages(&newline_ended, &[0]).unwrap());
+    let mut ctrl_names = xobject_names(&extracted_ctrl, 0);
+    ctrl_names.sort();
+    assert_eq!(ctrl_names, [b"ImHidden".to_vec(), b"ImShown".to_vec()]);
+}
diff --git a/crates/print/src/lib.rs b/crates/print/src/lib.rs
index b731aff00f..a46564add8 100644
--- a/crates/print/src/lib.rs
+++ b/crates/print/src/lib.rs
@@ -720,8 +720,9 @@ fn n(v: f64) -> String {
     if s == "-0" { "0".into() } else { s.into() }
 }
 
-/// The page's content streams decoded against `budget` and joined; streams that don't decode
-/// are left out. `None` when the budget ran out, so part of the content is missing.
+/// The page's content streams decoded against `budget` and joined with a space as the renderer
+/// joins them; streams that don't decode are left out. `None` when the budget ran out, so part of
+/// the content is missing.
 fn decoded_contents(doc: &Document, page: &Dict, budget: &mut DecodeBudget) -> Option<Vec<u8>> {
     let Some(contents) = page.get(b"Contents") else { return Some(Vec::new()) };
     let mut out = Vec::new();
@@ -729,7 +730,7 @@ fn decoded_contents(doc: &Document, page: &Dict, budget: &mut DecodeBudget) -> O
         match data {
             Ok(data) => {
                 out.extend_from_slice(&data);
-                out.push(b'\n');
+                out.push(b' ');
             }
             Err(_) if budget.remaining() == 0 => return None,
             Err(_) => {}
diff --git a/crates/print/src/tests.rs b/crates/print/src/tests.rs
index bc0454c999..e4e49b3d00 100644
--- a/crates/print/src/tests.rs
+++ b/crates/print/src/tests.rs
@@ -1059,3 +1059,85 @@ fn a_booklet_prints_both_sides_on_the_short_edge() {
     assert_eq!(booklet_duplex(BookletSubset::FrontOnly), spool::Duplex::Off);
     assert_eq!(booklet_duplex(BookletSubset::BackOnly), spool::Duplex::Off);
 }
+
+/// #3502: `/Contents` array pieces are joined with a space, matching the renderer, so a `%`
+/// comment at the end of a piece without a line break continues through the first line of the
+/// next piece in both `impose` and `text_reads_up`.
+#[test]
+fn contents_pieces_join_with_a_space_across_a_trailing_comment() {
+    let build_doc = |first_piece: &[u8]| {
+        let mut doc = Document::new_empty();
+        let font = doc.add(
+            [
+                (b"Type".to_vec(), Object::name("Font")),
+                (b"Subtype".to_vec(), Object::name("Type1")),
+                (b"BaseFont".to_vec(), Object::name("Helvetica")),
+            ]
+            .into_iter()
+            .collect::<Dict>(),
+        );
+        let s1 = doc.add(Stream::from_raw(Dict::new(), first_piece.to_vec()));
+        // Line 1 of s2 draws sideways ("HIDDEN") and 4 characters reading up; line 2 draws upright ("SHOWN").
+        let s2 = doc.add(Stream::from_raw(
+            Dict::new(),
+            b"BT /F1 18 Tf 0 1 -1 0 50 50 Tm (HIDDEN) Tj ET\nBT /F1 18 Tf 1 0 0 1 20 100 Tm (SHOWN) Tj ET".to_vec(),
+        ));
+        let fonts: Dict = [(b"F1".to_vec(), Object::Ref(font))].into_iter().collect();
+        let res: Dict = [(b"Font".to_vec(), Object::Dict(fonts))].into_iter().collect();
+        let pages_root = doc.add(Object::Null);
+        let page = doc.add(
+            [
+                (b"Type".to_vec(), Object::name("Page")),
+                (b"Parent".to_vec(), Object::Ref(pages_root)),
+                (b"MediaBox".to_vec(), Object::Array([0.0, 0.0, 200.0, 300.0].into_iter().map(Object::Real).collect())),
+                (b"Resources".to_vec(), Object::Dict(res)),
+                (b"Contents".to_vec(), Object::Array(vec![Object::Ref(s1), Object::Ref(s2)])),
+            ]
+            .into_iter()
+            .collect::<Dict>(),
+        );
+        doc.set(
+            pages_root,
+            Object::Dict(
+                [
+                    (b"Type".to_vec(), Object::name("Pages")),
+                    (b"Kids".to_vec(), Object::Array(vec![Object::Ref(page)])),
+                    (b"Count".to_vec(), Object::Int(1)),
+                ]
+                .into_iter()
+                .collect(),
+            ),
+        );
+        let cat = doc.add([(b"Type".to_vec(), Object::name("Catalog")), (b"Pages".to_vec(), Object::Ref(pages_root))].into_iter().collect::<Dict>());
+        doc.trailer_mut().set(b"Root".to_vec(), Object::Ref(cat));
+        doc
+    };
+
+    let form_strings = |imposed: Vec<u8>| -> Vec<Vec<u8>> {
+        let out = Document::open(Arc::new(imposed)).unwrap();
+        let page = &pdfcraft_model::pages(&out)[0];
+        let res = out.resolve(page.dict.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+        let xo = out.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+        let form_obj = out.resolve(xo.get(b"P0").unwrap());
+        let Object::Stream(form) = &*form_obj else { panic!("form stream") };
+        let body = form.decoded().unwrap();
+        pdfcraft_content::parse(&body)
+            .ops
+            .into_iter()
+            .filter(|op| op.op == b"Tj")
+            .filter_map(|op| op.operands.first().and_then(Object::as_string).map(|s| s.bytes.to_vec()))
+            .collect()
+    };
+
+    // Without a newline at the end of s1, `% comment` swallows line 1 of s2 (`(HIDDEN) Tj`).
+    let commented = build_doc(b"q Q % trailing comment");
+    assert!(!text_reads_up(&commented, 0), "commented-out vertical text on piece 2's first line is not counted");
+    let printed = impose(&commented, &settings(vec![0], Layout::Size(SizeMode::Actual))).unwrap();
+    assert_eq!(form_strings(printed), [b"SHOWN".to_vec()], "impose does not un-comment piece 2's first line");
+
+    // Control: when s1 terminates the comment with a newline, line 1 of s2 is drawn and counted.
+    let with_newline = build_doc(b"q Q % trailing comment\n");
+    assert!(text_reads_up(&with_newline, 0), "6 vertical vs 5 horizontal chars when line 1 is not commented out");
+    let printed_ctrl = impose(&with_newline, &settings(vec![0], Layout::Size(SizeMode::Actual))).unwrap();
+    assert_eq!(form_strings(printed_ctrl), [b"HIDDEN".to_vec(), b"SHOWN".to_vec()]);
+}

From b7f7b27f8f3f55157ae8cbd540f5131d05e5428c Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 08:36:17 +1100
Subject: [PATCH 071/270] fix(ui): menu Undo takes back typing in the open text
 box first
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Edit ▸ Undo with typing in a paragraph or added text box that the page
doesn't have yet applied the typing (a new edit, which dropped the
document's waiting Redo), closed the box and undid the typing all at
once; the key takes it back a step at a time in the box. Menu Undo now
goes to the box first, as Redo does, and is enabled while the box holds
such typing. Undo and Redo share typing_step for the box's own history.
---
 crates/ui-egui/src/commands.rs     |  4 ++-
 crates/ui-egui/src/editing.rs      | 52 +++++++++++++++++++++---------
 crates/ui-egui/tests/it/content.rs | 26 +++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 29 +++++++++++++++++
 4 files changed, 95 insertions(+), 16 deletions(-)

diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index ec49944529..d6eb6bbb0a 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -84,8 +84,10 @@ impl PdfCraftApp {
         if self.combine_showing() && matches!(spec.needs, commands::Needs::Undo | commands::Needs::Redo) {
             return self.combine_can_undo(spec.needs == commands::Needs::Undo);
         }
-        // Redo also takes back what Undo took in a box open on the page, with no document step.
+        // Undo also takes back typing in a box open on the page, and Redo what Undo took there,
+        // with no document step.
         (commands::is_enabled(spec, &self.session, self.active_ids().map(|(_, id)| id))
+            || spec.needs == commands::Needs::Undo && self.page_typing_unapplied()
             || spec.needs == commands::Needs::Redo && self.open_box_can_redo())
             && (spec.id != "edit.copy"
                 || self
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 55404a8dc9..6dce0631da 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -219,11 +219,31 @@ impl PdfCraftApp {
         }
         if self.combine_showing() {
             self.combine_history_step(true);
-        } else {
+        } else if !self.undo_in_page_box() {
             self.history_step(true);
         }
     }
 
+    /// Undo from the menu or toolbar while a box on the page holds typing the page doesn't have
+    /// yet: the box takes the step, as it does for the key, one step of its typing at a time.
+    /// Applying the typing first was a new edit, which dropped the document's Redo, and then the
+    /// typing was taken back all at once. True when the box took the step.
+    fn undo_in_page_box(&mut self) -> bool {
+        let Some(ctx) = self.ctx.clone() else { return false };
+        let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
+        if let Some(ed) = view.line_editor.as_mut().filter(|ed| ed.has_unsaved_text()) {
+            let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, true) else { return false };
+            ed.text = text;
+            return true;
+        }
+        if let Some(d) = view.content.draft.as_mut().filter(|d| d.has_unapplied_typing()) {
+            let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, true) else { return false };
+            d.text = text;
+            return true;
+        }
+        false
+    }
+
     pub fn redo(&mut self) {
         if self.combine_showing() {
             self.combine_history_step(false);
@@ -240,13 +260,13 @@ impl PdfCraftApp {
         let Some(ctx) = self.ctx.clone() else { return false };
         let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
         if let Some(ed) = view.line_editor.as_mut() {
-            let Some(text) = redo_typing(&ctx, crate::edit_text_ui::input_id(), &ed.text) else { return ed.has_unsaved_text() };
+            let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, false) else { return ed.has_unsaved_text() };
             let before = std::mem::replace(&mut ed.text, text);
             ed.follow_rows(&before);
             return true;
         }
         if let Some(d) = view.content.draft.as_mut() {
-            let Some(text) = redo_typing(&ctx, crate::content_ui::input_id(), &d.text) else { return d.has_unapplied_typing() };
+            let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, false) else { return d.has_unapplied_typing() };
             d.style.aligns = pdfcraft_engine::paragraph_align::remap(&d.text, &text, &d.style.aligns);
             d.text = text;
             return true;
@@ -1143,18 +1163,6 @@ impl PdfCraftApp {
 
 /// The single page a content edit changes (`None` for other edits). Like comment edits,
 /// these leave every other page's bytes, geometry and text alone, so their rasters stay valid.
-/// What the page text box `id`, showing `text`, gets back from its own Redo history, if anything;
-/// its caret goes where the Redo puts it.
-fn redo_typing(ctx: &egui::Context, id: egui::Id, text: &str) -> Option<String> {
-    let mut state = egui::TextEdit::load_state(ctx, id)?;
-    let mut undoer = state.undoer();
-    let (range, redone) = undoer.redo(&(state.cursor.char_range()?, text.to_owned()))?.clone();
-    state.set_undoer(undoer);
-    state.cursor.set_char_range(Some(range));
-    egui::TextEdit::store_state(ctx, id, state);
-    Some(redone)
-}
-
 fn content_page(edit: &Edit) -> Option<usize> {
     match edit {
         Edit::MoveObjects { page, .. }
@@ -1366,6 +1374,20 @@ fn has_typing_to_redo(ctx: &egui::Context, id: egui::Id, text: &str) -> bool {
     egui::TextEdit::load_state(ctx, id)
         .is_some_and(|state| state.cursor.char_range().is_some_and(|range| state.undoer().has_redo(&(range, text.to_owned()))))
 }
+
+/// The box's own Undo (or Redo), as the key does it: the box's text one step back (or forward) in
+/// its typing, with the box's history and cursor moved along. None when there is no such step.
+fn typing_step(ctx: &egui::Context, id: egui::Id, text: &str, undo: bool) -> Option<String> {
+    let mut state = egui::TextEdit::load_state(ctx, id)?;
+    let mut undoer = state.undoer();
+    let current = (state.cursor.char_range()?, text.to_owned());
+    let (range, stepped) = if undo { undoer.undo(&current) } else { undoer.redo(&current) }?.clone();
+    state.set_undoer(undoer);
+    state.cursor.set_char_range(Some(range));
+    egui::TextEdit::store_state(ctx, id, state);
+    Some(stepped)
+}
+
 #[cfg(test)]
 mod tests {
     use super::{SaveTarget, is_mail_temp_copy, save_dialog_folder, write_atomically, write_atomically_syncing, write_atomically_with};
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 592981acb7..327e3f45eb 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1038,6 +1038,32 @@ fn redo_from_the_menu_with_retyping_in_the_box_keeps_the_documents_redo() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit content"), "the document's Redo still waits");
 }
 
+/// Undo from the menu with retyping the page doesn't have yet in an added text box: the box takes
+/// it back and stays open, and the document's waiting Redo stays.
+#[test]
+fn undo_from_the_menu_takes_back_retyping_in_the_added_text_box() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    let bold = pdfcraft_engine::AddedText { bold: true, ..text };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::UpdateContent { page: 0, index: 0, content: pdfcraft_engine::AddedContent::Text(bold) }));
+    assert!(h.state_mut().execute("edit.undo"));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes it back in the box");
+    let s = h.state();
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit content"), "the document's Redo still waits");
+}
+
 /// Redo from the menu after Undo in an added text box, with nothing for the document to redo: the
 /// menu item follows the box's own Redo too, and puts the typing back.
 #[test]
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 2c68f21cc7..ceb4c36007 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6688,6 +6688,35 @@ fn redo_from_the_menu_with_typing_in_the_box_keeps_the_documents_redo() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
 }
 
+/// Undo from the menu or toolbar with typing in the box the page doesn't have yet: the box takes
+/// the typing back, as the key does, and stays open, and the document's waiting Redo stays. The
+/// menu applied the typing first (a new edit, which dropped that Redo), closed the box and undid
+/// the typing all at once.
+#[test]
+fn undo_from_the_menu_takes_back_typing_in_the_box() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    // Undo the bold (closing the editor), so the document has it to redo and nothing to undo.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.undo"), "Undo is enabled for the box's typing");
+    h.run_steps(3);
+    let s = h.state();
+    let ed = s.views[0].line_editor.as_ref().expect("the box stays open");
+    assert_eq!(ed.text, original, "the typing is taken back in the box");
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!((doc.can_redo(), doc.can_undo()), (Some("Edit text"), None), "the document is untouched");
+}
+
 /// Redo from the menu after Undo in the box took the typing back, with nothing for the document
 /// to redo: the menu item follows the box's own Redo too, and puts the typing back. It was
 /// disabled, as it followed only the document's Redo, and only the key could do it.

From 2f50e1fde7f4e5b48710cf1171ea44933cb0bc9d Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 15:48:04 +1100
Subject: [PATCH 072/270] fix(ui): typing Undo brings back a deleted row's
 alignment

egui's typing history keeps only text and caret, so Undo bringing back
a deleted row or line (added text, or a paragraph) gave it the
alignment of the row before it, and finishing the box could save that.
Each page box now keeps the texts it has shown through its own typing,
with every row's alignment then (follow_typing): Undo or Redo back to
one of them restores those alignments, and a new text follows the edit
with remap. An alignment picked since makes the older ones stale; they
are dropped, so Undo never takes back a pick. The record is cleared
with the box's typing history and holds 100 texts, as egui's does. It
covers typing, the keys and the menu's Undo and Redo.

On this branch the two-tab test also runs the menu's Redo in the copy,
where the box, with no Redo of its own, passes the step on and closes;
that step no longer requires the editor to stay open.

Also carries #4179's stronger two-tab test (dd47c4f9): the copy's
paragraph must be open before the key Redo and after it.
---
 crates/ui-egui/src/content_ui.rs   |   2 +-
 crates/ui-egui/src/edit_text_ui.rs | 124 ++++++++++++++++++++++++++++-
 crates/ui-egui/src/editing.rs      |  12 +--
 crates/ui-egui/tests/it/content.rs |  41 ++++++++++
 crates/ui-egui/tests/it/editing.rs |  38 ++++++++-
 5 files changed, 206 insertions(+), 11 deletions(-)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 969e45a55b..a190e118bb 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -645,7 +645,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                 }
                 // Each paragraph keeps its own alignment through the typing.
                 if t.text != before {
-                    t.style.aligns = pdfcraft_engine::paragraph_align::remap(&before, &t.text, &t.style.aligns);
+                    crate::edit_text_ui::follow_typing(ui.ctx(), input, &before, &t.text, &mut [&mut t.style.aligns]);
                 }
                 if t.focus {
                     resp.request_focus();
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index dc8958f245..eff2f2631f 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -285,10 +285,59 @@ pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, doc: pdfcr
         state.clear_undoer();
         egui::TextEdit::store_state(ctx, id, state);
     }
-    ctx.data_mut(|d| d.insert_temp(owner, doc));
+    ctx.data_mut(|d| {
+        d.insert_temp(owner, doc);
+        d.remove::<AlignHistory>(id.with(ALIGN_HISTORY));
+    });
     *from = Some(text.to_owned());
 }
 
+/// Each text a page box has shown through its own typing, with its rows' alignments then, oldest
+/// last: egui's history keeps only the text and the caret.
+type AlignHistory = Vec<(String, Vec<Vec<Option<pdfcraft_engine::TextAlign>>>)>;
+const ALIGN_HISTORY: &str = "aligns-by-text";
+/// As many texts as egui's own history keeps.
+const ALIGN_HISTORY_LEN: usize = 100;
+
+/// The page text box `id` went from `before` to `after` through its own typing (typing, Undo or
+/// Redo), and each list of row alignments in `aligns` follows. A text the box showed before gets
+/// back the alignments it had then, so Undo bringing back a deleted row brings back its
+/// alignment; a new text follows the edit ([`pdfcraft_engine::paragraph_align::remap`]). An
+/// alignment picked since makes the older texts' alignments stale, and they are dropped.
+pub(crate) fn follow_typing(
+    ctx: &egui::Context,
+    id: egui::Id,
+    before: &str,
+    after: &str,
+    aligns: &mut [&mut Vec<Option<pdfcraft_engine::TextAlign>>],
+) {
+    let now: Vec<Vec<_>> = aligns.iter().map(|a| a.to_vec()).collect();
+    let next = ctx.data_mut(|d| {
+        let seen = d.get_temp_mut_or_default::<AlignHistory>(id.with(ALIGN_HISTORY));
+        if seen.iter().any(|(text, was)| text == before && *was != now) {
+            seen.clear();
+        }
+        remember(seen, before, now.clone());
+        let next = match seen.iter().rev().find(|(text, _)| text == after) {
+            Some((_, was)) if was.len() == now.len() => was.clone(),
+            _ => now.iter().map(|a| pdfcraft_engine::paragraph_align::remap(before, after, a)).collect(),
+        };
+        remember(seen, after, next.clone());
+        next
+    });
+    for (slot, a) in aligns.iter_mut().zip(next) {
+        **slot = a;
+    }
+}
+
+fn remember(seen: &mut AlignHistory, text: &str, aligns: Vec<Vec<Option<pdfcraft_engine::TextAlign>>>) {
+    seen.retain(|(t, _)| t != text);
+    seen.push((text.to_owned(), aligns));
+    if seen.len() > ALIGN_HISTORY_LEN {
+        seen.remove(0);
+    }
+}
+
 /// Select `range` (bytes of `text`) in the page text box `id` again. egui keeps a box's selection
 /// only while it has the focus, so a click on Format text drops it; given back as formatting
 /// returns the focus, it stays shown, and a second choice reaches the same text.
@@ -441,6 +490,12 @@ impl LineEditor {
         self.original = self.text.clone();
     }
 
+    /// The text changed from `before` through the box's own typing (typing, Undo, Redo): rows
+    /// aligned on their own keep their alignment, and a row Undo brings back gets its own back.
+    pub(crate) fn follow_typed_rows(&mut self, ctx: &egui::Context, before: &str) {
+        follow_typing(ctx, input_id(), before, &self.text, &mut [&mut self.look.aligns, &mut self.look0.aligns]);
+    }
+
     /// The text changed from `before`: rows aligned on their own keep their alignment.
     pub(crate) fn follow_rows(&mut self, before: &str) {
         for look in [&mut self.look, &mut self.look0] {
@@ -1780,7 +1835,7 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                 }
                 let r = output.response;
                 if r.changed() {
-                    ed.follow_rows(&before);
+                    ed.follow_typed_rows(ctx, &before);
                     // The next pass measures the updated draft with the Apply/Save rewrite.
                     ctx.request_repaint();
                 }
@@ -1851,6 +1906,71 @@ pub(crate) fn caret_color_on(fill: Color32) -> Color32 {
 mod tests {
     use super::*;
 
+    /// Undo back to a text the box showed brings its rows' alignments back, unless an alignment
+    /// was picked since: then the older alignments are stale, and the edit is followed instead, so
+    /// Undo never takes back the pick.
+    #[test]
+    fn typing_history_restores_alignments_unless_one_was_picked_since() {
+        use pdfcraft_engine::TextAlign::{Center, Right};
+        let (ctx, id) = (egui::Context::default(), egui::Id::new("box"));
+        let mut aligns = vec![None, Some(Center), Some(Right)];
+        follow_typing(
+            &ctx,
+            id,
+            "A
+B
+C",
+            "A
+C",
+            &mut [&mut aligns],
+        );
+        assert_eq!(aligns, [None, Some(Right)], "the deleted row's entry goes");
+        follow_typing(
+            &ctx,
+            id,
+            "A
+C",
+            "A
+B
+C",
+            &mut [&mut aligns],
+        );
+        assert_eq!(aligns, [None, Some(Center), Some(Right)], "Undo brings it back");
+        follow_typing(
+            &ctx,
+            id,
+            "A
+B
+C",
+            "A
+C",
+            &mut [&mut aligns],
+        );
+        // An alignment picked for the first row, with no typing.
+        aligns = vec![Some(Right), Some(Right)];
+        let picked = aligns.clone();
+        follow_typing(
+            &ctx,
+            id,
+            "A
+C",
+            "A
+B
+C",
+            &mut [&mut aligns],
+        );
+        assert_eq!(
+            aligns,
+            pdfcraft_engine::paragraph_align::remap(
+                "A
+C", "A
+B
+C", &picked
+            ),
+            "the pick stays"
+        );
+    }
+
     #[test]
     fn the_rotate_knob_moves_below_when_there_is_no_room_above() {
         let view = Rect::from_min_max(Pos2::new(0.0, 100.0), Pos2::new(500.0, 500.0));
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 6dce0631da..fdb3c15273 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -233,12 +233,14 @@ impl PdfCraftApp {
         let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
         if let Some(ed) = view.line_editor.as_mut().filter(|ed| ed.has_unsaved_text()) {
             let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, true) else { return false };
-            ed.text = text;
+            let before = std::mem::replace(&mut ed.text, text);
+            ed.follow_typed_rows(&ctx, &before);
             return true;
         }
         if let Some(d) = view.content.draft.as_mut().filter(|d| d.has_unapplied_typing()) {
             let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, true) else { return false };
-            d.text = text;
+            let before = std::mem::replace(&mut d.text, text);
+            crate::edit_text_ui::follow_typing(&ctx, crate::content_ui::input_id(), &before, &d.text, &mut [&mut d.style.aligns]);
             return true;
         }
         false
@@ -262,13 +264,13 @@ impl PdfCraftApp {
         if let Some(ed) = view.line_editor.as_mut() {
             let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, false) else { return ed.has_unsaved_text() };
             let before = std::mem::replace(&mut ed.text, text);
-            ed.follow_rows(&before);
+            ed.follow_typed_rows(&ctx, &before);
             return true;
         }
         if let Some(d) = view.content.draft.as_mut() {
             let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, false) else { return d.has_unapplied_typing() };
-            d.style.aligns = pdfcraft_engine::paragraph_align::remap(&d.text, &text, &d.style.aligns);
-            d.text = text;
+            let before = std::mem::replace(&mut d.text, text);
+            crate::edit_text_ui::follow_typing(&ctx, crate::content_ui::input_id(), &before, &d.text, &mut [&mut d.style.aligns]);
             return true;
         }
         false
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 327e3f45eb..27b413af53 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1089,6 +1089,47 @@ fn redo_from_the_menu_is_enabled_for_the_added_text_boxs_own_typing() {
     assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "Redo puts it back");
 }
 
+/// Saved added text of three lines aligned Left, Centre and Right: the centred line deleted
+/// with its line break, then brought back with Ctrl+Z, is centred again, and Ctrl+Shift+Z deletes
+/// it again. The box's history keeps only text, so the restored line took the first line's
+/// alignment, and finishing the box would have saved that.
+#[test]
+fn undo_brings_a_deleted_line_of_added_text_back_with_its_alignment() {
+    use pdfcraft_engine::TextAlign::{Center, Right};
+    let mut h = harness();
+    let rect = [40.0, 170.0, 240.0, 215.0];
+    let aligns = vec![None, Some(Center), Some(Right)];
+    let text = pdfcraft_engine::AddedText { rect, text: "A\nB\nC".into(), aligns: aligns.clone(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    // On the first line, at the top of the box.
+    let point = at(&h, 45.0, 205.0);
+    click(&mut h, point);
+    let draft = |h: &Harness<'static, PdfCraftApp>| h.state().views[0].content.draft.clone().expect("the box is open");
+    assert_eq!((draft(&h).text, draft(&h).style.aligns), ("A\nB\nC".to_string(), aligns.clone()), "the editor opened on the text");
+    // Select the second line with its line break, and delete it.
+    h.run_steps(2);
+    // To the start of the first line, wherever the click put the caret.
+    for _ in 0..3 {
+        h.key_press(egui::Key::ArrowUp);
+    }
+    h.key_press(egui::Key::Home);
+    h.run_steps(1);
+    h.key_press(egui::Key::ArrowDown);
+    h.run_steps(1);
+    h.key_press_modifiers(egui::Modifiers::SHIFT, egui::Key::ArrowDown);
+    h.key_press(egui::Key::Backspace);
+    h.run_steps(2);
+    assert_eq!((draft(&h).text, draft(&h).style.aligns), ("A\nC".to_string(), vec![None, Some(Right)]), "the centred line is gone");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!((draft(&h).text, draft(&h).style.aligns), ("A\nB\nC".to_string(), aligns), "Undo brings it back centred");
+    h.key_press_modifiers(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!((draft(&h).text, draft(&h).style.aligns), ("A\nC".to_string(), vec![None, Some(Right)]), "Redo deletes it again");
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index ceb4c36007..962953d3ef 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6574,6 +6574,36 @@ fn aligning_a_selected_row_aligns_only_that_row_and_undo_puts_it_back() {
     assert!((row_rect(&h, "nine")[0] - last[0]).abs() < 0.5, "the last row is back");
 }
 
+/// A row aligned on its own, deleted by typing, then brought back with Undo from the menu: it
+/// comes back with its alignment, and Redo deletes it again. The box's history keeps only text,
+/// so the restored row took the alignment of the row before it.
+#[test]
+fn undo_brings_a_deleted_row_back_with_its_alignment() {
+    let mut h = three_row_paragraph();
+    // Right-align the last row on its own.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
+    h.run_steps(2);
+    align_by_pointer(&mut h, "Align right");
+    let ed = |h: &Harness<'static, PdfCraftApp>| h.state().views[0].line_editor.clone().expect("the paragraph stays open");
+    let (three_rows, aligned) = (ed(&h).text, ed(&h).look.aligns);
+    assert_eq!(aligned.last(), Some(&Some(pdfcraft_engine::TextAlign::Right)), "{aligned:?}");
+    // Delete the last row with the line break before it.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::ArrowLeft);
+    h.key_press(Key::Backspace);
+    h.run_steps(2);
+    let (two_rows, after_delete) = (ed(&h).text, ed(&h).look.aligns);
+    assert_eq!(pdfcraft_engine::paragraph_align::count(&two_rows), 2, "{two_rows:?}");
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!((ed(&h).text, ed(&h).look.aligns), (three_rows, aligned), "Undo brings the row back right-aligned");
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    assert_eq!((ed(&h).text, ed(&h).look.aligns), (two_rows, after_delete), "Redo deletes it again");
+}
+
 /// Redo after Undo in the box puts the typing back, in the box: it doesn't reach the document,
 /// whose own Redo (a formatting change waiting here) must stay waiting.
 #[test]
@@ -6771,12 +6801,14 @@ fn typing_in_one_tab_never_reaches_another_tabs_paragraph() {
     // The copy, its paragraph still open: Redo there has nothing of its own to put back.
     h.state_mut().active = Some(1);
     h.run_steps(3);
+    assert!(h.state().views[1].line_editor.is_some(), "the copy's paragraph is still open");
     h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
     h.run_steps(3);
-    let text = h.state().views[1].line_editor.as_ref().map(|ed| ed.text.clone());
-    assert!(!text.as_deref().unwrap_or_default().contains("secret"), "the other tab's typing came in: {text:?}");
+    let text = h.state().views[1].line_editor.as_ref().expect("the copy's paragraph stays open through Redo").text.clone();
+    assert!(!text.contains("secret"), "the other tab's typing came in: {text:?}");
     // Nor through what the menu's Redo runs, which reads the box's history itself (the menu item
-    // is off here, as the copy's document has nothing to redo).
+    // is off here, as the copy's document has nothing to redo). With no Redo of its own, the box
+    // passes the step to the document and closes, so the page's text is checked too.
     h.state_mut().redo();
     h.run_steps(3);
     let s = h.state();

From c9abf15e7c503c5b794f1dfd8a2f245da889040b Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 16:57:41 +1100
Subject: [PATCH 073/270] fix(edit): only a row aligned on its own is rewritten

A nonempty aligns counted as a style change, so every row of the
paragraph was rebuilt from the text state: rows left unselected lost
their source operators, and with TJ word gaps their words moved by
about a point and a half while the row's outer width stayed the same.
aligns no longer makes an edit non-plain; a row whose own line has an
alignment override is rewritten, and the others keep their operators.
---
 crates/edit/src/tests.rs        | 20 ++++++++++++++++++++
 crates/edit/src/text_regions.rs | 12 +++++++++---
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index f12430561e..afd908f86c 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -6975,6 +6975,26 @@ fn one_row_of_a_paragraph_takes_its_own_alignment() {
     assert!((row("eight")[2] - block.rect[2]).abs() < 1.0, "the second row ends at the right edge: {:?} vs {}", row("eight"), block.rect[2]);
 }
 
+/// Only a row given an alignment of its own is rewritten. The others keep their source operators,
+/// `TJ` word gaps included, so their words stay exactly where they were: rebuilt from the text,
+/// the first row's words moved by about a point and a half while its outer width stayed the same.
+#[test]
+fn rows_without_their_own_alignment_keep_their_operators() {
+    let first = "[(One) -250 (two) -250 (three) -250 (four)] TJ";
+    let mut doc = text_page(&format!("BT /F1 10 Tf 12 TL 72 700 Td {first} T* [(five) -250 (six) -250 (seven) -250 (eight)] TJ T* (nine ten) Tj ET"));
+    let block = text::text_blocks(&doc, 0).unwrap()[0].clone();
+    assert_eq!(block.editor_text.matches('\n').count(), 2, "one paragraph of three rows: {:?}", block.editor_text);
+    let row = |doc: &Document, starts: &str| text::text_lines(doc, 0).unwrap().into_iter().find(|l| l.text.starts_with(starts)).expect("the row");
+    let ink = row(&doc, "One").ink;
+    let style = text::BlockStyle { aligns: vec![None, None, Some(added::Align::Right)], ..Default::default() };
+    text::rewrite_block(&mut doc, 0, 0, Some(&block.editor_text), &style).unwrap();
+    let doc = reopen(&doc);
+    assert_eq!(row(&doc, "One").ink, ink, "the first row's words stay where they were");
+    let content = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
+    assert!(content.contains(first), "the first row keeps its operator: {content}");
+    assert!((row(&doc, "nine").rect[2] - block.rect[2]).abs() < 1.0, "the last row is right-aligned: {:?}", row(&doc, "nine").rect);
+}
+
 /// The same in a region of several styles: only the short first row is centred.
 #[test]
 fn one_row_of_a_styled_region_takes_its_own_alignment() {
diff --git a/crates/edit/src/text_regions.rs b/crates/edit/src/text_regions.rs
index 5d0a01e97d..965792908b 100644
--- a/crates/edit/src/text_regions.rs
+++ b/crates/edit/src/text_regions.rs
@@ -874,10 +874,16 @@ pub(super) fn rewrite_styled_block(
     let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
     let ops = pieces.parse().ops;
     // A row the edit doesn't reach keeps its source operators, so its kerning, TJ word gaps and
-    // glyph widths stay exactly as they were instead of being rebuilt from the text state.
-    let plain = BlockStyle { ranges: Vec::new(), ..style.clone() } == BlockStyle::default();
+    // glyph widths stay exactly as they were instead of being rebuilt from the text state. A row
+    // aligned on its own is reached; the rows around it are not.
+    let plain = BlockStyle { ranges: Vec::new(), aligns: Vec::new(), ..style.clone() } == BlockStyle::default();
     let mut kept = if plain {
-        untouched_rows(block, draft, &row_ranges).into_iter().zip(&rows).map(|(same, row)| same && row.iter().all(|c| c.1 < source_count)).collect()
+        untouched_rows(block, draft, &row_ranges)
+            .into_iter()
+            .zip(&rows)
+            .zip(&row_lines)
+            .map(|((same, row), line)| same && row.iter().all(|c| c.1 < source_count) && style.aligns.get(*line).copied().flatten().is_none())
+            .collect()
     } else {
         vec![false; rows.len()]
     };

From e71a946c0f85d31e49187cd13941185caefdc097 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Sun, 25 Oct 2026 08:31:05 +0100
Subject: [PATCH 074/270] fix(edit): a backdrop is only a fill the graphics
 state paints plain white

Review of #2815 (FredApps): two ways the detector took real content for a
page's own white backdrop and replaced it by default.

- A `gs` sets only the keys its dictionary has, but each one replaced the
  whole opacity decision and read every key it left out as its default,
  so `/Transparent gs /LineOnly gs 1 g ... re f` (ca 0.5, then only a
  line width) counted as opaque. Fill alpha, soft mask and blend mode are
  now kept one by one, through `gs` and `q`/`Q`.
- A transfer function was never read: TR or TR2 mapping 1 to 0 paints
  `1 g` black, and the fill was still replaced. The transfer function is
  tracked too, TR2 over TR in the same dictionary, and only /Identity
  (and /Default for TR2) counts; anything else leaves the fill alone.

Tests: nine graphics states that must keep the fill (each also checks Add
Background leaves the content as it was) and nine that still find the
backdrop (keys set back, TR2 /Default over a TR function, q/Q restoring),
plus an end-to-end render of the reviewer's translucent case under a red
background. All the keep cases fail on the code before this change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/tests/it/backdrop.rs | 45 +++++++++++++++++
 crates/edit/src/backdrop.rs            | 67 +++++++++++++++++++++-----
 crates/edit/src/backdrop_tests.rs      | 62 +++++++++++++++++++++++-
 parity/acrobat-features.toml           |  2 +-
 4 files changed, 160 insertions(+), 16 deletions(-)

diff --git a/crates/automation/tests/it/backdrop.rs b/crates/automation/tests/it/backdrop.rs
index 2f7a002981..00570b260c 100644
--- a/crates/automation/tests/it/backdrop.rs
+++ b/crates/automation/tests/it/backdrop.rs
@@ -222,3 +222,48 @@ fn remove_background_warns_about_pages_whose_own_backdrop_stays_off() {
     assert_eq!(ok(&mut a, "doc_backdrops", json!({ "doc": doc }))["pages"], json!([]), "the fill stays off");
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// Two 200 × 100 pt pages whose full-page `1 g` fill is not a plain white backdrop (#2815
+/// review): page 1 paints it half transparent, through a `gs` that sets `ca` and a later one
+/// that only sets the line width; page 2 sends it through a transfer function that maps 1 to 0.
+fn graphics_state_pdf() -> Vec<u8> {
+    let invert = "<< /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >>";
+    let resources = format!("<< /ExtGState << /Transparent << /ca 0.5 >> /LineOnly << /LW 2 >> /Invert << /TR {invert} >> >> >>");
+    let contents = ["/Transparent gs /LineOnly gs 1 g 0 0 200 100 re f", "/Invert gs 1 g 0 0 200 100 re f"];
+    let mut objs: Vec<String> =
+        vec!["<< /Type /Catalog /Pages 2 0 R >>".into(), "<< /Type /Pages /Kids [3 0 R 5 0 R] /Count 2 /MediaBox [0 0 200 100] >>".into()];
+    for (i, c) in contents.iter().enumerate() {
+        objs.push(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R /Resources {resources} >>", 4 + 2 * i));
+        objs.push(format!("<< /Length {} >>\nstream\n{c}\nendstream", c.len()));
+    }
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// #2815 review: a translucent fill (its `ca` left in force by a later `gs`) and a fill through
+/// a transfer function are not backdrops, so a red background goes under them and the
+/// translucent white still lightens it.
+#[test]
+fn fills_the_graphics_state_changes_are_not_replaced() {
+    let dir = named_workdir("graphics-state");
+    std::fs::write(dir.join("gs.pdf"), graphics_state_pdf()).unwrap();
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let doc = ok(&mut a, "doc_open", json!({ "path": "gs.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "doc_backdrops", json!({ "doc": doc }))["pages"], json!([]), "neither fill is a backdrop");
+    ok(&mut a, "doc_background", json!({ "doc": doc, "color": "#FF0000" }));
+    let [r, g, b] = blank_spot(&mut a, doc, 1);
+    assert_eq!(r, 255, "{:?}", [r, g, b]);
+    assert!((100..=160).contains(&g) && (100..=160).contains(&b), "half-transparent white over red, not red: {:?}", [r, g, b]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/edit/src/backdrop.rs b/crates/edit/src/backdrop.rs
index d55cb753ba..72438dedac 100644
--- a/crates/edit/src/backdrop.rs
+++ b/crates/edit/src/backdrop.rs
@@ -20,8 +20,10 @@
 //! that a redaction, Remove Hidden Information or Edit Text removed from the copy.
 //!
 //! Detection is deliberately strict: only one rectangle (`re`), in DeviceGray, DeviceRGB or
-//! DeviceCMYK, opaque in the graphics state, with an axis-aligned transform, filled before any
-//! other painting, and covering the crop box. Anything else is real content and stays.
+//! DeviceCMYK, opaque, unmasked, normally blended and with the identity transfer function as the
+//! graphics state stands after every `gs` so far (each sets only its own keys), with an
+//! axis-aligned transform, filled before any other painting, and covering the crop box.
+//! Anything else is real content and stays.
 
 use pdfcraft_content::{Matrix, Op, Pieces};
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
@@ -80,7 +82,32 @@ struct State {
     white: bool,
     /// Non-stroking colour space components (1, 3, 4), or 0 for a space we don't read.
     space: usize,
-    opaque: bool,
+    paint: Paint,
+}
+
+/// The graphics-state parameters (ExtGState, ISO 32000-2 §8.4.5) that decide whether a fill
+/// paints its colour as given. A `gs` sets only the keys its dictionary has, so each is kept on
+/// its own: a later dictionary that leaves one out keeps the earlier value.
+#[derive(Clone, Copy, Debug, PartialEq)]
+struct Paint {
+    /// Non-stroking alpha (`ca`) is 1.
+    full_alpha: bool,
+    /// No soft mask (`SMask` is `/None`).
+    no_soft_mask: bool,
+    /// The blend mode (`BM`) is Normal or Compatible.
+    normal_blend: bool,
+    /// The transfer function (`TR`, or `TR2`, which takes precedence) is the identity: a
+    /// function could turn white into any colour.
+    identity_transfer: bool,
+}
+
+impl Paint {
+    const INITIAL: Paint = Paint { full_alpha: true, no_soft_mask: true, normal_blend: true, identity_transfer: true };
+
+    /// A fill paints its colour exactly, opaque.
+    fn plain(self) -> bool {
+        self.full_alpha && self.no_soft_mask && self.normal_blend && self.identity_transfer
+    }
 }
 
 /// The backdrop `page` (0-based) paints, if any. Finding the page walks the page tree, so to
@@ -381,7 +408,7 @@ fn sub(doc: &Document, res: &Dict, kind: &[u8], name: &[u8]) -> Option<std::sync
 
 /// Walk the operators until the first one that paints; a backdrop is that one, or nothing.
 fn walk(doc: &Document, res: &Dict, crop: [f64; 4], ops: &[Op]) -> Option<(Backdrop, Option<std::ops::Range<usize>>)> {
-    let mut st = State { ctm: Matrix::IDENTITY, clip: Some([f64::MIN, f64::MIN, f64::MAX, f64::MAX]), white: false, space: 1, opaque: true };
+    let mut st = State { ctm: Matrix::IDENTITY, clip: Some([f64::MIN, f64::MIN, f64::MAX, f64::MAX]), white: false, space: 1, paint: Paint::INITIAL };
     let mut saved: Vec<State> = Vec::new();
     // Current path: its rectangles in user space, or `None` once it is anything else.
     let mut path: Option<Vec<[f64; 4]>> = Some(Vec::new());
@@ -402,7 +429,7 @@ fn walk(doc: &Document, res: &Dict, crop: [f64; 4], ops: &[Op]) -> Option<(Backd
                 }
                 st.ctm = m.then(&st.ctm);
             }
-            b"gs" => st.opaque = opaque_state(doc, res, op.name(0)?)?,
+            b"gs" => apply_state(doc, res, op.name(0)?, &mut st.paint)?,
             b"g" => set_colour(&mut st, 1, op),
             b"rg" => set_colour(&mut st, 3, op),
             b"k" => set_colour(&mut st, 4, op),
@@ -443,7 +470,7 @@ fn walk(doc: &Document, res: &Dict, crop: [f64; 4], ops: &[Op]) -> Option<(Backd
                     Some([r]) => st.clip.and_then(|c| intersect(*r, c)).is_some_and(|r| pdfcraft_content::contains(r, crop, COVER_EPS)),
                     _ => false,
                 };
-                return (covers && st.white && st.opaque && !clip_next).then(|| (Backdrop::Fill, Some(op.span.clone())));
+                return (covers && st.white && st.paint.plain() && !clip_next).then(|| (Backdrop::Fill, Some(op.span.clone())));
             }
             b"Do" => {
                 let xo = sub(doc, res, b"XObject", op.name(0)?)?;
@@ -472,7 +499,7 @@ fn walk(doc: &Document, res: &Dict, crop: [f64; 4], ops: &[Op]) -> Option<(Backd
 /// A picture placed by the CTM (onto the unit square) covering the crop box, opaque, unclipped.
 fn covers_unit_square(st: &State, crop: [f64; 4], image: bool) -> bool {
     image
-        && st.opaque
+        && st.paint.plain()
         && axis_aligned(&st.ctm)
         && st.clip.and_then(|c| intersect(st.ctm.bbox([0.0, 0.0, 1.0, 1.0]), c)).is_some_and(|r| pdfcraft_content::contains(r, crop, COVER_EPS))
 }
@@ -488,14 +515,28 @@ fn set_colour(st: &mut State, components: usize, op: &Op) {
         };
 }
 
-/// Does the named ExtGState keep painting opaque and normal? `None` when it can't be read.
-fn opaque_state(doc: &Document, res: &Dict, name: &[u8]) -> Option<bool> {
+/// Apply the named ExtGState's keys that [`Paint`] tracks; the keys it doesn't have leave
+/// `paint` as it was. `None` when the dictionary or one of those values can't be read.
+fn apply_state(doc: &Document, res: &Dict, name: &[u8], paint: &mut Paint) -> Option<()> {
     let gs = sub(doc, res, b"ExtGState", name)?;
     let gs = gs.as_dict()?;
-    let alpha = gs.get(b"ca").map(|a| doc.resolve(a).as_f64()).unwrap_or(Some(1.0))?;
-    let soft = gs.get(b"SMask").is_some_and(|m| doc.resolve(m).as_name() != Some(b"None"));
-    let blend = gs.get(b"BM").is_some_and(|b| !matches!(doc.resolve(b).as_name(), Some(b"Normal" | b"Compatible")));
-    Some(alpha >= 0.999 && !soft && !blend)
+    if let Some(alpha) = gs.get(b"ca") {
+        paint.full_alpha = doc.resolve(alpha).as_f64()? >= 0.999;
+    }
+    if let Some(mask) = gs.get(b"SMask") {
+        paint.no_soft_mask = doc.resolve(mask).as_name() == Some(b"None");
+    }
+    if let Some(blend) = gs.get(b"BM") {
+        paint.normal_blend = matches!(doc.resolve(blend).as_name(), Some(b"Normal" | b"Compatible"));
+    }
+    // TR2 takes precedence over TR in the same dictionary (§8.4.5, Table 57). Only the names
+    // are read: a function (or one per colourant) is taken to change white.
+    if let Some(transfer) = gs.get(b"TR2") {
+        paint.identity_transfer = matches!(doc.resolve(transfer).as_name(), Some(b"Identity" | b"Default"));
+    } else if let Some(transfer) = gs.get(b"TR") {
+        paint.identity_transfer = doc.resolve(transfer).as_name() == Some(b"Identity");
+    }
+    Some(())
 }
 
 /// Rotations by multiples of 90° and scales only: rectangles stay rectangles.
diff --git a/crates/edit/src/backdrop_tests.rs b/crates/edit/src/backdrop_tests.rs
index c7bfcaa8b4..6ca100adcb 100644
--- a/crates/edit/src/backdrop_tests.rs
+++ b/crates/edit/src/backdrop_tests.rs
@@ -30,14 +30,28 @@ fn stream(dict: &str, data: &str) -> String {
 
 /// One 300 × 200 page drawing `pieces` (objects 5…), with a font, a page-sized image `/Im0`
 /// (object 4) and two graphics states, `/Half` (ca 0.5) and `/Full` (ca 1).
+/// The graphics states [`page`] offers. `INVERT` is a transfer function that maps 1 to 0, so
+/// `1 g` through it paints black (#2815 review).
+const GRAPHICS_STATES: &str = concat!(
+    "/Half << /ca 0.5 >> /Full << /ca 1 /CA 1 >> /LineOnly << /LW 2 >> ",
+    "/Masked << /SMask << /S /Luminosity /G 4 0 R >> >> /Unmasked << /SMask /None >> ",
+    "/Multiply << /BM /Multiply >> /NormalBlend << /BM /Normal >> ",
+    "/Invert << /TR << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >> >> ",
+    "/Invert2 << /TR2 << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >> >> ",
+    "/IdentityTR << /TR /Identity >> /DefaultTR2 << /TR2 /Default >> ",
+    "/InvertButTR2Default << /TR << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >> /TR2 /Default >> ",
+    "/IdentityButTR2Invert << /TR /Identity /TR2 << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >> >>",
+);
+
 fn page(pieces: &[&str]) -> Document {
     let refs: Vec<String> = (0..pieces.len()).map(|i| format!("{} 0 R", i + 5)).collect();
     let mut objs = vec![
         "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
         "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
         format!(
-            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents [{}] /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> /XObject << /Im0 4 0 R >> /ExtGState << /Half << /ca 0.5 >> /Full << /ca 1 /CA 1 >> >> >> >>",
-            refs.join(" ")
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents [{}] /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> /XObject << /Im0 4 0 R >> /ExtGState << {GS} >> >> >>",
+            refs.join(" "),
+            GS = GRAPHICS_STATES
         ),
         stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", "\u{80}"),
     ];
@@ -498,3 +512,47 @@ fn a_stream_listed_twice_is_replaced_in_both_slots_and_restored_in_both() {
     remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
     assert_eq!(streams(&doc), original);
 }
+
+/// #2815 review: a `gs` sets only the keys its dictionary has, so a translucent, masked,
+/// blended or transferred fill stays that way through a later `gs` that leaves the key out,
+/// and a transfer function that isn't the identity can turn `1 g` into any colour.
+#[test]
+fn graphics_state_a_later_gs_leaves_out_still_keeps_the_fill() {
+    for state in [
+        "/Half gs /LineOnly gs",
+        "/Masked gs /LineOnly gs",
+        "/Multiply gs /LineOnly gs",
+        "/Invert gs /LineOnly gs",
+        "/Invert2 gs /LineOnly gs",
+        "/Invert gs",
+        "/Invert2 gs",
+        "/IdentityButTR2Invert gs",
+        "/Invert gs q /LineOnly gs Q",
+    ] {
+        let mut doc = page(&[&format!("{state} 1 g 0 0 300 200 re f {TEXT}")]);
+        assert_eq!(page_backdrop(&doc, 0).unwrap(), None, "{state}");
+        let before = streams(&doc);
+        add_background(&mut doc, &[0], &red(), false).unwrap();
+        assert_eq!(streams(&doc)[1..], before[..], "{state}: the page's content is unchanged");
+    }
+}
+
+/// The other side of the same rule: a later `gs` that does set the key back, `TR2` naming the
+/// default over a `TR` function, and `Q` restoring what `q` saved still leave a plain white fill.
+#[test]
+fn graphics_state_set_back_before_the_fill_still_finds_the_backdrop() {
+    for state in [
+        "/Half gs /Full gs",
+        "/Masked gs /Unmasked gs",
+        "/Multiply gs /NormalBlend gs",
+        "/Invert gs /IdentityTR gs",
+        "/Invert2 gs /DefaultTR2 gs",
+        "/InvertButTR2Default gs",
+        "/LineOnly gs",
+        "q /Half gs Q",
+        "q /Invert gs Q",
+    ] {
+        let doc = page(&[&format!("{state} 1 g 0 0 300 200 re f {TEXT}")]);
+        assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Fill), "{state}");
+    }
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 46e10e8b81..d38b467663 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2532,7 +2532,7 @@ status = "shipped"
 commands = ["edit.background"]
 tools = ["doc_background", "doc_backdrops"]
 evidence = ["crates/ui-egui/tests/it/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/it/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright", "crates/automation/tests/it/backdrop.rs::a_background_shows_on_a_page_that_paints_its_own_white_backdrop", "crates/ui-egui/tests/it/marks.rs::the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scans", "crates/ui-egui/tests/it/marks.rs::the_background_preview_follows_the_replace_checkbox", "crates/edit/src/backdrop_tests.rs::content_that_is_not_a_page_backdrop_is_left_alone", "crates/ui-egui/tests/it/marks.rs::the_preview_shows_the_page_the_range_selects_under_the_marks"]
-notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove turns it back on, after edits and redactions too, unless the operators before it changed or it would no longer be painted first, and then says which pages keep it off). The replaced copy's tag holds no page content or reference, so text a redaction or Remove Hidden Information takes off such a page leaves the file. Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space. The dialog previews a colour as a tint of the page's own thumbnail (opaque pictures on the page are tinted there too, not in the result), a file as its frame and name; a page that will still hide the background (a scan, or a white backdrop with Replace unticked) previews without the colour"
+notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove turns it back on, after edits and redactions too, unless the operators before it changed or it would no longer be painted first, and then says which pages keep it off). The replaced copy's tag holds no page content or reference, so text a redaction or Remove Hidden Information takes off such a page leaves the file. Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space, and white fills drawn translucent, through a soft mask, a non-Normal blend mode or a transfer function (TR/TR2) as the graphics state stands after every gs, which are real content and stay. The dialog previews a colour as a tint of the page's own thumbnail (opaque pictures on the page are tinted there too, not in the result), a file as its frame and name; a page that will still hide the background (a scan, or a white backdrop with Replace unticked) previews without the colour"
 
 [[feature]]
 id = "edit.background-update-remove"

From abc378c0bb8c34c17a3f43ea30e98db33a3c3574 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 19:10:46 +1100
Subject: [PATCH 075/270] fix(ui): a text box keeps its typing history through
 a trip to another tab
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tabs share one text box, and its Undo history was cleared whenever
another document's box took it: opening a paragraph in tab B wiped tab
A's typing steps, so Edit ▸ Undo back in A found none and closed A's
paragraph instead of taking the typing back. The box being left now
keeps a copy of its history and caret aside, under its document, and
the same box gets it back on its return; a box new to the text box
still starts with none, so typing still never reaches another tab. The
copy is a deep one: a state's history is shared between its clones.
---
 crates/ui-egui/src/edit_text_ui.rs | 26 +++++++++++++++---
 crates/ui-egui/tests/it/content.rs | 36 +++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 43 ++++++++++++++++++++++++++++++
 3 files changed, 101 insertions(+), 4 deletions(-)

diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index 396c430a7f..4724cbb6e5 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -276,15 +276,33 @@ pub(crate) fn input_id() -> egui::Id {
 /// as it was before a format change, into a box showing the page as it is now. `from` is the box's
 /// own record of that; which document `doc` last used the history is kept beside it, since a box
 /// in another tab on the same text would otherwise take that document's typing with its Redo.
+/// When another document's box takes the text box, the box it leaves keeps its history (and
+/// caret) aside, and gets it back on its return, so its typing can still be undone there.
 pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, doc: pdfcraft_engine::DocId, from: &mut Option<String>, text: &str) {
     let owner = id.with("typing-doc");
-    if from.as_deref() == Some(text) && ctx.data(|d| d.get_temp::<pdfcraft_engine::DocId>(owner)) == Some(doc) {
+    let last = ctx.data(|d| d.get_temp::<pdfcraft_engine::DocId>(owner));
+    if from.as_deref() == Some(text) && last == Some(doc) {
         return;
     }
-    if let Some(mut state) = egui::TextEdit::load_state(ctx, id) {
-        state.clear_undoer();
-        egui::TextEdit::store_state(ctx, id, state);
+    let aside = |doc: pdfcraft_engine::DocId| id.with(("typing-aside", doc));
+    if let Some(left) = last.filter(|l| *l != doc)
+        && let Some(state) = egui::TextEdit::load_state(ctx, id)
+    {
+        // A copy of its own: a state's history is shared between its clones, and the next box
+        // clears it in place.
+        let mut kept = egui::text_edit::TextEditState::default();
+        kept.cursor = state.cursor;
+        kept.set_undoer(state.undoer());
+        ctx.data_mut(|d| d.insert_temp(aside(left), kept));
     }
+    // Only the same box, still on the text it opened on, takes its history back.
+    let back = ctx.data_mut(|d| d.remove_temp::<egui::text_edit::TextEditState>(aside(doc))).filter(|_| from.as_deref() == Some(text));
+    let state = back.unwrap_or_else(|| {
+        let mut state = egui::TextEdit::load_state(ctx, id).unwrap_or_default();
+        state.clear_undoer();
+        state
+    });
+    egui::TextEdit::store_state(ctx, id, state);
     ctx.data_mut(|d| d.insert_temp(owner, doc));
     *from = Some(text.to_owned());
 }
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index a17d0793ea..43771ed724 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1022,6 +1022,42 @@ fn redo_from_the_menu_is_enabled_for_the_added_text_boxs_own_typing() {
     assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "Redo puts it back");
 }
 
+/// Typing in tab A's added text box, the same text opened in tab B, then back to A: Edit ▸ Undo
+/// takes the typing back in A's box, which stays open.
+#[test]
+fn undo_after_a_round_trip_through_another_tab_takes_back_added_text_typing() {
+    let mut h = harness();
+    h.state_mut().open_bytes("copy.pdf", None, include_bytes!("../data/form.pdf").to_vec()).unwrap();
+    h.run_steps(4);
+    let text = pdfcraft_engine::AddedText { rect: [40.0, 195.0, 240.0, 210.0], text: "Reviewed".into(), ..Default::default() };
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.text"));
+        h.run_steps(3);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        let k = r.width() / 300.0;
+        click(h, r.min + egui::vec2(45.0 * k, 195.0 * k));
+        assert_eq!(h.state().views[tab].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    };
+    for tab in [0, 1] {
+        h.state_mut().active = Some(tab);
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    }
+    open_in(&mut h, 0);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    open_in(&mut h, 1);
+    h.state_mut().active = Some(0);
+    h.run_steps(3);
+    let draft = |h: &Harness<'static, PdfCraftApp>| h.state().views[0].content.draft.as_ref().map(|d| d.text.clone());
+    assert_eq!(draft(&h).as_deref(), Some("Reviewed twice"), "A's box is still open with the typing");
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!(draft(&h).as_deref(), Some("Reviewed"), "Undo takes the typing back in A's box");
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index c22ce087f2..c1acc43fe7 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6645,6 +6645,49 @@ fn redo_from_the_menu_is_enabled_for_the_boxs_own_typing() {
     assert_eq!(h.state().views[0].line_editor.as_ref().expect("still open").text, typed, "Redo puts the typing back");
 }
 
+/// Typing in tab A's paragraph, a paragraph opened in tab B, then back to A: Edit ▸ Undo takes
+/// the typing back in A's box. The tabs share one text box, and its history was cleared each time
+/// another tab's box took it, so Undo found no step and closed A's paragraph instead
+/// (skylartaylor's and FredApps's review of 08ec1db7).
+#[test]
+fn undo_after_a_round_trip_through_another_tab_takes_back_the_typing() {
+    let mut h = harness(1, |app| {
+        app.open_bytes("copy.pdf", None, fixture(1)).expect("the copy opens");
+    });
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        if h.state().views[tab].line_editor.is_none() {
+            assert!(h.state_mut().execute("edit.edit_text"));
+            h.run_steps(2);
+        }
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        click_at(h, egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height()));
+        assert!(h.state().views[tab].line_editor.is_some(), "the paragraph opens for typing");
+    };
+    open_in(&mut h, 0);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    open_in(&mut h, 0);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    assert!(h.state().views[0].line_editor.as_ref().unwrap().text.ends_with(" more"));
+    open_in(&mut h, 1);
+    h.state_mut().active = Some(0);
+    h.run_steps(3);
+    assert!(h.state().views[0].line_editor.is_some(), "A's paragraph is still open after the round trip");
+    assert!(h.state_mut().execute("edit.undo"), "Undo is enabled");
+    h.run_steps(3);
+    let s = h.state();
+    let ed = s.views[0].line_editor.as_ref().expect("the box stays open: Undo takes back the typing");
+    assert_eq!(ed.text, original, "the typing is taken back in the box");
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
+}
+
 /// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
 /// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
 /// Typing in one tab, taken back with Undo, then came back with Redo in the other tab.

From bfc6f8b1b97e75a635b7b3beff01cc03c8c91171 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 19:10:46 +1100
Subject: [PATCH 076/270] fix(ui): a text box keeps its typing history through
 a trip to another tab
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tabs share one text box, and its Undo history was cleared whenever
another document's box took it: opening a paragraph in tab B wiped tab
A's typing steps, so Edit ▸ Undo back in A found none and closed A's
paragraph instead of taking the typing back. The box being left now
keeps a copy of its history and caret aside, under its document, and
the same box gets it back on its return; a box new to the text box
still starts with none, so typing still never reaches another tab. The
copy is a deep one: a state's history is shared between its clones.

Carried from #4179 (abc378c0). On this branch the rows' alignments by
text go aside and come back with the history, so Undo after the trip
still restores a deleted row's alignment.
---
 crates/ui-egui/src/edit_text_ui.rs | 54 +++++++++++++++++++++++++++---
 crates/ui-egui/tests/it/content.rs | 36 ++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 43 ++++++++++++++++++++++++
 3 files changed, 128 insertions(+), 5 deletions(-)

diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index eff2f2631f..15cc0dfc00 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -276,18 +276,41 @@ pub(crate) fn input_id() -> egui::Id {
 /// as it was before a format change, into a box showing the page as it is now. `from` is the box's
 /// own record of that; which document `doc` last used the history is kept beside it, since a box
 /// in another tab on the same text would otherwise take that document's typing with its Redo.
+/// When another document's box takes the text box, the box it leaves keeps its history (and
+/// caret) aside, and gets it back on its return, so its typing can still be undone there.
 pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, doc: pdfcraft_engine::DocId, from: &mut Option<String>, text: &str) {
     let owner = id.with("typing-doc");
-    if from.as_deref() == Some(text) && ctx.data(|d| d.get_temp::<pdfcraft_engine::DocId>(owner)) == Some(doc) {
+    let last = ctx.data(|d| d.get_temp::<pdfcraft_engine::DocId>(owner));
+    if from.as_deref() == Some(text) && last == Some(doc) {
         return;
     }
-    if let Some(mut state) = egui::TextEdit::load_state(ctx, id) {
-        state.clear_undoer();
-        egui::TextEdit::store_state(ctx, id, state);
+    let aside = |doc: pdfcraft_engine::DocId| id.with(("typing-aside", doc));
+    let aligns = id.with(ALIGN_HISTORY);
+    if let Some(left) = last.filter(|l| *l != doc)
+        && let Some(state) = egui::TextEdit::load_state(ctx, id)
+    {
+        // A copy of its own: a state's history is shared between its clones, and the next box
+        // clears it in place. The rows' alignments by text go with it.
+        let mut kept = egui::text_edit::TextEditState::default();
+        kept.cursor = state.cursor;
+        kept.set_undoer(state.undoer());
+        ctx.data_mut(|d| {
+            let rows = d.get_temp::<AlignHistory>(aligns).unwrap_or_default();
+            d.insert_temp(aside(left), (kept, rows));
+        });
     }
+    // Only the same box, still on the text it opened on, takes its history back.
+    let back =
+        ctx.data_mut(|d| d.remove_temp::<(egui::text_edit::TextEditState, AlignHistory)>(aside(doc))).filter(|_| from.as_deref() == Some(text));
+    let (state, rows) = back.unwrap_or_else(|| {
+        let mut state = egui::TextEdit::load_state(ctx, id).unwrap_or_default();
+        state.clear_undoer();
+        (state, AlignHistory::default())
+    });
+    egui::TextEdit::store_state(ctx, id, state);
     ctx.data_mut(|d| {
         d.insert_temp(owner, doc);
-        d.remove::<AlignHistory>(id.with(ALIGN_HISTORY));
+        d.insert_temp(aligns, rows);
     });
     *from = Some(text.to_owned());
 }
@@ -1906,6 +1929,27 @@ pub(crate) fn caret_color_on(fill: Color32) -> Color32 {
 mod tests {
     use super::*;
 
+    /// The rows' alignments by text go aside with the box's history when another tab's box takes
+    /// the text box, and come back with it: Undo after the trip still restores a deleted row's
+    /// alignment, while the other tab's box starts with none.
+    #[test]
+    fn alignments_by_text_survive_a_trip_to_another_tab() {
+        use pdfcraft_engine::{DocId, TextAlign::Right};
+        let (ctx, id) = (egui::Context::default(), egui::Id::new("box"));
+        let (mut a_from, mut b_from) = (None, None);
+        forget_typing_before(&ctx, id, DocId(1), &mut a_from, "A\nB");
+        let mut aligns = vec![None, Some(Right)];
+        follow_typing(&ctx, id, "A\nB", "A", &mut [&mut aligns]);
+        forget_typing_before(&ctx, id, DocId(2), &mut b_from, "A\nB");
+        let mut other = vec![None, None];
+        follow_typing(&ctx, id, "A\nB", "A", &mut [&mut other]);
+        follow_typing(&ctx, id, "A", "A\nB", &mut [&mut other]);
+        assert_eq!(other, [None, None], "tab B's box gets back its own alignments, not tab A's");
+        forget_typing_before(&ctx, id, DocId(1), &mut a_from, "A\nB");
+        follow_typing(&ctx, id, "A", "A\nB", &mut [&mut aligns]);
+        assert_eq!(aligns, [None, Some(Right)], "back in tab A, Undo brings the row back right-aligned");
+    }
+
     /// Undo back to a text the box showed brings its rows' alignments back, unless an alignment
     /// was picked since: then the older alignments are stale, and the edit is followed instead, so
     /// Undo never takes back the pick.
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 27b413af53..e7210a8ac9 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1130,6 +1130,42 @@ fn undo_brings_a_deleted_line_of_added_text_back_with_its_alignment() {
     assert_eq!((draft(&h).text, draft(&h).style.aligns), ("A\nC".to_string(), vec![None, Some(Right)]), "Redo deletes it again");
 }
 
+/// Typing in tab A's added text box, the same text opened in tab B, then back to A: Edit ▸ Undo
+/// takes the typing back in A's box, which stays open.
+#[test]
+fn undo_after_a_round_trip_through_another_tab_takes_back_added_text_typing() {
+    let mut h = harness();
+    h.state_mut().open_bytes("copy.pdf", None, include_bytes!("../data/form.pdf").to_vec()).unwrap();
+    h.run_steps(4);
+    let text = pdfcraft_engine::AddedText { rect: [40.0, 195.0, 240.0, 210.0], text: "Reviewed".into(), ..Default::default() };
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.text"));
+        h.run_steps(3);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        let k = r.width() / 300.0;
+        click(h, r.min + egui::vec2(45.0 * k, 195.0 * k));
+        assert_eq!(h.state().views[tab].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    };
+    for tab in [0, 1] {
+        h.state_mut().active = Some(tab);
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    }
+    open_in(&mut h, 0);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    open_in(&mut h, 1);
+    h.state_mut().active = Some(0);
+    h.run_steps(3);
+    let draft = |h: &Harness<'static, PdfCraftApp>| h.state().views[0].content.draft.as_ref().map(|d| d.text.clone());
+    assert_eq!(draft(&h).as_deref(), Some("Reviewed twice"), "A's box is still open with the typing");
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!(draft(&h).as_deref(), Some("Reviewed"), "Undo takes the typing back in A's box");
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 962953d3ef..a92850a275 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6770,6 +6770,49 @@ fn redo_from_the_menu_is_enabled_for_the_boxs_own_typing() {
     assert_eq!(h.state().views[0].line_editor.as_ref().expect("still open").text, typed, "Redo puts the typing back");
 }
 
+/// Typing in tab A's paragraph, a paragraph opened in tab B, then back to A: Edit ▸ Undo takes
+/// the typing back in A's box. The tabs share one text box, and its history was cleared each time
+/// another tab's box took it, so Undo found no step and closed A's paragraph instead
+/// (skylartaylor's and FredApps's review of 08ec1db7).
+#[test]
+fn undo_after_a_round_trip_through_another_tab_takes_back_the_typing() {
+    let mut h = harness(1, |app| {
+        app.open_bytes("copy.pdf", None, fixture(1)).expect("the copy opens");
+    });
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        if h.state().views[tab].line_editor.is_none() {
+            assert!(h.state_mut().execute("edit.edit_text"));
+            h.run_steps(2);
+        }
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        click_at(h, egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height()));
+        assert!(h.state().views[tab].line_editor.is_some(), "the paragraph opens for typing");
+    };
+    open_in(&mut h, 0);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    open_in(&mut h, 0);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    assert!(h.state().views[0].line_editor.as_ref().unwrap().text.ends_with(" more"));
+    open_in(&mut h, 1);
+    h.state_mut().active = Some(0);
+    h.run_steps(3);
+    assert!(h.state().views[0].line_editor.is_some(), "A's paragraph is still open after the round trip");
+    assert!(h.state_mut().execute("edit.undo"), "Undo is enabled");
+    h.run_steps(3);
+    let s = h.state();
+    let ed = s.views[0].line_editor.as_ref().expect("the box stays open: Undo takes back the typing");
+    assert_eq!(ed.text, original, "the typing is taken back in the box");
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
+}
+
 /// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
 /// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
 /// Typing in one tab, taken back with Undo, then came back with Redo (the key or the menu) in the

From aa326f37cdf7ae823cb2149321bf413a7b036ef3 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 21:15:26 +1100
Subject: [PATCH 077/270] fix(ui): formatting restarts a text box's history;
 the menu claims the box first

Three holes in the shared text box's history:

- Formatting applied with the paragraph open left typing_from as it
  was, so when the format left the text unchanged the box kept its
  history, and Redo put typing undone before the format back on top of
  it. applied() now resets typing_from, so the next claim clears it.
- Undo or Redo from the menu in the same frame as a tab switch ran
  before the box was drawn, on the history of the other tab's box: Undo
  put tab B's text into tab A's box, and Redo put A's undone typing into
  B's. undo_in_page_box and redo_in_page_box now make the box claim the
  text box first (claim_typing), as drawing it does.
- A box new to the text box cleared only the last box's history and
  kept its caret and selection; it now starts from a default state.

claim_typing on LineEditor and TextDraft is now the one way a box takes
the text box, for drawing and for the menu.
---
 crates/ui-egui/src/content_ui.rs   |   8 ++-
 crates/ui-egui/src/edit_text_ui.rs |  23 ++++--
 crates/ui-egui/src/editing.rs      |   6 ++
 crates/ui-egui/tests/it/content.rs |  36 ++++++++++
 crates/ui-egui/tests/it/editing.rs | 110 +++++++++++++++++++++++++++++
 5 files changed, 175 insertions(+), 8 deletions(-)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 04d626088d..77edee6876 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -75,6 +75,12 @@ pub struct TextDraft {
 }
 
 impl TextDraft {
+    /// Take the shared text box for this box ([`crate::edit_text_ui::forget_typing_before`]): its
+    /// own history, or none once the page has its text.
+    pub(crate) fn claim_typing(&mut self, ctx: &egui::Context, doc: pdfcraft_engine::DocId) {
+        crate::edit_text_ui::forget_typing_before(ctx, input_id(), doc, &mut self.typing_from, &self.style.text);
+    }
+
     /// Typing the page doesn't have yet: Undo takes it back in the box before touching the document.
     pub(crate) fn has_unapplied_typing(&self) -> bool {
         self.text != self.style.text
@@ -604,7 +610,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                 ui.fonts_mut(|f| f.layout_job(job))
             };
             let input = input_id();
-            crate::edit_text_ui::forget_typing_before(ui.ctx(), input, doc_id, &mut t.typing_from, &t.style.text);
+            t.claim_typing(ui.ctx(), doc_id);
             ui.horizontal_top(|ui| {
                 ui.spacing_mut().item_spacing.x = 4.0;
                 let mut edit = egui::TextEdit::multiline(&mut t.text)
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index 4724cbb6e5..a0f73eaf43 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -277,7 +277,9 @@ pub(crate) fn input_id() -> egui::Id {
 /// own record of that; which document `doc` last used the history is kept beside it, since a box
 /// in another tab on the same text would otherwise take that document's typing with its Redo.
 /// When another document's box takes the text box, the box it leaves keeps its history (and
-/// caret) aside, and gets it back on its return, so its typing can still be undone there.
+/// caret) aside, and gets it back on its return, so its typing can still be undone there. Each
+/// box claims the text box when it is drawn, and Undo and Redo from the menu claim it first too,
+/// since they can run before the box is drawn again after a tab switch.
 pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, doc: pdfcraft_engine::DocId, from: &mut Option<String>, text: &str) {
     let owner = id.with("typing-doc");
     let last = ctx.data(|d| d.get_temp::<pdfcraft_engine::DocId>(owner));
@@ -297,11 +299,9 @@ pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, doc: pdfcr
     }
     // Only the same box, still on the text it opened on, takes its history back.
     let back = ctx.data_mut(|d| d.remove_temp::<egui::text_edit::TextEditState>(aside(doc))).filter(|_| from.as_deref() == Some(text));
-    let state = back.unwrap_or_else(|| {
-        let mut state = egui::TextEdit::load_state(ctx, id).unwrap_or_default();
-        state.clear_undoer();
-        state
-    });
+    // A box new to the text box starts with nothing of the last one's: no history, caret or
+    // selection.
+    let state = back.unwrap_or_default();
     egui::TextEdit::store_state(ctx, id, state);
     ctx.data_mut(|d| d.insert_temp(owner, doc));
     *from = Some(text.to_owned());
@@ -421,9 +421,18 @@ impl LineEditor {
         self.look0 = self.look.clone();
         self.extras0 = self.extras;
         self.original = self.text.clone();
+        // The page now has this text: the box's history restarts, even when the format left the
+        // text as it was, so a Redo from before can't put undone typing back on top of it.
+        self.typing_from = None;
         self.focus = true;
     }
 
+    /// Take the shared text box for this paragraph ([`forget_typing_before`]): its own history,
+    /// or none once the page has its text.
+    pub(crate) fn claim_typing(&mut self, ctx: &egui::Context, doc: pdfcraft_engine::DocId) {
+        forget_typing_before(ctx, input_id(), doc, &mut self.typing_from, &self.original);
+    }
+
     /// Adopt the rewritten paragraph's current geometry before the next overlay frame.
     pub(crate) fn refresh_source(&mut self, block: &pdfcraft_engine::TextBlock, lines: Vec<pdfcraft_engine::TextLine>) {
         self.source_rect = block.rect.map(|v| v as f32);
@@ -1724,7 +1733,7 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                     if snapshot.changes_with(text.as_str()) { galley } else { unseen(galley) }
                 };
                 let input = input_id();
-                forget_typing_before(ui.ctx(), input, view_id, &mut ed.typing_from, &ed.original);
+                ed.claim_typing(ui.ctx(), view_id);
                 let output = egui::TextEdit::multiline(&mut ed.text)
                     .id(input)
                     .font(font.clone())
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 408474eaa9..a7ee6b3d54 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -231,12 +231,15 @@ impl PdfCraftApp {
     fn undo_in_page_box(&mut self) -> bool {
         let Some(ctx) = self.ctx.clone() else { return false };
         let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
+        let doc = view.id;
         if let Some(ed) = view.line_editor.as_mut().filter(|ed| ed.has_unsaved_text()) {
+            ed.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, true) else { return false };
             ed.text = text;
             return true;
         }
         if let Some(d) = view.content.draft.as_mut().filter(|d| d.has_unapplied_typing()) {
+            d.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, true) else { return false };
             d.text = text;
             return true;
@@ -259,12 +262,15 @@ impl PdfCraftApp {
     fn redo_in_page_box(&mut self) -> bool {
         let Some(ctx) = self.ctx.clone() else { return false };
         let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
+        let doc = view.id;
         if let Some(ed) = view.line_editor.as_mut() {
+            ed.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, false) else { return ed.has_unsaved_text() };
             ed.text = text;
             return true;
         }
         if let Some(d) = view.content.draft.as_mut() {
+            d.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, false) else { return d.has_unapplied_typing() };
             d.text = text;
             return true;
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 43771ed724..387cc1aed1 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1058,6 +1058,42 @@ fn undo_after_a_round_trip_through_another_tab_takes_back_added_text_typing() {
     assert_eq!(draft(&h).as_deref(), Some("Reviewed"), "Undo takes the typing back in A's box");
 }
 
+/// Edit ▸ Undo chosen in the same frame as the switch back to tab A's added text box, before it
+/// is drawn again: the shared text box still holds tab B's history, from a box on other text, so
+/// A's box claims its own back before stepping.
+#[test]
+fn undo_in_the_frame_of_the_switch_back_takes_back_added_text_typing() {
+    let mut h = harness();
+    h.state_mut().open_bytes("copy.pdf", None, include_bytes!("../data/form.pdf").to_vec()).unwrap();
+    h.run_steps(4);
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    for (tab, text) in [(0, "Reviewed"), (1, "Approved")] {
+        h.state_mut().active = Some(tab);
+        let text = pdfcraft_engine::AddedText { rect, text: text.into(), ..Default::default() };
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    }
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.text"));
+        h.run_steps(3);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        let k = r.width() / 300.0;
+        click(h, r.min + egui::vec2(45.0 * k, 195.0 * k));
+        assert_eq!(h.state().views[tab].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    };
+    open_in(&mut h, 0);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    open_in(&mut h, 1);
+    // Back to A and Undo at once: no frame draws A's box in between.
+    h.state_mut().active = Some(0);
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes the typing back in A's box");
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index c1acc43fe7..da2a703f55 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6688,6 +6688,116 @@ fn undo_after_a_round_trip_through_another_tab_takes_back_the_typing() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
 }
 
+/// Typing taken back with Ctrl+Z, then Bold applied with the paragraph still open: Ctrl+Shift+Z
+/// must not bring the typing back on top of the bold, as the box's history is cleared once the
+/// page has its text. The format left the text as it was, so the box kept its history and its
+/// Redo put "Page 1 more" back (FredApps's review of abc378c0).
+#[test]
+fn redo_after_formatting_never_brings_back_typing_undone_before_it() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the typing is taken back");
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), Some("Edit text"), "the bold is applied");
+    h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
+    h.run_steps(3);
+    let text = h.state().views[0].line_editor.as_ref().map(|ed| ed.text.clone());
+    assert_eq!(text.as_deref(), Some(original.as_str()), "the typing undone before the bold stays undone");
+    // Nor through what the menu's Redo runs.
+    h.state_mut().redo();
+    h.run_steps(3);
+    let s = h.state();
+    let text = s.views[0].line_editor.as_ref().map(|ed| ed.text.clone());
+    assert!(!text.as_deref().unwrap_or_default().contains("more"), "the menu's Redo brings it back: {text:?}");
+    assert_eq!(s.session.get(s.views[0].id).unwrap().text_blocks(0)[0].base_font, "Helvetica-Bold", "the bold stays");
+}
+
+/// Edit ▸ Undo chosen in the same frame as the switch back to tab A, before A's box is drawn
+/// again: the shared text box still holds tab B's history then. Stepping through it put B's
+/// typing into A's box; the box now claims its own history back first (CodeRabbit on abc378c0).
+#[test]
+fn undo_in_the_frame_of_the_switch_back_takes_back_the_typing() {
+    let mut h = harness(1, |app| {
+        app.open_bytes("copy.pdf", None, fixture(1)).expect("the copy opens");
+    });
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        if h.state().views[tab].line_editor.is_none() {
+            assert!(h.state_mut().execute("edit.edit_text"));
+            h.run_steps(2);
+        }
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        click_at(h, egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height()));
+        assert!(h.state().views[tab].line_editor.is_some(), "the paragraph opens for typing");
+    };
+    open_in(&mut h, 0);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    // In B, a paragraph whose text differs from A's ("Page 1 B", applied with Bold), so B's
+    // history can't pass for A's.
+    open_in(&mut h, 1);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" B".into()));
+    h.run_steps(2);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    assert_eq!(h.state().views[1].line_editor.as_ref().map(|ed| ed.text.as_str()), Some("Page 1 B"), "B's paragraph is open on its own text");
+    // Back to A and Undo at once: no frame draws A's box in between.
+    h.state_mut().active = Some(0);
+    assert!(h.state_mut().execute("edit.undo"), "Undo is enabled");
+    h.run_steps(3);
+    let ed = h.state().views[0].line_editor.clone().expect("the box stays open: Undo takes back the typing");
+    assert_eq!(ed.text, original, "the typing is taken back in A's box");
+}
+
+/// Redo from the menu chosen in the same frame as a switch to tab B, whose paragraph is open on
+/// the same text as A's: the shared text box still holds A's history then, with A's undone
+/// typing to redo, so B's box claims its own history back before stepping.
+#[test]
+fn redo_in_the_frame_of_a_tab_switch_never_brings_another_tabs_typing() {
+    let mut h = harness(1, |app| {
+        app.open_bytes("copy.pdf", None, fixture(1)).expect("the copy opens");
+    });
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.edit_text"));
+        h.run_steps(2);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        click_at(h, egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height()));
+        assert!(h.state().views[tab].line_editor.is_some(), "the paragraph opens for typing");
+    };
+    open_in(&mut h, 1);
+    open_in(&mut h, 0);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" secret".into()));
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "taken back in A");
+    // To B and Redo at once: no frame draws B's box in between.
+    h.state_mut().active = Some(1);
+    h.state_mut().redo();
+    h.run_steps(3);
+    let s = h.state();
+    let b = s.views[1].line_editor.as_ref().map(|ed| ed.text.clone());
+    assert!(!b.as_deref().unwrap_or_default().contains("secret"), "A's typing came back in B: {b:?}");
+    assert!(!s.session.get(s.views[1].id).unwrap().text_blocks(0)[0].text.contains("secret"), "A's typing reached B's page");
+}
+
 /// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
 /// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
 /// Typing in one tab, taken back with Undo, then came back with Redo in the other tab.

From e6e57a9a07471c2bc7d9051a30b08d0a60e3b123 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 21:15:26 +1100
Subject: [PATCH 078/270] fix(ui): formatting restarts a text box's history;
 the menu claims the box first

Three holes in the shared text box's history:

- Formatting applied with the paragraph open left typing_from as it
  was, so when the format left the text unchanged the box kept its
  history, and Redo put typing undone before the format back on top of
  it. applied() now resets typing_from, so the next claim clears it.
- Undo or Redo from the menu in the same frame as a tab switch ran
  before the box was drawn, on the history of the other tab's box: Undo
  put tab B's text into tab A's box, and Redo put A's undone typing into
  B's. undo_in_page_box and redo_in_page_box now make the box claim the
  text box first (claim_typing), as drawing it does.
- A box new to the text box cleared only the last box's history and
  kept its caret and selection; it now starts from a default state.

claim_typing on LineEditor and TextDraft is now the one way a box takes
the text box, for drawing and for the menu.

Carried from #4179 (aa326f37). On this branch the rows' alignments by
text restart with the history, so a Redo past a format can't bring
back an alignment from before it.
---
 crates/ui-egui/src/content_ui.rs   |   8 ++-
 crates/ui-egui/src/edit_text_ui.rs |  40 +++++++++--
 crates/ui-egui/src/editing.rs      |   6 ++
 crates/ui-egui/tests/it/content.rs |  36 ++++++++++
 crates/ui-egui/tests/it/editing.rs | 110 +++++++++++++++++++++++++++++
 5 files changed, 192 insertions(+), 8 deletions(-)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index a190e118bb..d6ac839f08 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -78,6 +78,12 @@ pub struct TextDraft {
 }
 
 impl TextDraft {
+    /// Take the shared text box for this box ([`crate::edit_text_ui::forget_typing_before`]): its
+    /// own history, or none once the page has its text.
+    pub(crate) fn claim_typing(&mut self, ctx: &egui::Context, doc: pdfcraft_engine::DocId) {
+        crate::edit_text_ui::forget_typing_before(ctx, input_id(), doc, &mut self.typing_from, &self.style.text);
+    }
+
     /// Typing the page doesn't have yet: Undo takes it back in the box before touching the document.
     pub(crate) fn has_unapplied_typing(&self) -> bool {
         self.text != self.style.text
@@ -624,7 +630,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
             };
             let before = t.text.clone();
             let input = input_id();
-            crate::edit_text_ui::forget_typing_before(ui.ctx(), input, doc_id, &mut t.typing_from, &t.style.text);
+            t.claim_typing(ui.ctx(), doc_id);
             ui.horizontal_top(|ui| {
                 ui.spacing_mut().item_spacing.x = 4.0;
                 let output = egui::TextEdit::multiline(&mut t.text)
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index 15cc0dfc00..69b08e49e6 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -277,7 +277,9 @@ pub(crate) fn input_id() -> egui::Id {
 /// own record of that; which document `doc` last used the history is kept beside it, since a box
 /// in another tab on the same text would otherwise take that document's typing with its Redo.
 /// When another document's box takes the text box, the box it leaves keeps its history (and
-/// caret) aside, and gets it back on its return, so its typing can still be undone there.
+/// caret) aside, and gets it back on its return, so its typing can still be undone there. Each
+/// box claims the text box when it is drawn, and Undo and Redo from the menu claim it first too,
+/// since they can run before the box is drawn again after a tab switch.
 pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, doc: pdfcraft_engine::DocId, from: &mut Option<String>, text: &str) {
     let owner = id.with("typing-doc");
     let last = ctx.data(|d| d.get_temp::<pdfcraft_engine::DocId>(owner));
@@ -302,11 +304,9 @@ pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, doc: pdfcr
     // Only the same box, still on the text it opened on, takes its history back.
     let back =
         ctx.data_mut(|d| d.remove_temp::<(egui::text_edit::TextEditState, AlignHistory)>(aside(doc))).filter(|_| from.as_deref() == Some(text));
-    let (state, rows) = back.unwrap_or_else(|| {
-        let mut state = egui::TextEdit::load_state(ctx, id).unwrap_or_default();
-        state.clear_undoer();
-        (state, AlignHistory::default())
-    });
+    // A box new to the text box starts with nothing of the last one's: no history, caret,
+    // selection or rows' alignments by text.
+    let (state, rows) = back.unwrap_or_default();
     egui::TextEdit::store_state(ctx, id, state);
     ctx.data_mut(|d| {
         d.insert_temp(owner, doc);
@@ -496,9 +496,18 @@ impl LineEditor {
         self.look0 = self.look.clone();
         self.extras0 = self.extras;
         self.original = self.text.clone();
+        // The page now has this text: the box's history restarts, even when the format left the
+        // text as it was, so a Redo from before can't put undone typing back on top of it.
+        self.typing_from = None;
         self.focus = true;
     }
 
+    /// Take the shared text box for this paragraph ([`forget_typing_before`]): its own history,
+    /// or none once the page has its text.
+    pub(crate) fn claim_typing(&mut self, ctx: &egui::Context, doc: pdfcraft_engine::DocId) {
+        forget_typing_before(ctx, input_id(), doc, &mut self.typing_from, &self.original);
+    }
+
     /// Adopt the rewritten paragraph's current geometry before the next overlay frame.
     pub(crate) fn refresh_source(&mut self, block: &pdfcraft_engine::TextBlock, lines: Vec<pdfcraft_engine::TextLine>) {
         self.source_rect = block.rect.map(|v| v as f32);
@@ -1832,7 +1841,7 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                 };
                 let before = ed.text.clone();
                 let input = input_id();
-                forget_typing_before(ui.ctx(), input, view_id, &mut ed.typing_from, &ed.original);
+                ed.claim_typing(ui.ctx(), view_id);
                 let output = egui::TextEdit::multiline(&mut ed.text)
                     .id(input)
                     .font(font.clone())
@@ -1929,6 +1938,23 @@ pub(crate) fn caret_color_on(fill: Color32) -> Color32 {
 mod tests {
     use super::*;
 
+    /// Formatting applied restarts the rows' alignments by text with the box's history: a Redo
+    /// past the format can't bring back an alignment from before it (FredApps on bfc6f8b1).
+    #[test]
+    fn formatting_applied_restarts_the_alignments_by_text() {
+        use pdfcraft_engine::{DocId, TextAlign::Right};
+        let (ctx, id) = (egui::Context::default(), egui::Id::new("box"));
+        let mut from = None;
+        forget_typing_before(&ctx, id, DocId(1), &mut from, "A\nB");
+        let mut aligns = vec![None, Some(Right)];
+        follow_typing(&ctx, id, "A\nB", "A", &mut [&mut aligns]);
+        // Formatting applied: the page now has "A", and the box's record of its text is reset.
+        from = None;
+        forget_typing_before(&ctx, id, DocId(1), &mut from, "A");
+        follow_typing(&ctx, id, "A", "A\nB", &mut [&mut aligns]);
+        assert_eq!(aligns, pdfcraft_engine::paragraph_align::remap("A", "A\nB", &[None]), "the row before the format doesn't come back aligned");
+    }
+
     /// The rows' alignments by text go aside with the box's history when another tab's box takes
     /// the text box, and come back with it: Undo after the trip still restores a deleted row's
     /// alignment, while the other tab's box starts with none.
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index fdb3c15273..af6e01eb81 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -231,13 +231,16 @@ impl PdfCraftApp {
     fn undo_in_page_box(&mut self) -> bool {
         let Some(ctx) = self.ctx.clone() else { return false };
         let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
+        let doc = view.id;
         if let Some(ed) = view.line_editor.as_mut().filter(|ed| ed.has_unsaved_text()) {
+            ed.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, true) else { return false };
             let before = std::mem::replace(&mut ed.text, text);
             ed.follow_typed_rows(&ctx, &before);
             return true;
         }
         if let Some(d) = view.content.draft.as_mut().filter(|d| d.has_unapplied_typing()) {
+            d.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, true) else { return false };
             let before = std::mem::replace(&mut d.text, text);
             crate::edit_text_ui::follow_typing(&ctx, crate::content_ui::input_id(), &before, &d.text, &mut [&mut d.style.aligns]);
@@ -261,13 +264,16 @@ impl PdfCraftApp {
     fn redo_in_page_box(&mut self) -> bool {
         let Some(ctx) = self.ctx.clone() else { return false };
         let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
+        let doc = view.id;
         if let Some(ed) = view.line_editor.as_mut() {
+            ed.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, false) else { return ed.has_unsaved_text() };
             let before = std::mem::replace(&mut ed.text, text);
             ed.follow_typed_rows(&ctx, &before);
             return true;
         }
         if let Some(d) = view.content.draft.as_mut() {
+            d.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, false) else { return d.has_unapplied_typing() };
             let before = std::mem::replace(&mut d.text, text);
             crate::edit_text_ui::follow_typing(&ctx, crate::content_ui::input_id(), &before, &d.text, &mut [&mut d.style.aligns]);
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index e7210a8ac9..4fc6c59b67 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1166,6 +1166,42 @@ fn undo_after_a_round_trip_through_another_tab_takes_back_added_text_typing() {
     assert_eq!(draft(&h).as_deref(), Some("Reviewed"), "Undo takes the typing back in A's box");
 }
 
+/// Edit ▸ Undo chosen in the same frame as the switch back to tab A's added text box, before it
+/// is drawn again: the shared text box still holds tab B's history, from a box on other text, so
+/// A's box claims its own back before stepping.
+#[test]
+fn undo_in_the_frame_of_the_switch_back_takes_back_added_text_typing() {
+    let mut h = harness();
+    h.state_mut().open_bytes("copy.pdf", None, include_bytes!("../data/form.pdf").to_vec()).unwrap();
+    h.run_steps(4);
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    for (tab, text) in [(0, "Reviewed"), (1, "Approved")] {
+        h.state_mut().active = Some(tab);
+        let text = pdfcraft_engine::AddedText { rect, text: text.into(), ..Default::default() };
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    }
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.text"));
+        h.run_steps(3);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        let k = r.width() / 300.0;
+        click(h, r.min + egui::vec2(45.0 * k, 195.0 * k));
+        assert_eq!(h.state().views[tab].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    };
+    open_in(&mut h, 0);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    open_in(&mut h, 1);
+    // Back to A and Undo at once: no frame draws A's box in between.
+    h.state_mut().active = Some(0);
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes the typing back in A's box");
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index a92850a275..767aa18062 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6813,6 +6813,116 @@ fn undo_after_a_round_trip_through_another_tab_takes_back_the_typing() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
 }
 
+/// Typing taken back with Ctrl+Z, then Bold applied with the paragraph still open: Ctrl+Shift+Z
+/// must not bring the typing back on top of the bold, as the box's history is cleared once the
+/// page has its text. The format left the text as it was, so the box kept its history and its
+/// Redo put "Page 1 more" back (FredApps's review of abc378c0).
+#[test]
+fn redo_after_formatting_never_brings_back_typing_undone_before_it() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the typing is taken back");
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), Some("Edit text"), "the bold is applied");
+    h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
+    h.run_steps(3);
+    let text = h.state().views[0].line_editor.as_ref().map(|ed| ed.text.clone());
+    assert_eq!(text.as_deref(), Some(original.as_str()), "the typing undone before the bold stays undone");
+    // Nor through what the menu's Redo runs.
+    h.state_mut().redo();
+    h.run_steps(3);
+    let s = h.state();
+    let text = s.views[0].line_editor.as_ref().map(|ed| ed.text.clone());
+    assert!(!text.as_deref().unwrap_or_default().contains("more"), "the menu's Redo brings it back: {text:?}");
+    assert_eq!(s.session.get(s.views[0].id).unwrap().text_blocks(0)[0].base_font, "Helvetica-Bold", "the bold stays");
+}
+
+/// Edit ▸ Undo chosen in the same frame as the switch back to tab A, before A's box is drawn
+/// again: the shared text box still holds tab B's history then. Stepping through it put B's
+/// typing into A's box; the box now claims its own history back first (CodeRabbit on abc378c0).
+#[test]
+fn undo_in_the_frame_of_the_switch_back_takes_back_the_typing() {
+    let mut h = harness(1, |app| {
+        app.open_bytes("copy.pdf", None, fixture(1)).expect("the copy opens");
+    });
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        if h.state().views[tab].line_editor.is_none() {
+            assert!(h.state_mut().execute("edit.edit_text"));
+            h.run_steps(2);
+        }
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        click_at(h, egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height()));
+        assert!(h.state().views[tab].line_editor.is_some(), "the paragraph opens for typing");
+    };
+    open_in(&mut h, 0);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    // In B, a paragraph whose text differs from A's ("Page 1 B", applied with Bold), so B's
+    // history can't pass for A's.
+    open_in(&mut h, 1);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" B".into()));
+    h.run_steps(2);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    assert_eq!(h.state().views[1].line_editor.as_ref().map(|ed| ed.text.as_str()), Some("Page 1 B"), "B's paragraph is open on its own text");
+    // Back to A and Undo at once: no frame draws A's box in between.
+    h.state_mut().active = Some(0);
+    assert!(h.state_mut().execute("edit.undo"), "Undo is enabled");
+    h.run_steps(3);
+    let ed = h.state().views[0].line_editor.clone().expect("the box stays open: Undo takes back the typing");
+    assert_eq!(ed.text, original, "the typing is taken back in A's box");
+}
+
+/// Redo from the menu chosen in the same frame as a switch to tab B, whose paragraph is open on
+/// the same text as A's: the shared text box still holds A's history then, with A's undone
+/// typing to redo, so B's box claims its own history back before stepping.
+#[test]
+fn redo_in_the_frame_of_a_tab_switch_never_brings_another_tabs_typing() {
+    let mut h = harness(1, |app| {
+        app.open_bytes("copy.pdf", None, fixture(1)).expect("the copy opens");
+    });
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.edit_text"));
+        h.run_steps(2);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        click_at(h, egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height()));
+        assert!(h.state().views[tab].line_editor.is_some(), "the paragraph opens for typing");
+    };
+    open_in(&mut h, 1);
+    open_in(&mut h, 0);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" secret".into()));
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "taken back in A");
+    // To B and Redo at once: no frame draws B's box in between.
+    h.state_mut().active = Some(1);
+    h.state_mut().redo();
+    h.run_steps(3);
+    let s = h.state();
+    let b = s.views[1].line_editor.as_ref().map(|ed| ed.text.clone());
+    assert!(!b.as_deref().unwrap_or_default().contains("secret"), "A's typing came back in B: {b:?}");
+    assert!(!s.session.get(s.views[1].id).unwrap().text_blocks(0)[0].text.contains("secret"), "A's typing reached B's page");
+}
+
 /// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
 /// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
 /// Typing in one tab, taken back with Undo, then came back with Redo (the key or the menu) in the

From 42da7f24737ddc0d641d12602282b59494958eea Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Sun, 25 Oct 2026 21:03:30 +0100
Subject: [PATCH 079/270] fix(comments): delete or edit one reply from its own
 menu, keeping the thread
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the Comments panel a reply had no menu, and the card's Delete removes
the whole thread, so one wrong reply couldn't go without the comment and
every other reply. On the selected card each reply now has its own "…"
(Edit, Copy text, Delete), as Adobe's help describes. Delete takes that
reply with its pop-up and the replies to it, as comment_delete already
did headlessly. The comment and its other replies stay, in one undo step.
A locked reply's Delete is greyed out. Status badges and a Replace Text
caret get no menu.

Deleting moves what follows it up in /Annots. Before, any delete cleared
the selection, and the panel's inline editor stayed keyed to an index
that could now be another comment. CommentView::annotation_deleted now
finds both where they moved, from their place among what stays and what
they read, or clears them when they went too or the page changed
unexpectedly.

The new string is in every catalogue. Parity notes, the roadmap row and
comment_delete's description say a reply can be deleted on its own.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ROADMAP.md                               |   1 +
 crates/automation/src/tools.rs           |   2 +-
 crates/automation/tests/it/automation.rs |  29 ++++++
 crates/ui-egui/src/comments.rs           | 117 +++++++++++++++++++++++
 crates/ui-egui/src/comments_panel.rs     | 105 +++++++++++++++-----
 crates/ui-egui/src/editing.rs            |   8 +-
 crates/ui-egui/src/i18n/ar.tsv           |   3 +
 crates/ui-egui/src/i18n/bg.tsv           |   3 +
 crates/ui-egui/src/i18n/ca.tsv           |   3 +
 crates/ui-egui/src/i18n/ckb.tsv          |   3 +
 crates/ui-egui/src/i18n/cs.tsv           |   3 +
 crates/ui-egui/src/i18n/de.tsv           |   3 +
 crates/ui-egui/src/i18n/el.tsv           |   3 +
 crates/ui-egui/src/i18n/es.tsv           |   3 +
 crates/ui-egui/src/i18n/fa.tsv           |   3 +
 crates/ui-egui/src/i18n/fi.tsv           |   3 +
 crates/ui-egui/src/i18n/fr.tsv           |   3 +
 crates/ui-egui/src/i18n/hi.tsv           |   3 +
 crates/ui-egui/src/i18n/hu.tsv           |   3 +
 crates/ui-egui/src/i18n/id.tsv           |   3 +
 crates/ui-egui/src/i18n/it.tsv           |   3 +
 crates/ui-egui/src/i18n/ja.tsv           |   3 +
 crates/ui-egui/src/i18n/kk.tsv           |   3 +
 crates/ui-egui/src/i18n/ko.tsv           |   3 +
 crates/ui-egui/src/i18n/lo.tsv           |   3 +
 crates/ui-egui/src/i18n/lt.tsv           |   3 +
 crates/ui-egui/src/i18n/nb.tsv           |   3 +
 crates/ui-egui/src/i18n/pl.tsv           |   3 +
 crates/ui-egui/src/i18n/pt-br.tsv        |   3 +
 crates/ui-egui/src/i18n/ro.tsv           |   3 +
 crates/ui-egui/src/i18n/ru.tsv           |   3 +
 crates/ui-egui/src/i18n/sl.tsv           |   3 +
 crates/ui-egui/src/i18n/sq.tsv           |   3 +
 crates/ui-egui/src/i18n/te.tsv           |   3 +
 crates/ui-egui/src/i18n/th.tsv           |   3 +
 crates/ui-egui/src/i18n/tr.tsv           |   3 +
 crates/ui-egui/src/i18n/uk.tsv           |   3 +
 crates/ui-egui/src/i18n/vi.tsv           |   3 +
 crates/ui-egui/src/i18n/zh-hans.tsv      |   3 +
 crates/ui-egui/src/i18n/zh-hant.tsv      |   3 +
 crates/ui-egui/tests/it/comments.rs      |  94 +++++++++++++++++-
 docs/roadmap.md                          |   3 +-
 parity/acrobat-features.toml             |  16 ++--
 43 files changed, 443 insertions(+), 34 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 165fccc5e8..7c52ddac17 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -199,6 +199,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 ## Progress log
 
+- **2026-10-25 (M5, comment replies):** One reply can be deleted from the Comments panel without its thread. On the selected card each reply has its own "…" menu (Edit, Copy text, Delete); Delete takes that reply with its pop-up and the replies to it, as `comment_delete` already did headlessly, and the comment and its other replies stay. The card stays selected, and the panel's editor stays open, on what they were on though the delete moved it in `/Annots`. A locked reply can't be deleted. Estimates unchanged.
 - **2026-10-24 (M10, #4158 partial):** Word, HTML, RTF and PowerPoint export keep a block that continues another on its line (an italic case name, a link, a superscript) as a run in its own style inside that paragraph, with the source's word space, instead of a paragraph of its own. Style changes that wrap onto the next line still split paragraphs (the reading blocks keep style boundaries). Estimates unchanged.
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 4b4ac8873b..e2fdf9f783 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -886,7 +886,7 @@ pub fn tools() -> Vec<ToolDef> {
         )),
         t("comment_image_preview", "Preview image signature layers", "Return a PNG of the page without the selected image signature/initials (layer=background, default), or its embedded image with alpha (layer=image). Includes the displayed rectangle, document rotation, image_rotation (how far clockwise the image is shown turned) and annotation opacity. Cache these layers for live placement/resizing; commit once with comment_edit. Does not change the document or undo history.")
             .ro().with(schema(comment_ref(json!({ "layer": { "type": "string", "enum": ["background", "image"], "default": "background" }, "dpi": { "type": "number", "minimum": 1, "maximum": 600, "default": 96 } })), &["doc"])),
-        t("comment_delete", "Delete a comment", "Delete a comment with its pop-up and replies. Undoable.").destructive().with(schema(comment_ref(json!({})), &["doc"])),
+        t("comment_delete", "Delete a comment", "Delete a comment with its pop-up and replies, or one reply (its id, or page and index, from comment_list) with its pop-up and the replies to it; the comment and its other replies stay. Undoable.").destructive().with(schema(comment_ref(json!({})), &["doc"])),
         t(
             "doc_protect",
             "Protect with passwords",
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 23351db9aa..ce68cd25b4 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -2134,6 +2134,35 @@ fn nested_replies_stay_in_the_listing() {
     assert!(replies.contains(&"DIRECT_REPLY") && replies.contains(&"NESTED_REPLY"), "the nested reply is listed: {replies:?}");
 }
 
+/// comment_delete on a reply deletes that reply and the replies to it, as the Comments panel's
+/// reply menu does: the comment and its other replies stay, and one undo brings it back.
+#[test]
+fn deleting_a_reply_keeps_its_comment_and_the_other_replies() {
+    let dir = workdir("delete-reply");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    let root = ok(&mut a, "comment_add", json!({ "doc": doc, "page": 1, "type": "note", "at": [40, 40], "contents": "ROOT_NOTE", "author": "A" }));
+    let root_id = root["comment"]["id"].as_str().unwrap().to_string();
+    ok(&mut a, "comment_reply", json!({ "doc": doc, "id": root_id, "text": "WRONG_REPLY", "author": "B" }));
+    ok(&mut a, "comment_reply", json!({ "doc": doc, "id": root_id, "text": "RIGHT_REPLY", "author": "C" }));
+    let replies = |a: &mut Automation| -> Vec<Value> {
+        let list = ok(a, "comment_list", json!({ "doc": doc }));
+        assert_eq!(list["count"], 1, "{list}");
+        list["comments"][0]["replies"].as_array().unwrap().clone()
+    };
+    let wrong = replies(&mut a).into_iter().find(|r| r["contents"] == "WRONG_REPLY").unwrap();
+    ok(&mut a, "comment_reply", json!({ "doc": doc, "id": wrong["id"], "text": "ANSWER_TO_WRONG", "author": "D" }));
+    let texts = |a: &mut Automation| -> Vec<String> { replies(a).iter().filter_map(|r| r["contents"].as_str().map(str::to_owned)).collect() };
+    assert_eq!(texts(&mut a), ["WRONG_REPLY", "RIGHT_REPLY", "ANSWER_TO_WRONG"]);
+
+    ok(&mut a, "comment_delete", json!({ "doc": doc, "page": wrong["page"], "index": wrong["index"] }));
+    let list = ok(&mut a, "comment_list", json!({ "doc": doc }));
+    assert_eq!(list["comments"][0]["contents"], "ROOT_NOTE", "{list}");
+    assert_eq!(texts(&mut a), ["RIGHT_REPLY"], "the reply took the answer to it along");
+    assert_eq!(ok(&mut a, "edit_undo", json!({ "doc": doc }))["undone"], "Delete comment");
+    assert_eq!(texts(&mut a), ["WRONG_REPLY", "RIGHT_REPLY", "ANSWER_TO_WRONG"]);
+}
+
 /// Replies thread by their `/IRT` reference, not `/NM`: PyMuPDF names the first comment on every
 /// page `fitz-A0`. A shared id is refused rather than taken to mean page 1's comment.
 #[test]
diff --git a/crates/ui-egui/src/comments.rs b/crates/ui-egui/src/comments.rs
index bf9b5fe72c..511bee805a 100644
--- a/crates/ui-egui/src/comments.rs
+++ b/crates/ui-egui/src/comments.rs
@@ -12,6 +12,8 @@
 //! Everything is turned into `pdfcraft_engine::Edit`s, queued on the view as `pending_edit` and
 //! applied by the app, so each change is one undo step.
 
+use std::collections::HashMap;
+
 use egui::{Color32, CornerRadius, Pos2, Rect, Sense, Stroke, pos2, vec2};
 use pdfcraft_engine::{Edit, LineEnding, Markup, NewAnnotation, NoteIcon, ReviewState, Rgb, Shape, Style};
 use pdfcraft_render::{Annotation, DocInfo, PageInfo, PageText};
@@ -578,6 +580,61 @@ impl CommentView {
             self.editor_focus = None;
         }
     }
+
+    /// The annotation at `gone` was just deleted; `before` and `after` are the document's
+    /// annotations until then and now. The selection and the inline editor stay on what they
+    /// were on, where it now is (deleting a reply keeps its comment selected), and close when it
+    /// went too.
+    pub(crate) fn annotation_deleted(&mut self, before: &[Annotation], after: &[Annotation], gone: (usize, usize)) {
+        self.selected = self.selected.and_then(|k| after_delete(before, after, gone, k));
+        self.editing = self.editing.take().and_then(|(p, i, text)| after_delete(before, after, gone, (p, i)).map(|(p, i)| (p, i, text)));
+        if self.editing.is_none() {
+            self.editor_focus = None;
+        }
+    }
+}
+
+/// Where the annotation at `keep` is once the one at `gone` was deleted, or `None` when it went
+/// with it. Deleting takes the annotation's replies (at any depth) and pop-ups out of its page's
+/// `/Annots` (`pdfcraft_annot::delete_annotation`), and everything after them moves up, so `keep`
+/// is found by its place among the page's annotations that stay. When the page lost other
+/// annotations than those, or the one in that place reads differently, it is not guessed at.
+fn after_delete(before: &[Annotation], after: &[Annotation], gone: (usize, usize), keep: (usize, usize)) -> Option<(usize, usize)> {
+    if keep == gone {
+        return None;
+    }
+    if keep.0 != gone.0 {
+        return Some(keep);
+    }
+    let (old, new) = (on_page(before, gone.0), on_page(after, gone.0));
+    // Only replies on the page go with it: `/IRT` is followed through the page's `/Annots`.
+    let parents: HashMap<usize, usize> = old.iter().filter_map(|a| a.parent.filter(|p| p.0 == gone.0).map(|p| (a.index, p.1))).collect();
+    let goes = |mut i: usize| {
+        // `link_replies` settles every chain within 64 steps.
+        for _ in 0..=64 {
+            if i == gone.1 {
+                return true;
+            }
+            let Some(&up) = parents.get(&i) else { return false };
+            i = up;
+        }
+        false
+    };
+    let stays: Vec<&Annotation> = old.iter().copied().filter(|a| !goes(a.index)).collect();
+    if stays.len() != new.len() {
+        return None;
+    }
+    let rank = stays.iter().position(|a| a.index == keep.1)?;
+    let (was, now) = (stays.get(rank)?, new.get(rank)?);
+    let same = (&was.subtype, &was.name, &was.author, &was.contents, was.rect) == (&now.subtype, &now.name, &now.author, &now.contents, now.rect);
+    same.then_some((now.page, now.index))
+}
+
+/// The annotations listed on `page`, in `/Annots` order.
+fn on_page(list: &[Annotation], page: usize) -> Vec<&Annotation> {
+    let mut v: Vec<&Annotation> = list.iter().filter(|a| a.page == page).collect();
+    v.sort_by_key(|a| a.index);
+    v
 }
 
 /// Comments panel order (Acrobat: Sort by page, author, date, type, colour).
@@ -2353,6 +2410,66 @@ mod tests {
         }
     }
 
+    /// A listed comment or reply at `index` on `page`, replying to `parent`.
+    fn listed(page: usize, index: usize, contents: &str, parent: Option<(usize, usize)>) -> Annotation {
+        Annotation {
+            page,
+            subtype: "Text".into(),
+            author: None,
+            contents: Some(contents.into()),
+            modified: None,
+            name: None,
+            in_reply_to: None,
+            parent,
+            grouped: false,
+            rect: [0.0, 0.0, 20.0, 20.0],
+            color: None,
+            index,
+            state: None,
+            quads: Vec::new(),
+            locked: false,
+            intent: None,
+            fill_sign: false,
+            no_rotate: false,
+            points: Vec::new(),
+        }
+    }
+
+    /// What stays selected or open in the editor after a delete is found where it moved to: the
+    /// reply's own replies go with it (pop-ups, unlisted, are gone too), and a page that lost
+    /// something else, or whose annotation in that place reads differently, keeps nothing.
+    #[test]
+    fn a_kept_comment_is_found_where_a_delete_moved_it() {
+        // Page 0's `/Annots`: reply A, its pop-up (unlisted), the comment, reply B, a reply to A.
+        let before = vec![
+            listed(0, 0, "A", Some((0, 2))),
+            listed(0, 2, "comment", None),
+            listed(0, 3, "B", Some((0, 2))),
+            listed(0, 4, "to A", Some((0, 0))),
+            listed(1, 0, "other page", None),
+        ];
+        // Deleting A takes its pop-up and the reply to it: the comment and B move up two places.
+        let after = vec![listed(0, 0, "comment", None), listed(0, 1, "B", Some((0, 0))), listed(1, 0, "other page", None)];
+        let gone = (0, 0);
+        assert_eq!(after_delete(&before, &after, gone, (0, 2)), Some((0, 0)), "the comment");
+        assert_eq!(after_delete(&before, &after, gone, (0, 3)), Some((0, 1)), "the other reply");
+        assert_eq!(after_delete(&before, &after, gone, (0, 4)), None, "the reply to A went with it");
+        assert_eq!(after_delete(&before, &after, gone, gone), None, "the deleted one");
+        assert_eq!(after_delete(&before, &after, gone, (1, 0)), Some((1, 0)), "another page keeps its places");
+        // The page lost more than A and its replies: nothing is guessed.
+        assert_eq!(after_delete(&before, &after[..1], gone, (0, 2)), None);
+        // Another annotation in the comment's place.
+        let changed = vec![listed(0, 0, "something else", None), listed(0, 1, "B", Some((0, 0)))];
+        assert_eq!(after_delete(&before, &changed, gone, (0, 2)), None);
+
+        let mut view = CommentView { selected: Some((0, 2)), editing: Some((0, 3, "typed".into())), ..Default::default() };
+        view.annotation_deleted(&before, &after, gone);
+        assert_eq!((view.selected, view.editing), (Some((0, 0)), Some((0, 1, "typed".into()))), "both follow");
+        let mut view = CommentView { editing: Some((0, 4, "typed".into())), editor_focus: Some(EditorFocus::Take), ..Default::default() };
+        view.annotation_deleted(&before, &after, gone);
+        assert_eq!((view.editing, view.editor_focus), (None, None), "the editor closes with the reply it was open on");
+    }
+
     use pdfcraft_render::TextGlyph;
 
     /// One glyph per character, `w` points wide, on a line of `em`-point text whose baseline is at `y`, drawn
diff --git a/crates/ui-egui/src/comments_panel.rs b/crates/ui-egui/src/comments_panel.rs
index 54ca9e5152..0d917b5cae 100644
--- a/crates/ui-egui/src/comments_panel.rs
+++ b/crates/ui-egui/src/comments_panel.rs
@@ -3,7 +3,8 @@
 //! Header "Comments N" (comments, as Acrobat counts them) with "N replies" under it and search;
 //! an "Add a comment" box that posts a sticky note on the current page; cards grouped by page.
 //! Selecting a card selects the comment on the page and opens its reply box and "…" menu (Edit,
-//! Set status, Delete). Status replies show as a badge.
+//! Set status, Delete), and gives each reply a "…" of its own (Edit, Copy text, Delete). Status
+//! replies show as a badge.
 
 use std::collections::HashMap;
 
@@ -358,27 +359,10 @@ fn card(
             });
             egui::Frame::NONE.inner_margin(egui::Margin { left: 34, right: 0, top: 4, bottom: 0 }).show(ui, |ui| {
                 ui.set_width(ui.available_width());
-                if editing && let Some((_, _, text)) = view.comments.editing.as_mut() {
-                    let r = ui.add(crate::widgets::block(text).desired_rows(2).desired_width(f32::INFINITY).id_salt(("comment-edit", key)));
-                    match view.comments.editor_focus.take() {
-                        Some(crate::comments::EditorFocus::Take) => r.request_focus(),
-                        Some(crate::comments::EditorFocus::Release) => r.surrender_focus(),
-                        None => {}
+                if editing {
+                    if let Some(e) = inline_editor(ui, t, view, key, 2) {
+                        edit = Some(e);
                     }
-                    let submit = crate::comments::submit_key(ui, &r, false);
-                    ui.horizontal(|ui| {
-                        if (ui
-                            .add(egui::Button::new(egui::RichText::new(tl!("Save")).color(Color32::WHITE)).fill(t.accent).corner_radius(12))
-                            .clicked()
-                            || submit)
-                            && let Some((page, index, text)) = view.comments.editing.take()
-                        {
-                            edit = Some(Edit::SetAnnotationContents { page, index, text });
-                        }
-                        if ui.button(tl!("Cancel")).clicked() || ui.input(|i| i.key_pressed(egui::Key::Escape)) {
-                            view.comments.editing = None;
-                        }
-                    });
                 } else {
                     let body = a.contents.as_deref().unwrap_or("");
                     if body.is_empty() {
@@ -405,6 +389,7 @@ fn card(
             for r in &replies {
                 ui.add_space(8.0);
                 let mut me = egui::Rect::NOTHING;
+                let reply_key = (r.page, r.index);
                 ui.horizontal(|ui| {
                     me = avatar(ui, t, None, Some(&initials(r.author.as_deref().unwrap_or("?"))), t.text_faint);
                     ui.vertical(|ui| {
@@ -415,8 +400,25 @@ fn card(
                             if let Some(m) = &r.modified {
                                 ui.add(egui::Label::new(egui::RichText::new(m).font(theme::regular(11.0)).color(t.text_faint)).truncate());
                             }
+                            // Each reply has its own "…" (Edit, Copy text, Delete), as in Acrobat.
+                            // A Replace Text caret is half of its comment, not a reply: it has none.
+                            if selected && allowed && !r.grouped {
+                                ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                                    let more = icons::button(ui, "ellipsis", 20.0, false, tl!("Options for this reply"));
+                                    if let Some(e) = reply_menu(ui, view, r, &more) {
+                                        edit = Some(e);
+                                    }
+                                });
+                            }
                         });
-                        widgets::wrapped_text(ui, r.contents.as_deref().unwrap_or(""), theme::regular(12.5), t.text, false);
+                        let open = view.comments.editing.as_ref().is_some_and(|(p, i, _)| (*p, *i) == reply_key);
+                        if open {
+                            if let Some(e) = inline_editor(ui, t, view, reply_key, 1) {
+                                edit = Some(e);
+                            }
+                        } else {
+                            widgets::wrapped_text(ui, r.contents.as_deref().unwrap_or(""), theme::regular(12.5), t.text, false);
+                        }
                     });
                 });
                 // The circles are 12 px in radius; leave a 1 px gap at each end.
@@ -531,6 +533,65 @@ fn card(
     edit
 }
 
+/// The inline editor open on comment or reply `key` in the panel, with Save and Cancel; returns
+/// the edit Save makes.
+fn inline_editor(ui: &mut egui::Ui, t: &Tokens, view: &mut DocView, key: (usize, usize), rows: usize) -> Option<Edit> {
+    let mut edit = None;
+    let (_, _, text) = view.comments.editing.as_mut()?;
+    let r = ui.add(crate::widgets::block(text).desired_rows(rows).desired_width(f32::INFINITY).id_salt(("comment-edit", key)));
+    match view.comments.editor_focus.take() {
+        Some(crate::comments::EditorFocus::Take) => r.request_focus(),
+        Some(crate::comments::EditorFocus::Release) => r.surrender_focus(),
+        None => {}
+    }
+    let submit = crate::comments::submit_key(ui, &r, false);
+    ui.horizontal(|ui| {
+        if (ui.add(egui::Button::new(egui::RichText::new(tl!("Save")).color(Color32::WHITE)).fill(t.accent).corner_radius(12)).clicked() || submit)
+            && let Some((page, index, text)) = view.comments.editing.take()
+        {
+            edit = Some(Edit::SetAnnotationContents { page, index, text });
+        }
+        if ui.button(tl!("Cancel")).clicked() || ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+            view.comments.editing = None;
+        }
+    });
+    edit
+}
+
+/// A reply's "…" menu, hung from its button `more`: Edit, Copy text and Delete. Delete takes
+/// the reply alone, with what hangs off it (its own replies, status changes and pop-up), as
+/// deleting a comment takes its thread; the comment and its other replies stay. Returns the
+/// edit to apply.
+fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, more: &egui::Response) -> Option<Edit> {
+    let mut edit = None;
+    let menu_id = ui.scope_id().with(("reply-menu", r.page, r.index));
+    if more.clicked() {
+        egui::Popup::open_id(ui.ctx(), menu_id);
+    }
+    egui::Popup::new(menu_id, ui.ctx().clone(), egui::PopupAnchor::ParentRect(more.rect), ui.layer_id())
+        .open_memory(None)
+        .kind(egui::PopupKind::Menu)
+        .layout(Layout::top_down_justified(Align::Min))
+        .show(|ui| {
+            ui.set_min_width(140.0);
+            if ui.button(tl_ctx!("comment menu", "Edit")).clicked() {
+                view.comments.open_editor(r.page, r.index, r.contents.clone().unwrap_or_default());
+                ui.close();
+            }
+            if ui.button(tl!("Copy text")).clicked() {
+                ui.ctx().copy_text(r.contents.clone().unwrap_or_default());
+                ui.close();
+            }
+            ui.separator();
+            // The card stays selected: the app finds its comment again after the delete.
+            if ui.add_enabled(!r.locked, egui::Button::new(tl!("Delete"))).clicked() {
+                edit = Some(Edit::DeleteAnnotation { page: r.page, index: r.index });
+                ui.close();
+            }
+        });
+    edit
+}
+
 /// A 26 pt round badge: a type glyph (comments) or initials (replies). Returns where it was drawn.
 fn avatar(ui: &mut egui::Ui, t: &Tokens, icon: Option<&str>, text: Option<&str>, color: Color32) -> egui::Rect {
     let (r, _) = ui.allocate_exact_size(vec2(26.0, 26.0), Sense::hover());
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 9a13d570d9..1ae66561b8 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -53,6 +53,12 @@ impl PdfCraftApp {
         } else {
             (None, 0, false)
         };
+        // A deletion moves the comments after it on the page: these say where the selected one,
+        // and the one open in the panel's editor, went.
+        let annots_before = match (&edit, self.session.get(id)) {
+            (Edit::DeleteAnnotation { page, .. }, Some(d)) => d.info.annotations.iter().filter(|a| a.page == *page).cloned().collect(),
+            _ => Vec::new(),
+        };
         match self.session.apply(id, edit.clone()) {
             Ok(()) => {
                 let Some(doc) = self.session.get(id) else { return true };
@@ -172,7 +178,7 @@ impl PdfCraftApp {
                             view.comments.open_editor(a.page, n, String::new());
                         }
                     }
-                    Edit::DeleteAnnotation { .. } => view.comments.selected = None,
+                    Edit::DeleteAnnotation { page, index } => view.comments.annotation_deleted(&annots_before, &info.annotations, (page, index)),
                     _ => {}
                 }
                 if std::mem::take(&mut view.comments.tool_done) && !self.comment_prefs.pinned {
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 3e6d735523..1ae1d5ca1d 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -2833,3 +2833,6 @@ certificate	Version	الإصدار
 	Rotate the selected pages clockwise	تدوير الصفحات المحددة باتجاه عقارب الساعة
 	Extract the selected pages…	استخراج الصفحات المحددة…
 	Delete the selected pages	حذف الصفحات المحددة
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	خيارات هذا الرد
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index ec0339f18a..30064446bc 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -2520,3 +2520,6 @@ animation effects	Off	Изключени
 	Rotate the selected pages clockwise	Завъртане на избраните страници по часовниковата стрелка
 	Extract the selected pages…	Извличане на избраните страници…
 	Delete the selected pages	Изтриване на избраните страници
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Опции за този отговор
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 0cacae3c2c..6917f86d45 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -2818,3 +2818,6 @@ theme	Appearance	Aspecte
 	Rotate the selected pages clockwise	Gira les pàgines seleccionades en sentit horari
 	Extract the selected pages…	Extreu les pàgines seleccionades…
 	Delete the selected pages	Suprimeix les pàgines seleccionades
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opcions d'aquesta resposta
diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index 71c0c62869..457da979a4 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -2749,3 +2749,6 @@ certificate	Version	وەشان
 	Rotate the selected pages clockwise	پەڕە هەڵبژێردراوەکان بە ئاڕاستەی میلی کاتژمێر بسوڕێنە
 	Extract the selected pages…	پەڕە هەڵبژێردراوەکان دەربهێنە…
 	Delete the selected pages	پەڕە هەڵبژێردراوەکان بسڕەوە
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	هەڵبژاردەکانی ئەم وەڵامە
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index ed6d051b57..c8e2c7de10 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -2864,3 +2864,6 @@ certificate	Version	Verze
 	Rotate the selected pages clockwise	Otočit vybrané stránky po směru hodinových ručiček
 	Extract the selected pages…	Extrahovat vybrané stránky…
 	Delete the selected pages	Odstranit vybrané stránky
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Možnosti této odpovědi
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 8586a21d43..fa34681ad6 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -2558,3 +2558,6 @@ animation effects	Off	Aus
 	Rotate the selected pages clockwise	Ausgewählte Seiten im Uhrzeigersinn drehen
 	Extract the selected pages…	Ausgewählte Seiten extrahieren…
 	Delete the selected pages	Ausgewählte Seiten löschen
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Optionen für diese Antwort
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index e3eac77caa..2d16480209 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -2563,3 +2563,6 @@ animation effects	Off	Ανενεργά
 	Rotate the selected pages clockwise	Περιστροφή των επιλεγμένων σελίδων δεξιόστροφα
 	Extract the selected pages…	Εξαγωγή των επιλεγμένων σελίδων…
 	Delete the selected pages	Διαγραφή των επιλεγμένων σελίδων
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Επιλογές για αυτήν την απάντηση
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 0d4e505a70..51eb3f9483 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -2880,3 +2880,6 @@ theme	Appearance	Aspecto
 	Rotate the selected pages clockwise	Girar las páginas seleccionadas en sentido horario
 	Extract the selected pages…	Extraer las páginas seleccionadas…
 	Delete the selected pages	Eliminar las páginas seleccionadas
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opciones de esta respuesta
diff --git a/crates/ui-egui/src/i18n/fa.tsv b/crates/ui-egui/src/i18n/fa.tsv
index 5cfc217533..5c7279dfdc 100644
--- a/crates/ui-egui/src/i18n/fa.tsv
+++ b/crates/ui-egui/src/i18n/fa.tsv
@@ -2804,3 +2804,6 @@ theme	Appearance	ظاهر
 	two cells would both be named {name}	دو خانه هر دو با نام {name} نام‌گذاری می‌شوند
 	a field named {name} already exists	فیلدی با نام {name} از قبل وجود دارد
 	Today	امروز
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	گزینه‌های این پاسخ
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index a542ee9b91..7742ef6aeb 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -2827,3 +2827,6 @@ theme	Appearance	Teema
 	Rotate the selected pages clockwise	Kierrä valittuja sivuja myötäpäivään
 	Extract the selected pages…	Pura valitut sivut…
 	Delete the selected pages	Poista valitut sivut
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Tämän vastauksen asetukset
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 61c8b5171d..a8df3184fa 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2823,3 +2823,6 @@ certificate	Version	Version
 	Rotate the selected pages clockwise	Faire pivoter les pages sélectionnées dans le sens horaire
 	Extract the selected pages…	Extraire les pages sélectionnées…
 	Delete the selected pages	Supprimer les pages sélectionnées
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Options de cette réponse
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index e9d627aca9..1e239dcd7a 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -2794,3 +2794,6 @@ theme	Appearance	स्वरूप
 	Rotate the selected pages clockwise	चयनित पृष्ठों को दक्षिणावर्त घुमाएँ
 	Extract the selected pages…	चयनित पृष्ठ निकालें…
 	Delete the selected pages	चयनित पृष्ठ हटाएँ
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	इस जवाब के विकल्प
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 6b37b9169b..14e2399a20 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -2556,3 +2556,6 @@ animation effects	Off	Ki
 	Rotate the selected pages clockwise	A kijelölt oldalak forgatása az óramutató járásával megegyezően
 	Extract the selected pages…	A kijelölt oldalak kibontása…
 	Delete the selected pages	A kijelölt oldalak törlése
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	A válasz beállításai
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 292b336e10..e2eecad04e 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -2795,3 +2795,6 @@ theme	Appearance	Tampilan
 	Rotate the selected pages clockwise	Putar halaman yang dipilih searah jarum jam
 	Extract the selected pages…	Ekstrak halaman yang dipilih…
 	Delete the selected pages	Hapus halaman yang dipilih
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opsi untuk balasan ini
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 20729bae6a..e24c7239f5 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -2789,3 +2789,6 @@ certificate	SHA-256 digest	Impronta SHA-256
 	Rotate the selected pages clockwise	Ruota le pagine selezionate in senso orario
 	Extract the selected pages…	Estrai le pagine selezionate…
 	Delete the selected pages	Elimina le pagine selezionate
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opzioni per questa risposta
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 1ed4d43b6c..62334da62c 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -2557,3 +2557,6 @@ animation effects	Off	オフ
 	Rotate the selected pages clockwise	選択したページを時計回りに回転
 	Extract the selected pages…	選択したページを抽出…
 	Delete the selected pages	選択したページを削除
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	この返信のオプション
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 9022c3591c..f79ad88476 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -2555,3 +2555,6 @@ animation effects	Off	Өшірулі
 	Rotate the selected pages clockwise	Таңдалған беттерді сағат тілімен бұру
 	Extract the selected pages…	Таңдалған беттерді шығарып алу…
 	Delete the selected pages	Таңдалған беттерді жою
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Осы жауаптың параметрлері
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 09b9cad9fa..3d543237b3 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -2794,3 +2794,6 @@ theme	Appearance	모양
 	Rotate the selected pages clockwise	선택한 페이지를 시계 방향으로 회전
 	Extract the selected pages…	선택한 페이지 추출…
 	Delete the selected pages	선택한 페이지 삭제
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	이 답글의 옵션
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index 964467d823..ce4f67ebe2 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -2465,3 +2465,6 @@ animation effects	Off	ປິດ
 	Rotate the selected pages clockwise	ໝູນໜ້າທີ່ເລືອກຕາມເຂັມໂມງ
 	Extract the selected pages…	ແຍກໜ້າທີ່ເລືອກອອກ…
 	Delete the selected pages	ລຶບໜ້າທີ່ເລືອກ
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	ຕົວເລືອກຂອງການຕອບກັບນີ້
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 43749f4ec8..da076f4559 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -2818,3 +2818,6 @@ theme	Appearance	Išvaizda
 	Rotate the selected pages clockwise	Pasukti pasirinktus puslapius pagal laikrodžio rodyklę
 	Extract the selected pages…	Išskleisti pasirinktus puslapius…
 	Delete the selected pages	Ištrinti pasirinktus puslapius
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Šio atsakymo parinktys
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index 6f1739974a..b7522c2084 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -2733,3 +2733,6 @@ key	Space	Mellomrom
 	Rotate the selected pages clockwise	Roter de valgte sidene med klokken
 	Extract the selected pages…	Trekk ut de valgte sidene…
 	Delete the selected pages	Slett de valgte sidene
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Alternativer for dette svaret
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 963d717584..75756768d5 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -2653,3 +2653,6 @@ animation effects	Off	Wyłączone
 	Rotate the selected pages clockwise	Obróć zaznaczone strony w prawo
 	Extract the selected pages…	Wyodrębnij zaznaczone strony…
 	Delete the selected pages	Usuń zaznaczone strony
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opcje tej odpowiedzi
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index c34ae83bc5..24dcb6247f 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -2842,3 +2842,6 @@ theme	Appearance	Aparência
 	Rotate the selected pages clockwise	Girar as páginas selecionadas no sentido horário
 	Extract the selected pages…	Extrair as páginas selecionadas…
 	Delete the selected pages	Excluir as páginas selecionadas
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opções desta resposta
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index 78d2298b93..02e383e77c 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -2818,3 +2818,6 @@ theme	Appearance	Aspect
 	Rotate the selected pages clockwise	Rotește paginile selectate în sens orar
 	Extract the selected pages…	Extrage paginile selectate…
 	Delete the selected pages	Șterge paginile selectate
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opțiuni pentru acest răspuns
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 274232d586..0429bd944b 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -2470,3 +2470,6 @@ animation effects	Off	Выкл
 	Rotate the selected pages clockwise	Повернуть выбранные страницы по часовой стрелке
 	Extract the selected pages…	Извлечь выбранные страницы…
 	Delete the selected pages	Удалить выбранные страницы
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Параметры этого ответа
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 420e6a5996..50d8fd345a 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -2562,3 +2562,6 @@ animation effects	Off	Izklopljeni
 	Rotate the selected pages clockwise	Zavrti izbrane strani v smeri urnega kazalca
 	Extract the selected pages…	Izvleci izbrane strani…
 	Delete the selected pages	Izbriši izbrane strani
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Možnosti tega odgovora
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index ba7c9dc5b3..d0306f2430 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -2544,3 +2544,6 @@ animation effects	Off	Joaktiv
 	Rotate the selected pages clockwise	Rrotullo faqet e përzgjedhura në drejtim të orës
 	Extract the selected pages…	Nxirr faqet e përzgjedhura…
 	Delete the selected pages	Fshi faqet e përzgjedhura
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opsionet për këtë përgjigje
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 7f339989ee..84ae40746b 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -2466,3 +2466,6 @@ animation effects	Off	ఆఫ్
 	Rotate the selected pages clockwise	ఎంచుకున్న పేజీలను సవ్య దిశలో తిప్పు
 	Extract the selected pages…	ఎంచుకున్న పేజీలను సంగ్రహించు…
 	Delete the selected pages	ఎంచుకున్న పేజీలను తొలగించు
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	ఈ ప్రత్యుత్తరం ఎంపికలు
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index 2c9b892ed7..a13e6e3332 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -2720,3 +2720,6 @@ theme	Appearance	ลักษณะที่ปรากฏ
 	Rotate the selected pages clockwise	หมุนหน้าที่เลือกตามเข็มนาฬิกา
 	Extract the selected pages…	แยกหน้าที่เลือกออก…
 	Delete the selected pages	ลบหน้าที่เลือก
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	ตัวเลือกของการตอบกลับนี้
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index a2ecaea179..7695241b30 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -2553,3 +2553,6 @@ animation effects	Off	Kapalı
 	Rotate the selected pages clockwise	Seçili sayfaları saat yönünde döndür
 	Extract the selected pages…	Seçili sayfaları ayıkla…
 	Delete the selected pages	Seçili sayfaları sil
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Bu yanıtın seçenekleri
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 9c76868839..6f31d9d32a 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2579,3 +2579,6 @@ animation effects	Off	Вимкнено
 	Rotate the selected pages clockwise	Повернути вибрані сторінки за годинниковою стрілкою
 	Extract the selected pages…	Витягнути вибрані сторінки…
 	Delete the selected pages	Видалити вибрані сторінки
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Параметри цієї відповіді
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 973ba870ea..e43fdd3404 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -2824,3 +2824,6 @@ key	Space	Space
 	Rotate the selected pages clockwise	Xoay các trang đã chọn theo chiều kim đồng hồ
 	Extract the selected pages…	Trích xuất các trang đã chọn…
 	Delete the selected pages	Xóa các trang đã chọn
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Tùy chọn cho câu trả lời này
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index d77c8f6425..7b63830365 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -2521,3 +2521,6 @@ animation effects	Off	关
 	Rotate the selected pages clockwise	顺时针旋转所选页面
 	Extract the selected pages…	提取所选页面…
 	Delete the selected pages	删除所选页面
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	此回复的选项
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index ce3b939f1d..8f0ea1bed3 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -2507,3 +2507,6 @@ animation effects	Off	關
 	Rotate the selected pages clockwise	順時針旋轉所選頁面
 	Extract the selected pages…	擷取所選頁面…
 	Delete the selected pages	刪除所選頁面
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	此回覆的選項
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 3a3169576c..f8c26b59b8 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -4,7 +4,7 @@
 use egui::accesskit::Role;
 use egui::{Pos2, pos2};
 use egui_kittest::Harness;
-use egui_kittest::kittest::Queryable;
+use egui_kittest::kittest::{NodeT, Queryable};
 use pdfcraft_render::Annotation;
 use pdfcraft_ui_egui::{PdfCraftApp, QuickTool};
 
@@ -1327,6 +1327,98 @@ fn replies_follow_irt_references_when_names_repeat_on_every_page() {
     h.get_by_label("2 replies");
 }
 
+// Contributor-original PDF: a comment whose wrong reply (with a pop-up) comes before it in
+// `/Annots` and has an answer of its own, a locked right reply and an Accepted status. `/F 128`
+// is the Locked flag.
+const REPLY_THREAD: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [5 0 R 9 0 R 4 0 R 6 0 R 7 0 R 8 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (note) /T (Ben) /Contents (The comment) >> endobj
+5 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (wrong) /IRT 4 0 R /T (Cat) /Contents (Wrong reply) /Popup 9 0 R >> endobj
+6 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (right) /IRT 4 0 R /T (Dan) /Contents (Right reply) /F 128 >> endobj
+7 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (answer) /IRT 5 0 R /T (Eve) /Contents (Answer to the wrong reply) >> endobj
+8 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /IRT 4 0 R /StateModel /Review /State /Accepted /T (Ben) /Contents (Accepted set by Ben) >> endobj
+9 0 obj << /Type /Annot /Subtype /Popup /Rect [60 100 160 160] /Parent 5 0 R >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+/// The "…" of the reply row that shows `text`: the last one above it (it sits on the row's
+/// author line).
+fn reply_options<'a>(h: &'a Harness<'static, PdfCraftApp>, text: &str) -> egui_kittest::Node<'a> {
+    let y = h.get_by_label(text).rect().top();
+    h.query_all_by_label("Options for this reply")
+        .filter(|b| b.rect().top() <= y)
+        .max_by(|a, b| a.rect().top().total_cmp(&b.rect().top()))
+        .expect("a reply menu")
+}
+
+/// One reply is deleted from its own "…" menu, with the answer to it and its pop-up: the comment,
+/// its other reply and its status stay, and the card stays selected though the comment moved up
+/// in `/Annots`. One undo brings the reply back. A locked reply can't be deleted, and Edit
+/// changes the reply's text, not the comment's.
+#[test]
+fn one_reply_is_deleted_from_its_menu_and_the_thread_stays() {
+    let mut h = harness_with_bytes(REPLY_THREAD.to_vec(), |app| {
+        app.set_option("panel", "comments").unwrap();
+        app.views[0].comments.selected = Some((0, 2));
+    });
+    let texts = |h: &Harness<'static, PdfCraftApp>| -> Vec<String> { comments(h).iter().filter_map(|a| a.contents.clone()).collect() };
+    let all = ["Wrong reply", "The comment", "Right reply", "Answer to the wrong reply", "Accepted set by Ben"];
+    assert_eq!(texts(&h), all);
+    assert_eq!(h.query_all_by_label("Options for this reply").count(), 3, "each reply has one; the status is a badge");
+
+    reply_options(&h, "Wrong reply").click();
+    h.run_steps(2);
+    h.get_by_label("Delete").click();
+    h.run_steps(3);
+    assert_eq!(texts(&h), ["The comment", "Right reply", "Accepted set by Ben"], "the reply took its answer along");
+    let id = h.state().views[0].id;
+    assert_eq!(h.state().session.get(id).unwrap().info.annotations[0].index, 0, "its pop-up went too");
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 0)), "the card stays selected where the comment now is");
+    assert_eq!(h.query_all_by_label("Wrong reply").count(), 0);
+    assert_eq!(h.query_all_by_label("Answer to the wrong reply").count(), 0);
+    h.get_by_label("Right reply");
+    h.get_by_label("Accepted");
+    assert_eq!(h.state().session.get(id).unwrap().can_undo(), Some("Delete comment"), "one undo step");
+
+    // Copy text copies the reply's text.
+    reply_options(&h, "Right reply").click();
+    h.run_steps(2);
+    h.get_by_label("Copy text").click();
+    let mut copied = false;
+    for _ in 0..4 {
+        h.step();
+        copied |= h.output().platform_output.commands.iter().any(|c| matches!(c, egui::OutputCommand::CopyText(t) if t == "Right reply"));
+    }
+    assert!(copied, "the reply's text is copied");
+    h.run_steps(2);
+
+    // The locked reply's Delete is greyed out; its text can still be edited (ISO 32000-2
+    // Table 167: Locked doesn't restrict the contents).
+    reply_options(&h, "Right reply").click();
+    h.run_steps(2);
+    assert!(h.get_by_label("Delete").accesskit_node().is_disabled(), "a locked reply isn't deleted");
+    h.query_all_by_label("Edit").last().expect("the reply menu's Edit, after the toolbar tab").click();
+    h.run_steps(2);
+    let editor = h.query_all_by(|n| n.role() == Role::MultilineTextInput && n.placeholder() != Some("Add a reply")).next().expect("reply editor");
+    editor.click();
+    h.run_steps(1);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+    h.event(egui::Event::Text("Right reply, reworded".into()));
+    h.run_steps(2);
+    h.get_by_label("Save").click();
+    h.run_steps(3);
+    assert_eq!(texts(&h), ["The comment", "Right reply, reworded", "Accepted set by Ben"]);
+
+    h.state_mut().undo();
+    h.run_steps(2);
+    h.state_mut().undo();
+    h.run_steps(3);
+    assert_eq!(texts(&h), all, "undo brings the reply and its answer back");
+    h.get_by_label("Wrong reply");
+}
+
 #[test]
 fn the_header_names_no_replies_when_there_are_none() {
     let h = harness_with_bytes(PER_PAGE_NAMES.to_vec(), |app| {
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 40fa711c24..f1c3bfa106 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,5 +1,6 @@
 # PdfCraft roadmap: milestones and what's next
 
+> **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M5: one reply in the Comments panel is edited, copied or deleted from its own "…" menu; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
@@ -177,7 +178,7 @@ total matches the parity estimate.
 | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Organize opens directly into the page overview, with checkbox selection, an editable page-range selection (#1092), and per-page rotate/delete controls; Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Extract and Split preserve shared Type 3 glyph resource graphs, retaining conservative pruning limits. Missing: page transitions, recovery on the web M4: Insert-from-file preserves source bookmarks; integration tests retained with current main. |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Renderer-creation errors return to the existing OpenGL startup fallback; a real-GPU regression covers errors and device reuse. The underlying x86 DX12 shader compiler failure remains unresolved; see `windows-renderer-startup.md`. With Windows' Animation effects turned off, the wheel scrolls and zooms without easing and egui's animations take no time (`motion.rs`; macOS, Linux and the browser aren't asked yet); Preferences ▸ Animation effects (Use system setting, On, Off) decides it on every platform. |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web |
-| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: replies thread by their `/IRT` reference rather than the parent's `/NM`, so files that repeat names per page (PyMuPDF) thread correctly, and the Comments header counts comments without their replies, as Acrobat does, with the reply count under it; the Comments panel groups replies and counts all page roots once per frame (#2669, item 5); stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles; Ctrl+Enter submission for highlight comment text and replies, with Shift+Enter newlines (reconciled with upstream main for PR #1457 on 2026-10-14). Missing: custom stamps, replace-text proposals, summary layouts with the page |
+| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: replies thread by their `/IRT` reference rather than the parent's `/NM`, so files that repeat names per page (PyMuPDF) thread correctly, and the Comments header counts comments without their replies, as Acrobat does, with the reply count under it; the Comments panel groups replies and counts all page roots once per frame (#2669, item 5); each reply in the Comments panel has its own "…" (Edit, Copy text, Delete): Delete takes that reply and the replies to it, the comment and its other replies stay, and the card stays selected; stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles; Ctrl+Enter submission for highlight comment text and replies, with Shift+Enter newlines (reconciled with upstream main for PR #1457 on 2026-10-14). Missing: custom stamps, replace-text proposals, summary layouts with the page |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web M4: Insert-from-file preserves source bookmarks; integration tests retained with current main. |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links; nested FDF export uses lazy array owners and annotation positions, with retained entries budgeted before cloning under copied-graph limits and source `/Page` and `/Pages` dictionaries replaced by null at every copy depth); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. A refused restyle or resize of a text box another program drew leaves that comment unchanged (#1327). Make Current Properties Default on an arrow updates arrows, not plain lines (#1302). Flattening keeps a visible comment it cannot draw (#1317). Missing: custom stamps, replace-text proposals, summary layouts with the page |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 5e1c4a7e75..b846d36701 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -3967,8 +3967,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_reply"]
-evidence = ["crates/ui-egui/tests/it/comments.rs::the_panel_posts_comments_and_replies", "crates/ui-egui/tests/it/comments.rs::ctrl_enter_posts_a_reply_and_shift_enter_adds_a_line", "crates/annot/src/tests.rs::replies_and_status_thread_onto_the_parent"]
-notes = "multiline reply field: Enter or Ctrl+Enter (also Command+Enter) posts, Shift+Enter adds a newline; empty replies are not posted"
+evidence = ["crates/ui-egui/tests/it/comments.rs::the_panel_posts_comments_and_replies", "crates/ui-egui/tests/it/comments.rs::ctrl_enter_posts_a_reply_and_shift_enter_adds_a_line", "crates/annot/src/tests.rs::replies_and_status_thread_onto_the_parent", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays"]
+notes = "multiline reply field: Enter or Ctrl+Enter (also Command+Enter) posts, Shift+Enter adds a newline; empty replies are not posted. On the selected card each reply has its own \"…\" menu (Edit, Copy text, Delete); a Replace Text caret, half of its comment, has none. Missing: Set status on a reply from its menu, @mentions"
 
 [[feature]]
 id = "comment.set-status"
@@ -4003,8 +4003,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_delete"]
-evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain"]
-notes = "deletes the pop-up and the reply thread"
+evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/comments.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies"]
+notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted."
 
 [[feature]]
 id = "comment.keyboard-nudge"
@@ -4039,8 +4039,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_edit"]
-evidence = ["crates/annot/src/tests.rs::text_box_text_and_colour_changes_are_drawn", "crates/annot/src/tests.rs::editing_a_text_box_refits_its_rectangle", "crates/automation/tests/it/automation.rs::comments_through_tools", "crates/ui-egui/tests/it/comments.rs::ctrl_enter_posts_a_highlight_comment_and_shift_enter_adds_a_line"]
-notes = "double-click a comment or card, or Edit in the menus; Ctrl+Enter (also Command+Enter) saves text in the focused comment editor, Shift+Enter adds a newline; a text box's rectangle follows the new text (wrap width and top edge stay, the height fits the wrapped lines)"
+evidence = ["crates/annot/src/tests.rs::text_box_text_and_colour_changes_are_drawn", "crates/annot/src/tests.rs::editing_a_text_box_refits_its_rectangle", "crates/automation/tests/it/automation.rs::comments_through_tools", "crates/ui-egui/tests/it/comments.rs::ctrl_enter_posts_a_highlight_comment_and_shift_enter_adds_a_line", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays"]
+notes = "double-click a comment or card, or Edit in the menus (a reply from its own \"…\" menu); Ctrl+Enter (also Command+Enter) saves text in the focused comment editor, Shift+Enter adds a newline; a text box's rectangle follows the new text (wrap width and top edge stay, the height fits the wrapped lines)"
 
 [[feature]]
 id = "comment.copy-comment-text"
@@ -4051,8 +4051,8 @@ milestone = "M5"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/comments.rs::comments_take_checkmarks_lock_hide_and_summarize"]
-notes = "card and canvas context menus"
+evidence = ["crates/ui-egui/tests/it/comments.rs::comments_take_checkmarks_lock_hide_and_summarize", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays"]
+notes = "card, reply and canvas context menus"
 
 [[feature]]
 id = "comment.filter-comments"

From 9745b7c5ccf6f8ff41de167d556190e7136fcc15 Mon Sep 17 00:00:00 2001
From: songzhihui <song19891121@qq.com>
Date: Mon, 26 Oct 2026 16:03:04 +0800
Subject: [PATCH 080/270] M2: match print-preview fonts to output policy

---
 ROADMAP.md                  |  4 ++
 crates/render/src/raster.rs | 78 +++++++++++++++++++++++++++++++++++++
 docs/roadmap.md             |  6 ++-
 3 files changed, 87 insertions(+), 1 deletion(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 88139fb145..dfc8b311d8 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,5 +1,7 @@
 # PdfCraft roadmap
 
+> **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: print preview excludes installed CJK fonts and isolates its font cache from the viewer; estimates unchanged)
+
 > **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: reconcile current main while retaining display-only CJK fallback and upstream Japanese font selection; estimates unchanged)
 
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M2, PR #4172: extend on-screen CJK fallback to Combine thumbnails and figure previews; recognise FangSong and subset-prefixed Founder names; estimates unchanged)
@@ -757,3 +759,5 @@ Newest first: the date, what moved, and the new overall estimate.
 - **2026-10-22 (PR #3227 integration):** M11: integrate upstream `80b7d215`; retain partial target-version compatibility and upstream content-boundary and image-size regression coverage. Scope and estimates unchanged.
 
 - **2026-10-23 (M2, PR #4172):** Combine thumbnails and accessibility figure previews use the viewer's display-only CJK fallback. Windows family matching includes FangSong and subset-prefixed Founder names. Export, print, OCR and automation remain off by default; estimates unchanged.
+
+- **2026-10-26 (M2, PR #4172 print-preview review):** Print-preview requests disable installed CJK fallback and use an isolated cache so preview font availability matches output. Viewer fallback survives switching in either direction. Synthetic GBK regressions cover inline and single-worker rendering, full pages and tiles; estimates unchanged.
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 0382ba67c7..592bbf536e 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -200,6 +200,7 @@ pub struct RenderRequest {
 /// The tag bit of a print-preview raster. Such requests always render the document's true
 /// colours, ignoring `RenderConfig::reading_colors`: a preview's job is fidelity to the
 /// printout, and the print itself — imposed from the document — is never recoloured.
+/// Installed-font fallback is also disabled, matching the output's font policy.
 pub const PRINT_TAG: u64 = 1 << 60;
 
 /// The reading colours a request renders with: print previews ([`PRINT_TAG`]) ignore the
@@ -337,6 +338,23 @@ fn render_page<'a>(
     config: &RenderConfig,
     req: RenderRequest,
 ) -> Result<Output, (String, bool)> {
+    // Print previews share the viewer pool, but must use the output font policy. Keep the
+    // caller's cancellation/warning hooks, layers and annotation settings. A fresh cache is
+    // essential: hayro keys cached fonts by PDF dictionary, not by the font resolver, so the
+    // viewer cache could supply an installed face even after changing the resolver (and a
+    // cached missing font from print preview could blank the viewer on switching back).
+    let print_settings;
+    let print_cache;
+    let (settings, cache) = if config.system_fonts && req.tag & PRINT_TAG != 0 {
+        print_settings = InterpreterSettings {
+            font_resolver: RenderConfig { system_fonts: false, ..config.clone() }.settings().font_resolver,
+            ..settings.clone()
+        };
+        print_cache = RenderCache::new();
+        (&print_settings, &print_cache)
+    } else {
+        (settings, cache)
+    };
     let reading = request_reading(config, &req);
     if req.kind == RequestKind::Text {
         return match catch_unwind(AssertUnwindSafe(|| crate::text::extract_page(pdf, req.page, settings))) {
@@ -7909,6 +7927,66 @@ trailer << /Root 1 0 R >>
         }
     }
 
+    /// Print preview must match output even after the same worker cached an installed face.
+    /// Switching back to the viewer must not retain the print resolver's missing-font result.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn print_preview_excludes_installed_fonts_without_poisoning_viewer_cache() {
+        use hayro::hayro_interpret::font::FallbackFontQuery;
+        use hayro::hayro_interpret::hayro_cmap::CharacterCollection;
+        let query = FontQuery::Fallback(FallbackFontQuery {
+            post_script_name: Some("SimSun".into()),
+            character_collection: Some(CharacterCollection { family: CidFamily::AdobeGB1, supplement: 2 }),
+            ..Default::default()
+        });
+        if super::system_fallback(&query).is_none() {
+            eprintln!("no installed GB1 face (or PDFCRAFT_SYSTEM_FONTS=0): skipped");
+            return;
+        }
+        let content = "BT /F1 40 Tf 5 15 Td <D6D0CEC4> Tj ET";
+        let bytes = Arc::new(format!(
+            "%PDF-1.7\n\
+             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 120 60] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+             5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /SimSun /Encoding /GBK-EUC-H /DescendantFonts [6 0 R] >> endobj\n\
+             6 0 obj << /Type /Font /Subtype /CIDFontType2 /BaseFont /SimSun /CIDSystemInfo << /Registry (Adobe) /Ordering (GB1) /Supplement 2 >> /FontDescriptor 7 0 R /DW 1000 >> endobj\n\
+             7 0 obj << /Type /FontDescriptor /FontName /SimSun /Flags 6 /FontBBox [0 -141 1000 859] /ItalicAngle 0 /Ascent 859 /Descent -141 /CapHeight 700 /StemV 80 >> endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF", content.len()
+        ).into_bytes());
+        let config = RenderConfig::default().on_screen();
+        let mut inline = PageRenderer::new(bytes.clone(), config.clone());
+        let mut output = PageRenderer::new(bytes.clone(), RenderConfig::default());
+        let pool = RenderPool::new(bytes, 1, config);
+        for tile in [None, Some(Tile { x: 0, y: 0, w: 120, h: 60 })] {
+            // Cover both directions with a warm worker cache, including other caller tag bits.
+            for tag in [PRINT_TAG | 1, 2, PRINT_TAG | 3, 4] {
+                let req = RenderRequest { page: 0, scale: 1.0, tile, tag, ..Default::default() };
+                let truth = output.render(req);
+                assert!(truth.error.is_none(), "{:?}", truth.error);
+                pool.set_queue(vec![req]);
+                let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+                let worker = loop {
+                    if let Some(page) = pool.try_recv() {
+                        break page;
+                    }
+                    assert!(std::time::Instant::now() < deadline, "print-preview worker timed out");
+                    std::thread::sleep(std::time::Duration::from_millis(5));
+                };
+                for page in [inline.render(req), worker] {
+                    assert!(page.error.is_none(), "{:?}", page.error);
+                    if tag & PRINT_TAG != 0 {
+                        assert_eq!(page.rgba, truth.rgba, "print preview must match output, tile={tile:?}");
+                    } else {
+                        let ink = page.rgba.as_chunks::<4>().0.iter().filter(|c| c[0] < 128).count();
+                        assert!(ink > 300, "viewer still draws installed Chinese glyphs: {ink}");
+                    }
+                }
+            }
+        }
+    }
+
     /// Half-width katakana are common in Japanese documents set in a non-embedded Mincho font
     /// such as HeiseiMin-W3. The Mincho substitute must have those glyphs: one that lacks them
     /// (Shippori Mincho) draws them as .notdef.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 0ffcf06f9d..09c783e7a0 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,5 +1,7 @@
 # PdfCraft roadmap: milestones and what's next
 
+> **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: print-preview font policy matches output, with isolated caches and GBK switching regressions; estimates unchanged)
+
 > **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: reconcile current main and retain Japanese serif/weight selection alongside display-only CJK fallback; estimates unchanged)
 
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
@@ -160,6 +162,8 @@ M2 update (2026-10-23, #234 / continuation of #1567): the desktop viewer uses in
 faces for non-embedded CID fonts, including Windows GBK-EUC-H books. Windows Song/Hei/Kai
 families are retained when installed, and reload retains the fallback. This is display-only;
 export, printing, OCR, automation and machines without a candidate retain their limitations.
+Print preview excludes installed faces and isolates its font cache from the viewer, matching
+output font availability even after repeated view/print switching (2026-10-26, PR #4172).
 The M2 readiness and remaining-work estimates below are unchanged.
 
 "Plan size" is the original single-agent sizing. "Done" is the estimated share of that milestone's
@@ -171,7 +175,7 @@ total matches the parity estimate.
 |---|---|---|---|---|---|
 | M0 | Skeleton: workspace, xtask gates, CI | 15–30 | 98% | 1–2 | GitHub workflow, `deny.toml` (licence audit of every dependency), parity checklist (826 features, `xtask parity`) done. Missing: remaining crate stubs, testkit/oracle crates |
 | M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 80% | 20–40 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. An unchanged incremental save of a classic table writes a zero-length cross-reference subsection instead of a section with no subsections (#1339). A full rewrite keeps unknown trailer entries, including objects reachable only from them (#1338). Fuzzing runs nightly (`xtask fuzz`). Raw-deflate fallback preserves decoding-limit errors, including through tolerant COS stream decoding. Done since: #2658: macOS atomic saves retain destination extended attributes, including Finder tags, and reject partial resource-fork reads after size changes. Metadata failures retain the original PDF and unsaved edit. Missing: ≥ 250 tests, own image codecs |
-| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized. Forms without Resources use page Properties for ActualText and layer visibility; own dictionaries stop fallback. Oversized missing inline-image samples, including header and terminator overhead, no longer pin the content window (#3107 / PR #3438); normal large streamed images retain deterministic sample boundaries. Radial luminosity fades have synthetic coverage for the existing #2132 mask guard, including per-pixel references, antialiased clips, previews, scales and tiles; no additional production fix was needed. Dotted TOC leaders no longer inflate letter tracking or hide word spaces (#3086); phrase search and selection are covered. Short tracked ellipses retain their gap samples and remain searchable. Missing spacing glyphs in non-embedded Japanese CID substitutes render blank without changing PDF advances or Unicode (#3601). The desktop viewer can use installed CJK fonts, including Windows GBK Song/Hei/Kai/FangSong and subset-prefixed Founder names; Combine thumbnails and accessibility figure previews use the same display-only fallback, without changing export or print font policy (#234, continuation of #1567, review #4172). |
+| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized. Forms without Resources use page Properties for ActualText and layer visibility; own dictionaries stop fallback. Oversized missing inline-image samples, including header and terminator overhead, no longer pin the content window (#3107 / PR #3438); normal large streamed images retain deterministic sample boundaries. Radial luminosity fades have synthetic coverage for the existing #2132 mask guard, including per-pixel references, antialiased clips, previews, scales and tiles; no additional production fix was needed. Dotted TOC leaders no longer inflate letter tracking or hide word spaces (#3086); phrase search and selection are covered. Short tracked ellipses retain their gap samples and remain searchable. Missing spacing glyphs in non-embedded Japanese CID substitutes render blank without changing PDF advances or Unicode (#3601). The desktop viewer can use installed CJK fonts, including Windows GBK Song/Hei/Kai/FangSong and subset-prefixed Founder names; Combine thumbnails and accessibility figure previews use the same display-only fallback, without changing export or print font policy (#234, continuation of #1567, review #4172). Print previews exclude installed faces and isolate their font cache; GBK regressions cover view/print switching for inline and pooled whole-page/tile rendering. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. The renderer keeps its one-point crop-size floor in physical points after UserUnit scaling, with regression coverage for crop origins, rotations and f32 reciprocal rounding. Existing unit policy and nearly-zero fallback are retained. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). #3808: the Pages inspector offers a 50–150% thumbnail slider and buttons, also available through `ui.set`. Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. #3149: page-list changes discard render demand based on old geometry; actual raster dimensions are checked against the GPU limit before upload. Synthetic crash and continued-rendering regressions cover the replacement path. Save-prompt shortcuts yield to dialogs above them; stacked link-consent UI regression covers Escape and Return. Comment hover follows individual marked lines and original annotation paint order (#3541/#3620), independently of spatial inspection sorting; synthetic rotation, differing-upper-edge overlap and unchanged-document regressions. Optional page gaps join page edges without cropping PDF margins; current-document toggle, persisted default and UI control options are covered by viewer tests. Gap changes in Organize Pages preserve document scroll position, and both comparison panes follow menu and control choices. Repeated window resizes by an edge and moves by the tab strip on GNOME/Wayland work without a click in between. |

From 3994c2ca9d42a8d08b17571c80d37d536cafcb9b Mon Sep 17 00:00:00 2001
From: songzhihui <song19891121@qq.com>
Date: Mon, 26 Oct 2026 16:39:20 +0800
Subject: [PATCH 081/270] M2: document installed CJK font resolution contracts

---
 ROADMAP.md                       |  4 ++++
 crates/render/src/raster.rs      |  4 ++++
 crates/render/src/system_font.rs | 23 +++++++++++++++++++++++
 docs/roadmap.md                  |  4 +++-
 4 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index dfc8b311d8..ba657c4d92 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,5 +1,7 @@
 # PdfCraft roadmap
 
+> **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: document installed-font resolution helpers and regression contracts; behavior and estimates unchanged)
+
 > **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: print preview excludes installed CJK fonts and isolates its font cache from the viewer; estimates unchanged)
 
 > **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: reconcile current main while retaining display-only CJK fallback and upstream Japanese font selection; estimates unchanged)
@@ -761,3 +763,5 @@ Newest first: the date, what moved, and the new overall estimate.
 - **2026-10-23 (M2, PR #4172):** Combine thumbnails and accessibility figure previews use the viewer's display-only CJK fallback. Windows family matching includes FangSong and subset-prefixed Founder names. Export, print, OCR and automation remain off by default; estimates unchanged.
 
 - **2026-10-26 (M2, PR #4172 print-preview review):** Print-preview requests disable installed CJK fallback and use an isolated cache so preview font availability matches output. Viewer fallback survives switching in either direction. Synthetic GBK regressions cover inline and single-worker rendering, full pages and tiles; estimates unchanged.
+
+- **2026-10-26 (M2, PR #4172 documentation review):** Added function documentation for installed-font script selection, bounded candidate reads, platform paths, resolver precedence and regression contracts. No runtime behavior or estimate change.
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 592bbf536e..74c4586dc8 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -88,6 +88,10 @@ impl RenderConfig {
         Self { system_fonts: true, ..self }
     }
 
+    /// Build interpreter settings with layer and comment preferences and a font resolver that
+    /// tries bundled Japanese faces, then opt-in installed CJK faces, then standard substitutes.
+    /// Passwords belong to parser construction; request-specific preview overrides are applied
+    /// by `render_page`, which also preserves the caller's warning and cancellation hooks.
     fn settings(&self) -> InterpreterSettings {
         let standard = InterpreterSettings::default().font_resolver;
         let system_fonts = self.system_fonts;
diff --git a/crates/render/src/system_font.rs b/crates/render/src/system_font.rs
index a5db18dfc5..8fcd167415 100644
--- a/crates/render/src/system_font.rs
+++ b/crates/render/src/system_font.rs
@@ -38,6 +38,8 @@ enum Script {
 }
 
 impl Script {
+    /// Map the four supported Adobe CJK collections to their writing systems. Identity and
+    /// custom collections provide no regional hint and cannot select an installed face here.
     fn of(family: &CidFamily) -> Option<Self> {
         match family {
             CidFamily::AdobeJapan1 => Some(Self::Japanese),
@@ -133,6 +135,9 @@ pub(crate) fn fallback(query: &FallbackFontQuery) -> Option<(FontData, u32)> {
     found.as_ref().map(|(bytes, index)| (Arc::clone(bytes) as FontData, *index))
 }
 
+/// Read a candidate through the bounded file cache and select a face that maps `probe`,
+/// preferring the requested region and weight. Unreadable files and unsuitable faces return
+/// `None`, allowing the caller to try the next candidate without changing the PDF.
 fn read(candidate: &Candidate, probe: char, bold: bool) -> Option<(Arc<Vec<u8>>, u32)> {
     let bytes = file_bytes(&candidate.path)?;
     let index = pick_face(&bytes, probe, candidate.region, bold)?;
@@ -197,6 +202,10 @@ fn pick_face(bytes: &[u8], probe: char, region: &[&str], bold: bool) -> Option<u
     best.map(|(index, _)| index)
 }
 
+/// List installed-font paths in preference order, with regional face-name hints for collections.
+/// Windows Simplified Chinese first tries the named document family; its generic list also
+/// prefers a bold face for bold requests. macOS includes bounded downloaded-font locations.
+/// Only fixed platform filenames are used: a PDF font name never becomes a filesystem path.
 fn candidates(script: Script, family: ChineseFamily, bold: bool) -> Vec<Candidate> {
     let region: &'static [&'static str] = match script {
         Script::Japanese => &["JP", "Japanese"],
@@ -283,6 +292,8 @@ fn macos_font_asset_dirs() -> &'static [PathBuf] {
     })
 }
 
+/// Locate the Windows Fonts directory using `WINDIR`, then `SystemRoot`, then `C:\Windows`.
+/// This only constructs the path; candidate reads still enforce regular-file and size limits.
 fn windows_fonts() -> PathBuf {
     let dir = std::env::var_os("WINDIR").or_else(|| std::env::var_os("SystemRoot")).map_or_else(|| PathBuf::from(r"C:\Windows"), PathBuf::from);
     dir.join("Fonts")
@@ -294,6 +305,8 @@ mod tests {
 
     const SCRIPTS: [Script; 4] = [Script::Japanese, Script::SimplifiedChinese, Script::TraditionalChinese, Script::Korean];
 
+    /// Standard, localized and subset-prefixed names retain their Chinese family hint;
+    /// unrelated Latin names and generic YaHei requests use the default candidate list.
     #[test]
     fn chinese_family_hints_include_subset_and_localized_names() {
         for name in ["SimSun", "ABCDEF+SimSun", "STSong-Light", "宋体"] {
@@ -340,6 +353,8 @@ mod tests {
         assert!(fangsong.first().is_some_and(|c| c.path.ends_with("simfang.ttf")));
     }
 
+    /// Invalid font bytes, missing paths and directories produce no candidate face rather
+    /// than preventing the resolver from trying a later installed font.
     #[test]
     fn broken_and_missing_files_are_skipped() {
         assert_eq!(pick_face(b"", '\u{7269}', &[], false), None);
@@ -372,6 +387,8 @@ mod tests {
         assert!(file_bytes(missing).is_none() && file_bytes(missing).is_none());
     }
 
+    /// A Latin-only face fails every CJK probe even though its Latin glyph remains readable,
+    /// distinguishing unsupported script coverage from an unparseable font file.
     #[test]
     fn a_latin_face_is_rejected_for_every_script() {
         let inter = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");
@@ -381,6 +398,8 @@ mod tests {
         assert_eq!(pick_face(inter, 'A', &[], false), Some(0));
     }
 
+    /// Platform candidates are absolute TrueType paths and exclude the font families barred
+    /// by the asset policy, independently of whether those files are installed locally.
     #[test]
     fn candidates_are_absolute_font_files_without_adobe_designs() {
         for script in SCRIPTS {
@@ -398,6 +417,8 @@ mod tests {
         }
     }
 
+    /// The four regional Adobe collections select their corresponding scripts; Identity
+    /// carries no regional information and must not acquire an installed fallback by guess.
     #[test]
     fn only_the_four_adobe_collections_have_a_script() {
         assert_eq!(Script::of(&CidFamily::AdobeCNS1), Some(Script::TraditionalChinese));
@@ -465,6 +486,8 @@ mod tests {
     #[cfg(target_os = "macos")]
     #[test]
     fn macos_candidates_include_a_pingfang_that_lives_in_the_font_assets() {
+        /// Independently locate an installed asset by filename within the test's depth limit,
+        /// providing an oracle for the production candidate list without using its discovery.
         fn find(dir: &Path, name: &str, depth: u32) -> Option<PathBuf> {
             for entry in std::fs::read_dir(dir).ok()?.flatten() {
                 let path = entry.path();
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 09c783e7a0..080416c1a6 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,5 +1,7 @@
 # PdfCraft roadmap: milestones and what's next
 
+> **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: document installed-font helpers and regression contracts; behavior and estimates unchanged)
+
 > **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: print-preview font policy matches output, with isolated caches and GBK switching regressions; estimates unchanged)
 
 > **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: reconcile current main and retain Japanese serif/weight selection alongside display-only CJK fallback; estimates unchanged)
@@ -175,7 +177,7 @@ total matches the parity estimate.
 |---|---|---|---|---|---|
 | M0 | Skeleton: workspace, xtask gates, CI | 15–30 | 98% | 1–2 | GitHub workflow, `deny.toml` (licence audit of every dependency), parity checklist (826 features, `xtask parity`) done. Missing: remaining crate stubs, testkit/oracle crates |
 | M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 80% | 20–40 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. An unchanged incremental save of a classic table writes a zero-length cross-reference subsection instead of a section with no subsections (#1339). A full rewrite keeps unknown trailer entries, including objects reachable only from them (#1338). Fuzzing runs nightly (`xtask fuzz`). Raw-deflate fallback preserves decoding-limit errors, including through tolerant COS stream decoding. Done since: #2658: macOS atomic saves retain destination extended attributes, including Finder tags, and reject partial resource-fork reads after size changes. Metadata failures retain the original PDF and unsaved edit. Missing: ≥ 250 tests, own image codecs |
-| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized. Forms without Resources use page Properties for ActualText and layer visibility; own dictionaries stop fallback. Oversized missing inline-image samples, including header and terminator overhead, no longer pin the content window (#3107 / PR #3438); normal large streamed images retain deterministic sample boundaries. Radial luminosity fades have synthetic coverage for the existing #2132 mask guard, including per-pixel references, antialiased clips, previews, scales and tiles; no additional production fix was needed. Dotted TOC leaders no longer inflate letter tracking or hide word spaces (#3086); phrase search and selection are covered. Short tracked ellipses retain their gap samples and remain searchable. Missing spacing glyphs in non-embedded Japanese CID substitutes render blank without changing PDF advances or Unicode (#3601). The desktop viewer can use installed CJK fonts, including Windows GBK Song/Hei/Kai/FangSong and subset-prefixed Founder names; Combine thumbnails and accessibility figure previews use the same display-only fallback, without changing export or print font policy (#234, continuation of #1567, review #4172). Print previews exclude installed faces and isolate their font cache; GBK regressions cover view/print switching for inline and pooled whole-page/tile rendering. |
+| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized. Forms without Resources use page Properties for ActualText and layer visibility; own dictionaries stop fallback. Oversized missing inline-image samples, including header and terminator overhead, no longer pin the content window (#3107 / PR #3438); normal large streamed images retain deterministic sample boundaries. Radial luminosity fades have synthetic coverage for the existing #2132 mask guard, including per-pixel references, antialiased clips, previews, scales and tiles; no additional production fix was needed. Dotted TOC leaders no longer inflate letter tracking or hide word spaces (#3086); phrase search and selection are covered. Short tracked ellipses retain their gap samples and remain searchable. Missing spacing glyphs in non-embedded Japanese CID substitutes render blank without changing PDF advances or Unicode (#3601). The desktop viewer can use installed CJK fonts, including Windows GBK Song/Hei/Kai/FangSong and subset-prefixed Founder names; Combine thumbnails and accessibility figure previews use the same display-only fallback, without changing export or print font policy (#234, continuation of #1567, review #4172). Print previews exclude installed faces and isolate their font cache; GBK regressions cover view/print switching for inline and pooled whole-page/tile rendering. Installed-font helpers and their regression contracts have function documentation. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. The renderer keeps its one-point crop-size floor in physical points after UserUnit scaling, with regression coverage for crop origins, rotations and f32 reciprocal rounding. Existing unit policy and nearly-zero fallback are retained. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). #3808: the Pages inspector offers a 50–150% thumbnail slider and buttons, also available through `ui.set`. Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. #3149: page-list changes discard render demand based on old geometry; actual raster dimensions are checked against the GPU limit before upload. Synthetic crash and continued-rendering regressions cover the replacement path. Save-prompt shortcuts yield to dialogs above them; stacked link-consent UI regression covers Escape and Return. Comment hover follows individual marked lines and original annotation paint order (#3541/#3620), independently of spatial inspection sorting; synthetic rotation, differing-upper-edge overlap and unchanged-document regressions. Optional page gaps join page edges without cropping PDF margins; current-document toggle, persisted default and UI control options are covered by viewer tests. Gap changes in Organize Pages preserve document scroll position, and both comparison panes follow menu and control choices. Repeated window resizes by an edge and moves by the tab strip on GNOME/Wayland work without a click in between. |

From 0a6d0f3689c82658906a5a020701beebfb30ffa8 Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <258340642+jonathanwxh-cell@users.noreply.github.com>
Date: Mon, 26 Oct 2026 10:00:14 +0000
Subject: [PATCH 082/270] fix(crypt): derive a new file id from the encryption
 seed

/ID is SHA-256 of the seed under the label id, not an unkeyed DefaultHasher digest. The salts test is a characterization; failing closed when randomness is missing stays the regression guard.

Co-authored-by: jonathanwxh-cell <jonathanwxh-cell@users.noreply.github.com>
---
 crates/cos/src/document.rs | 47 ++++++++++++++++++++++++++------------
 crates/crypt/src/lib.rs    | 10 +++++++-
 crates/crypt/src/tests.rs  | 10 ++++++++
 crates/engine/src/tests.rs |  6 +++++
 4 files changed, 58 insertions(+), 15 deletions(-)

diff --git a/crates/cos/src/document.rs b/crates/cos/src/document.rs
index ae00234d0e..46b57d1717 100644
--- a/crates/cos/src/document.rs
+++ b/crates/cos/src/document.rs
@@ -792,8 +792,7 @@ impl Document {
         let id0 = match self.trailer.get(b"ID") {
             Some(Object::Array(a)) if a.len() == 2 => a[0].as_string().map(|s| s.bytes.clone()).unwrap_or_default(),
             _ => {
-                let mut id = generated_id(&params.seed);
-                id.truncate(16);
+                let id = pdfcraft_crypt::file_id(&params.seed);
                 let s = Object::String(crate::PdfString { bytes: id.clone(), hex: true });
                 self.trailer.set(b"ID".to_vec(), Object::Array(vec![s.clone(), s]));
                 id
@@ -2191,18 +2190,6 @@ fn rfind(hay: &[u8], needle: &[u8], from: usize) -> Option<usize> {
     (from..=hay.len() - needle.len()).rev().find(|&i| &hay[i..i + needle.len()] == needle)
 }
 
-/// A file identifier derived from entropy supplied by the caller.
-fn generated_id(seed: &[u8; 32]) -> Vec<u8> {
-    use std::hash::{Hash, Hasher};
-    let mut out = Vec::new();
-    for i in 0..2u8 {
-        let mut h = std::collections::hash_map::DefaultHasher::new();
-        (seed, i, b"pdfcraft id").hash(&mut h);
-        out.extend_from_slice(&h.finish().to_be_bytes());
-    }
-    out
-}
-
 /// The object number a classic xref subsection really starts at. A common producer bug heads the
 /// table `1 n` and then writes object 0's free entry (`0000000000 65535 f`) as its first row, so
 /// every row would be read one number too high and object 1 as free. Such a subsection is read
@@ -2250,6 +2237,38 @@ const MAX_XREF_OBJECTS: usize = 8_388_607;
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_missing_file_id_is_derived_from_the_encryption_seed() {
+        let mut doc = Document::new_empty();
+        let seed = [9u8; 32];
+        doc.set_encryption(&pdfcraft_crypt::NewEncryption {
+            algorithm: pdfcraft_crypt::Algorithm::Aes256,
+            user_password: "user",
+            owner_password: "owner",
+            permissions: -4,
+            encrypt_metadata: true,
+            seed,
+        })
+        .unwrap();
+        let id = doc.trailer().get(b"ID").and_then(|o| o.as_array()).and_then(|a| a.first()).and_then(|o| o.as_string()).map(|s| s.bytes.clone());
+        assert_eq!(id.as_deref(), Some(pdfcraft_crypt::file_id(&seed).as_slice()));
+
+        let mut kept = Document::new_empty();
+        let fixed = Object::String(crate::PdfString { bytes: b"0123456789abcdef".to_vec(), hex: true });
+        kept.trailer_mut().set(b"ID".to_vec(), Object::Array(vec![fixed.clone(), fixed]));
+        kept.set_encryption(&pdfcraft_crypt::NewEncryption {
+            algorithm: pdfcraft_crypt::Algorithm::Aes256,
+            user_password: "user",
+            owner_password: "owner",
+            permissions: -4,
+            encrypt_metadata: true,
+            seed,
+        })
+        .unwrap();
+        let still = kept.trailer().get(b"ID").and_then(|o| o.as_array()).and_then(|a| a.first()).and_then(|o| o.as_string()).map(|s| s.bytes.clone());
+        assert_eq!(still.as_deref(), Some(b"0123456789abcdef".as_slice()));
+    }
+
     #[test]
     fn a_read_state_matches_a_clone_and_no_changed_document() {
         let mut doc = Document::new_empty();
diff --git a/crates/crypt/src/lib.rs b/crates/crypt/src/lib.rs
index 82b598688a..ba9a63581c 100644
--- a/crates/crypt/src/lib.rs
+++ b/crates/crypt/src/lib.rs
@@ -602,12 +602,20 @@ fn expand(seed: &[u8; 32], label: &[u8], n: usize) -> Vec<u8> {
         h.update(label);
         h.update(counter.to_le_bytes());
         out.extend_from_slice(&h.finalize());
-        counter += 1;
+        counter = counter.saturating_add(1);
     }
     out.truncate(n);
     out
 }
 
+/// Sixteen bytes of file identifier from `seed` (SHA-256 in counter mode, label `id`).
+///
+/// `/ID` is written in the clear. Deriving it the same way as the file key keeps that public
+/// value from being an unkeyed hash of the seed.
+pub fn file_id(seed: &[u8; 32]) -> Vec<u8> {
+    expand(seed, b"id", 16)
+}
+
 /// Build the `/Encrypt` values and an authenticated (owner) handler for a new encryption.
 pub fn create(params: &NewEncryption, id0: &[u8]) -> Result<SecurityHandler, CryptError> {
     // Bits 7–8 and 13–32 must be 1; bits 1–2 must be 0 (§7.6.4.2).
diff --git a/crates/crypt/src/tests.rs b/crates/crypt/src/tests.rs
index 5110e79998..e684f1ef2e 100644
--- a/crates/crypt/src/tests.rs
+++ b/crates/crypt/src/tests.rs
@@ -4,6 +4,16 @@ fn hex(s: &str) -> Vec<u8> {
     (0..s.len()).step_by(2).map(|i| u8::from_str_radix(&s[i..i + 2], 16).unwrap()).collect()
 }
 
+#[test]
+fn file_id_is_a_one_way_16_byte_identifier() {
+    let seed = [7u8; 32];
+    let id = file_id(&seed);
+    assert_eq!(id.len(), 16);
+    assert_eq!(id, file_id(&seed));
+    assert_ne!(id, seed[..16]);
+    assert_ne!(id, file_id(&[8u8; 32]));
+}
+
 #[test]
 fn rc4_reference_vectors() {
     assert_eq!(rc4(b"Key", b"Plaintext"), hex("bbf316e8d940af0ad3"));
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 6895f188f3..ceb3f1c34f 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1886,6 +1886,12 @@ fn passwords_that_encryption_would_make_empty_or_equal_are_refused() {
 
 #[test]
 fn fresh_sessions_protecting_identical_documents_produce_different_salts() {
+    // Characterization only: two sessions' salts differ. A per-call RandomState already did
+    // that before Protect drew from the platform CSPRNG, so this does not prove the source.
+    // `protect_fails_closed_when_randomness_is_unavailable` is the guard. It does not compile
+    // against a Protect with no CSPRNG hook, and it fails closed when that hook errors or
+    // returns zeros. Comparing the stored function with `getrandom::fill` is not reliable:
+    // one function can have different addresses in different codegen units.
     let raw = Arc::new(fixture(1));
     let encrypt_bytes = |saved: Arc<Vec<u8>>, key: &[u8]| -> Vec<u8> {
         let doc = pdfcraft_cos::Document::open_with_password(saved, Some("secret")).unwrap();

From a85a6c721172dda6e9e567b379094f73a999b16c Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Mon, 26 Oct 2026 21:22:57 +1100
Subject: [PATCH 083/270] fix(ui): restyling an open added-text box restarts
 its typing history

restyle_draft applies a format change to an open added-text box in
place, so the page then has the box's text. Unlike a paragraph's
applied(), it left typing_from as it was: when the restyle left the
text as it was, the box kept its history, and Redo put typing undone
before the restyle back on top of it, to be saved on finishing. It now
resets typing_from after a successful edit, so the next claim clears
the history (and the rows' alignments by text with it).
---
 crates/ui-egui/src/panels.rs       |  3 +++
 crates/ui-egui/tests/it/content.rs | 40 ++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index 0178325b0b..9c595dee84 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -674,6 +674,9 @@ impl PdfCraftApp {
         {
             // What the page has now. The aligns stay those of the text in the box.
             d.style = pdfcraft_engine::AddedText { aligns: std::mem::take(&mut d.style.aligns), ..updated };
+            // The page has the box's text: its typing history restarts at the next claim, even
+            // when the restyle left the text as it was, so a Redo can't put undone typing back.
+            d.typing_from = None;
         }
     }
 
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index acc9d80472..69597591db 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1241,6 +1241,46 @@ fn undo_in_the_frame_of_the_switch_back_takes_back_added_text_typing() {
     assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes the typing back in A's box");
 }
 
+/// Retyping taken back with Ctrl+Z, then Bold picked with the added text box still open: the
+/// restyle is applied in place and the page has the box's text, so neither Ctrl+Shift+Z nor the
+/// menu's Redo may bring the undone retyping back on top of the bold (CodeRabbit on a33a8bba).
+#[test]
+fn redo_after_restyling_open_added_text_never_brings_back_typing_undone_before_it() {
+    for route in ["key", "menu"] {
+        let mut h = harness();
+        let rect = [40.0, 195.0, 240.0, 210.0];
+        let text = pdfcraft_engine::AddedText { rect, text: "Reviewed".into(), ..Default::default() };
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+        assert!(h.state_mut().execute("edit.text"));
+        h.run_steps(3);
+        let point = at(&h, 45.0, 195.0);
+        click(&mut h, point);
+        assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+        h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+        h.event(egui::Event::Text(" twice".into()));
+        h.run_steps(2);
+        h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+        h.run_steps(3);
+        assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "{route}: taken back");
+        h.get_by_label("Bold").click();
+        h.run_steps(4);
+        let pdfcraft_engine::AddedContent::Text(now) = &added(&h)[0].content else { panic!() };
+        assert!(now.bold, "{route}: the bold is applied to the item");
+        assert!(h.state().views[0].content.draft.is_some(), "{route}: the box stays open");
+        if route == "key" {
+            h.key_press_modifiers(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT, egui::Key::Z);
+        } else {
+            // The menu item is off: neither the document nor the box has a Redo.
+            assert!(!h.state_mut().execute("edit.redo"), "menu: Redo is refused, there is nothing to redo");
+        }
+        h.run_steps(3);
+        let draft = h.state().views[0].content.draft.as_ref().map(|d| d.text.clone());
+        assert_eq!(draft.as_deref(), Some("Reviewed"), "{route}: the retyping undone before the bold comes back in the box");
+        let pdfcraft_engine::AddedContent::Text(now) = &added(&h)[0].content else { panic!() };
+        assert_eq!(now.text, "Reviewed", "{route}: nor in the document");
+    }
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.

From 0cdd6592077595d85322959f850d13ad121b4a6a Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Mon, 26 Oct 2026 21:20:26 +0100
Subject: [PATCH 084/270] chore: Cargo.lock: pdfcraft-edit's sha2 follows
 main's 0.11.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Cargo.lock b/Cargo.lock
index 7957416fe3..5e41927f2c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4216,7 +4216,7 @@ dependencies = [
  "pdfcraft-cos",
  "pdfcraft-fonts",
  "pdfcraft-model",
- "sha2 0.11.0",
+ "sha2 0.11.1",
  "thiserror 2.0.21",
  "unicode-bidi",
 ]

From 64fba7d177032170939861dc7eb51d8486a43264 Mon Sep 17 00:00:00 2001
From: Hitesh <shahagra@gmail.com>
Date: Sun, 25 Oct 2026 13:46:51 +0530
Subject: [PATCH 085/270] feat(edit): Esc in an open paragraph selects its box,
 so Delete removes it

In Edit text & images a click inside a paragraph opens it for typing, and selecting the whole
box meant aiming for its thin frame: a press a few pixels inside put the caret in the text
instead (#2203). Esc in the inline editor now leaves the text and selects the paragraph's box,
as Acrobat does, so Esc then Delete removes it, the arrow keys nudge it and its frame drags it.
Esc still discards an unapplied draft.

The editor asks `ObjectSelection` to select the paragraph, and the next `prepare`, which has the
document's inventory, selects it after its own Escape check, so the Esc that closed the editor
cannot clear the new selection.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/tools/edit_text_ui.rs |  3 ++
 crates/ui-egui/src/tools/object_ui.rs    | 20 ++++++++++++++
 crates/ui-egui/tests/it/editing.rs       | 35 ++++++++++++++++++++++++
 parity/acrobat-features.toml             |  4 +--
 4 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
index 66daa6edb8..11bf52fbb7 100644
--- a/crates/ui-egui/src/tools/edit_text_ui.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -664,6 +664,9 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
         Some(apply) => {
             let ed = view.line_editor.take()?;
             if !apply {
+                // Esc leaves the text but not the paragraph: its box is selected, as in Acrobat,
+                // so Delete removes it without aiming for the frame. The draft is discarded.
+                view.objects.select_paragraph_next(ed.page, ed.block);
                 return None;
             }
             view.applied_editor = Some(ed.clone());
diff --git a/crates/ui-egui/src/tools/object_ui.rs b/crates/ui-egui/src/tools/object_ui.rs
index d495116c6c..e54446297c 100644
--- a/crates/ui-egui/src/tools/object_ui.rs
+++ b/crates/ui-egui/src/tools/object_ui.rs
@@ -25,6 +25,9 @@ pub(crate) struct ObjectSelection {
     pub hold_editor: bool,
     blocked_page: Option<usize>,
     input_blocked: bool,
+    /// A paragraph (page, block) to select once the document is at hand: Esc in the inline
+    /// editor asks for it, and the next `prepare` selects it.
+    select_paragraph: Option<(usize, usize)>,
 }
 
 #[derive(Clone, Copy)]
@@ -62,6 +65,14 @@ impl ObjectSelection {
         self.gesture = None;
         self.pending = None;
         self.blocked_page = None;
+        self.select_paragraph = None;
+    }
+
+    /// Select paragraph `block` of `page` as an object at the next `prepare`, as Acrobat does
+    /// when Esc leaves a text box: the box is then selected, so Delete removes it, the arrow keys
+    /// move it and its frame drags it, without aiming for the frame.
+    pub(crate) fn select_paragraph_next(&mut self, page: usize, block: usize) {
+        self.select_paragraph = Some((page, block));
     }
 
     pub fn prepare(&mut self, doc: &Document, enabled: bool, ctx: &egui::Context) {
@@ -106,6 +117,15 @@ impl ObjectSelection {
         if self.page.is_some() && ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
             self.clear();
         }
+        // After the Escape check: the Esc that closed the editor must not clear what it selected.
+        if let Some((page, block)) = self.select_paragraph.take()
+            && let Ok(objects) = self.inventory(doc, page)
+            && let Some(object) = objects.into_iter().find(|o| o.target == ObjectTarget { kind: ObjectKind::Text, index: block })
+        {
+            self.clear();
+            self.page = Some(page);
+            self.selected.push(object);
+        }
     }
 
     /// The move of the whole selection by `offset` (user space). The selection follows it.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index e5e104d674..c2abd20f9b 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6499,3 +6499,38 @@ fn a_paragraph_selected_by_its_frame_deletes_with_one_key() {
         assert_eq!(blocks(&h).iter().map(|b| b.text.as_str()).collect::<Vec<_>>(), ["Page 1"], "undo restores it");
     }
 }
+
+/// Esc in an open paragraph leaves its text and selects its box, as in Acrobat, so Esc and
+/// Delete remove it without aiming for the thin frame; the unapplied draft is discarded.
+#[test]
+fn escape_in_an_open_paragraph_selects_its_box_for_delete() {
+    for draft in [None, Some("Page one")] {
+        let mut h = harness(1, |_| {});
+        assert!(h.state_mut().execute("edit.edit_text"));
+        h.run_steps(2);
+        let id = h.state().views[0].id;
+        let blocks = |h: &Harness<'static, PdfCraftApp>| h.state().session.get(id).unwrap().text_blocks(0);
+        let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+        let k = r.width() / 200.0;
+        let b = blocks(&h)[0].clone();
+        click_at(
+            &mut h,
+            egui::pos2(r.left() + ((b.rect[0] + b.rect[2]) / 2.0) as f32 * k, r.top() + (300.0 - (b.rect[1] + b.rect[3]) / 2.0) as f32 * k),
+        );
+        assert!(h.state().views[0].line_editor.is_some(), "a click inside the paragraph opens it for typing");
+        if let Some(text) = draft {
+            h.state_mut().views[0].line_editor.as_mut().unwrap().text = text.into();
+            h.run_steps(1);
+        }
+        press(&mut h, Modifiers::NONE, Key::Escape);
+        assert!(h.state().views[0].line_editor.is_none(), "Esc leaves the text");
+        h.get_by_label("1 object selected");
+        assert_eq!(blocks(&h)[0].text, "Page 1", "the draft {draft:?} is discarded");
+        press(&mut h, Modifiers::NONE, Key::Delete);
+        assert!(blocks(&h).is_empty(), "Esc then Delete removes the paragraph: {:?}", blocks(&h));
+        // One undo step brings it back.
+        assert!(h.state_mut().execute("edit.undo"));
+        h.run_steps(2);
+        assert_eq!(blocks(&h)[0].text, "Page 1");
+    }
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index bcba7a0ecd..6ec28519ae 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1878,8 +1878,8 @@ milestone = "M7"
 status = "partial"
 commands = ["edit.edit_text"]
 tools = ["text_lines", "text_paragraphs", "text_edit", "text_edit_layout", "text_font_files", "text_font_import", "text_fonts"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools", "crates/edit/src/tests.rs::a_line_whose_operator_starts_the_next_stream_can_be_edited", "crates/automation/tests/it/automation.rs::a_line_split_across_content_streams_is_listed_and_edited", "crates/ui-egui/tests/it/editing.rs::selected_text_formatting_keeps_the_rest_of_the_paragraph_and_reopens", "crates/edit/src/tests.rs::marked_paragraph_boundaries_and_cross_stream_transforms_survive_rewrite", "crates/automation/tests/it/automation.rs::explicit_font_and_disjoint_ranges_save_reopen_through_tools", "crates/edit/src/tests.rs::disjoint_style_ranges_preserve_unselected_runs_and_validate_utf8_atomically", "crates/engine/tests/it/document_fonts.rs::opentype_cff_document_font_preserves_program_codes_and_rendering_after_reopen", "crates/ui-egui/tests/it/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/it/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools", "crates/edit/src/tests.rs::mixed_styles_and_matrix_sizes_form_visual_regions_without_merging_columns", "crates/edit/src/tests.rs::rich_region_edits_preserve_styles_positions_and_delete_all_runs_after_reopen", "crates/ui-egui/tests/it/editing.rs::one_editor_contains_mixed_styles_and_visual_rows", "crates/ui-egui/tests/it/editing.rs::inline_editor_preserves_source_font_and_previews_live_bounds", "crates/fonts/src/pdf/tests.rs::mac_subset_cmap_uses_pdf_unicode_without_changing_source_program", "crates/automation/tests/it/automation.rs::mixed_visual_region_edit_preview_save_reopen_and_undo_through_tools", "crates/ui-egui/tests/it/ui.rs::the_edit_tab_turns_on_edit_text_and_images", "crates/ui-egui/tests/it/editing.rs::the_caret_on_a_small_row_is_as_tall_as_that_row", "crates/edit/src/tests.rs::uzbek_and_kazakh_cyrillic_use_the_bundled_latin_face", "crates/automation/tests/it/automation.rs::editing_uzbek_and_kazakh_cyrillic_through_tools", "crates/edit/src/tests.rs::styled_paragraph_batches_cyrillic_without_changing_source_fonts", "crates/edit/src/tests.rs::styled_paragraph_over_240_fallback_glyphs_splits_and_refuses_atomically", "crates/edit/src/tests.rs::styled_fallback_batches_keep_face_choices_and_range_styles", "crates/edit/src/tests.rs::styled_fallback_shards_keep_text_advances_and_alignment", "crates/edit/src/tests.rs::styled_fallback_budget_is_enforced_before_objects_are_written", "crates/edit/src/tests.rs::styled_fallback_same_base_font_and_character_keep_both_weights", "crates/automation/tests/it/automation.rs::styled_cyrillic_fallback_is_batched_through_tools_and_reopen"]
-notes = "The Edit tab turns Edit text & images on at once, as in Acrobat (leaving the tab puts the tool down and applies an edit in progress); click a paragraph box and retype it in place (font reused or Helvetica substituted, colour and spacing kept, rewrapped); a page's /Contents pieces are parsed joined, so a line whose operands and operator sit in different pieces is listed and edited (lines and paragraphs still don't join across pieces; Edit image still parses each piece alone); drag a box to move it or its right-edge handle to rewrap it (edit.text-move-resize); per-character formatting changes are next Since #1116: mixed-style visual regions retain source rows, subset encodings, colour and baseline anchors in one textless-background editor. Explicit paragraph/heading scopes constrain grouping; compatible graphics planes permit cross-stream regions. Full matching document fonts complete absent subset glyphs; installed/file selection, TrueType/OpenType-CFF embedding and disjoint UTF-8 range styles have save/reopen coverage. Single-face OpenType shaping/bidi retains logical text through ToUnicode/ActualText. Replacement text the paragraph's font can't show takes the craft-fonts Japanese faces when they draw all of it (Uzbek қ, Kazakh ә are in none of them), else the bundled Inter face, so those letters write in every build (#2593). Legacy non-SFNT preview, mixed-font/style contextual runs, full structure-tree preservation and author intent in untagged PDFs remain limited; Styled-path outline fallback batches by actual face with 240 glyphs per font and preserves source styles; adjacent equal-font/style characters form runs. At most 15360 distinct fallback glyphs per styled paragraph; missing glyphs are refused before fallback objects are written. Glyph coverage, mixed contextual shaping, single-style fallback and stale-font cleanup are unchanged; see docs/editing-existing-text.md"
+evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools", "crates/edit/src/tests.rs::a_line_whose_operator_starts_the_next_stream_can_be_edited", "crates/automation/tests/it/automation.rs::a_line_split_across_content_streams_is_listed_and_edited", "crates/ui-egui/tests/it/editing.rs::selected_text_formatting_keeps_the_rest_of_the_paragraph_and_reopens", "crates/edit/src/tests.rs::marked_paragraph_boundaries_and_cross_stream_transforms_survive_rewrite", "crates/automation/tests/it/automation.rs::explicit_font_and_disjoint_ranges_save_reopen_through_tools", "crates/edit/src/tests.rs::disjoint_style_ranges_preserve_unselected_runs_and_validate_utf8_atomically", "crates/engine/tests/it/document_fonts.rs::opentype_cff_document_font_preserves_program_codes_and_rendering_after_reopen", "crates/ui-egui/tests/it/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/it/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools", "crates/edit/src/tests.rs::mixed_styles_and_matrix_sizes_form_visual_regions_without_merging_columns", "crates/edit/src/tests.rs::rich_region_edits_preserve_styles_positions_and_delete_all_runs_after_reopen", "crates/ui-egui/tests/it/editing.rs::one_editor_contains_mixed_styles_and_visual_rows", "crates/ui-egui/tests/it/editing.rs::inline_editor_preserves_source_font_and_previews_live_bounds", "crates/fonts/src/pdf/tests.rs::mac_subset_cmap_uses_pdf_unicode_without_changing_source_program", "crates/automation/tests/it/automation.rs::mixed_visual_region_edit_preview_save_reopen_and_undo_through_tools", "crates/ui-egui/tests/it/ui.rs::the_edit_tab_turns_on_edit_text_and_images", "crates/ui-egui/tests/it/editing.rs::the_caret_on_a_small_row_is_as_tall_as_that_row", "crates/edit/src/tests.rs::uzbek_and_kazakh_cyrillic_use_the_bundled_latin_face", "crates/automation/tests/it/automation.rs::editing_uzbek_and_kazakh_cyrillic_through_tools", "crates/edit/src/tests.rs::styled_paragraph_batches_cyrillic_without_changing_source_fonts", "crates/edit/src/tests.rs::styled_paragraph_over_240_fallback_glyphs_splits_and_refuses_atomically", "crates/edit/src/tests.rs::styled_fallback_batches_keep_face_choices_and_range_styles", "crates/edit/src/tests.rs::styled_fallback_shards_keep_text_advances_and_alignment", "crates/edit/src/tests.rs::styled_fallback_budget_is_enforced_before_objects_are_written", "crates/edit/src/tests.rs::styled_fallback_same_base_font_and_character_keep_both_weights", "crates/automation/tests/it/automation.rs::styled_cyrillic_fallback_is_batched_through_tools_and_reopen", "crates/ui-egui/tests/it/editing.rs::escape_in_an_open_paragraph_selects_its_box_for_delete"]
+notes = "The Edit tab turns Edit text & images on at once, as in Acrobat (leaving the tab puts the tool down and applies an edit in progress); Esc in an open paragraph leaves its text and selects its box, so Delete removes it (the unapplied draft is discarded); click a paragraph box and retype it in place (font reused or Helvetica substituted, colour and spacing kept, rewrapped); a page's /Contents pieces are parsed joined, so a line whose operands and operator sit in different pieces is listed and edited (lines and paragraphs still don't join across pieces; Edit image still parses each piece alone); drag a box to move it or its right-edge handle to rewrap it (edit.text-move-resize); per-character formatting changes are next Since #1116: mixed-style visual regions retain source rows, subset encodings, colour and baseline anchors in one textless-background editor. Explicit paragraph/heading scopes constrain grouping; compatible graphics planes permit cross-stream regions. Full matching document fonts complete absent subset glyphs; installed/file selection, TrueType/OpenType-CFF embedding and disjoint UTF-8 range styles have save/reopen coverage. Single-face OpenType shaping/bidi retains logical text through ToUnicode/ActualText. Replacement text the paragraph's font can't show takes the craft-fonts Japanese faces when they draw all of it (Uzbek қ, Kazakh ә are in none of them), else the bundled Inter face, so those letters write in every build (#2593). Legacy non-SFNT preview, mixed-font/style contextual runs, full structure-tree preservation and author intent in untagged PDFs remain limited; Styled-path outline fallback batches by actual face with 240 glyphs per font and preserves source styles; adjacent equal-font/style characters form runs. At most 15360 distinct fallback glyphs per styled paragraph; missing glyphs are refused before fallback objects are written. Glyph coverage, mixed contextual shaping, single-style fallback and stale-font cleanup are unchanged; see docs/editing-existing-text.md"
 
 [[feature]]
 id = "edit.text-reflow"

From 0817ce2774c000279e9a11c9fdfe510aba4ac811 Mon Sep 17 00:00:00 2001
From: songzhihui <song19891121@qq.com>
Date: Tue, 27 Oct 2026 14:12:06 +0800
Subject: [PATCH 086/270] M2: keep roadmap review history in continuous
 blockquotes

---
 ROADMAP.md      | 5 -----
 docs/roadmap.md | 5 -----
 2 files changed, 10 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 264b308680..ada909fabd 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,15 +1,10 @@
 # PdfCraft roadmap
 
 > **Last reviewed:** 2026-10-27 · **Last updated:** 2026-10-27 · **Change:** patch (M2, PR #4172: integrate main 1dd2737b; preserve viewer-only CJK fallback and regression coverage across engine, renderer and Combine module splits; estimates unchanged)
-
 > **Last reviewed:** 2026-10-27 · **Last updated:** 2026-10-27 · **Change:** patch (M2, PR #4172: integrate main 9a9813bf and preserve viewer-only CJK fallback through the engine module split; estimates unchanged)
-
 > **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: document installed-font resolution helpers and regression contracts; behavior and estimates unchanged)
-
 > **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: print preview excludes installed CJK fonts and isolates its font cache from the viewer; estimates unchanged)
-
 > **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: reconcile current main while retaining display-only CJK fallback and upstream Japanese font selection; estimates unchanged)
-
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M2, PR #4172: extend on-screen CJK fallback to Combine thumbnails and figure previews; recognise FangSong and subset-prefixed Founder names; estimates unchanged)
 
 **Stage: alpha** · next: beta, ~25% (ready for real work 50% → 75%) and ~400–700 h away
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 5b79c0fa67..211fa11466 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,15 +1,10 @@
 # PdfCraft roadmap: milestones and what's next
 
 > **Last reviewed:** 2026-10-27 · **Last updated:** 2026-10-27 · **Change:** patch (M2, PR #4172: integrate main 1dd2737b; preserve viewer-only CJK fallback and regression coverage across engine, renderer and Combine module splits; estimates unchanged)
-
 > **Last reviewed:** 2026-10-27 · **Last updated:** 2026-10-27 · **Change:** patch (M2, PR #4172: integrate main 9a9813bf and migrate viewer-only CJK configuration to the split engine modules; estimates unchanged)
-
 > **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: document installed-font helpers and regression contracts; behavior and estimates unchanged)
-
 > **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: print-preview font policy matches output, with isolated caches and GBK switching regressions; estimates unchanged)
-
 > **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** patch (M2, PR #4172: reconcile current main and retain Japanese serif/weight selection alongside display-only CJK fallback; estimates unchanged)
-
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)

From 7679f6b5562174cd1e9383ba84b2c2e4092f0706 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Tue, 27 Oct 2026 19:02:30 +1100
Subject: [PATCH 087/270] fix(edit): keep column frames local and clear stale
 history selections

---
 crates/edit/src/tests.rs                 | 44 ++++++++++++++++++++++++
 crates/edit/src/text/rewrite.rs          |  2 +-
 crates/edit/src/text_regions/grouping.rs | 37 ++++++++++++--------
 crates/ui-egui/src/editing.rs            |  4 +++
 crates/ui-egui/tests/it/content.rs       | 11 ++++++
 crates/ui-egui/tests/it/editing.rs       | 11 ++++++
 6 files changed, 93 insertions(+), 16 deletions(-)

diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 0859560620..96f71da36b 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -7259,6 +7259,50 @@ fn a_lone_row_of_two_styles_aligns_across_its_column() {
     assert!((title(&doc)[0] - centred[0]).abs() < 0.5, "centring again leaves it where it is: {:?} vs {centred:?}", title(&doc));
 }
 
+#[test]
+fn a_titles_column_ignores_distant_full_width_headers_and_footers() {
+    for (title_x, column_prefix) in [(95, "The first"), (365, "The second")] {
+        for mixed in [false, true] {
+            for title_y in [710, 580] {
+                let title = if mixed { "(Big ) Tj 1 0 0 rg (Title) Tj" } else { "(Title) Tj" };
+                let name = if mixed { "Big Title" } else { "Title" };
+                let mut doc = text_page(&format!(
+                    "BT /F1 10 Tf 12 TL 50 780 Td (A page-wide header extending well beyond either body column on this page and continuing all the way to the right margin.) Tj T* (A repeated page-wide heading across both columns and continuing to the right margin of the page.) Tj ET \
+                 BT /F1 18 Tf 1 0 0 1 {title_x} {title_y} Tm {title} ET \
+                 BT 0 g /F1 10 Tf 12 TL 50 660 Td (The first column runs to here.) Tj T* (A second row of it.) Tj ET \
+                 BT /F1 10 Tf 12 TL 320 660 Td (The second column runs to here.) Tj T* (Another row.) Tj ET \
+                 BT /F1 10 Tf 50 40 Td (A page-wide footer extending well beyond either body column on this page and continuing all the way to the right margin.) Tj ET"
+                ));
+                let rect = |doc: &Document, prefix: &str| {
+                    let blocks = text::text_blocks(doc, 0).unwrap();
+                    blocks.iter().find(|b| b.text.starts_with(prefix)).unwrap_or_else(|| panic!("missing {prefix:?} in {blocks:?}")).rect
+                };
+                let column = rect(&doc, column_prefix);
+                let header = rect(&doc, "A page-wide header");
+                let footer = rect(&doc, "A page-wide footer");
+                assert!(header[2] > column[2] + 20.0 && footer[2] > column[2] + 20.0);
+                for align in [added::Align::Center, added::Align::Center, added::Align::Right, added::Align::Left] {
+                    let blocks = text::text_blocks(&doc, 0).unwrap();
+                    let (index, block) = blocks.iter().enumerate().find(|(_, b)| b.text == name).unwrap();
+                    let style = text::BlockStyle { aligns: vec![Some(align)], ..Default::default() };
+                    text::rewrite_block(&mut doc, 0, index, Some(&block.editor_text), &style).unwrap();
+                    doc = reopen(&doc);
+                    let title = rect(&doc, name);
+                    let error = match align {
+                        added::Align::Center => ((title[0] + title[2]) - (column[0] + column[2])).abs() / 2.0,
+                        added::Align::Right => (title[2] - column[2]).abs(),
+                        _ => (title[0] - column[0]).abs(),
+                    };
+                    assert!(error < 1.0, "{align:?}, mixed={mixed}, title_y={title_y}: {title:?} must use {column:?}");
+                    assert_eq!(rect(&doc, "A page-wide header"), header);
+                    assert_eq!(rect(&doc, "A page-wide footer"), footer);
+                    assert_eq!(rect(&doc, column_prefix), column);
+                }
+            }
+        }
+    }
+}
+
 /// How each glyph-showing operator on page 0 is painted, read the way a renderer reads the page:
 /// its text, `Tr`, stroke colour operators, line width (from `w` or an ExtGState's `/LW`) and
 /// the ExtGStates selected before it, following `q`/`Q`.
diff --git a/crates/edit/src/text/rewrite.rs b/crates/edit/src/text/rewrite.rs
index 77d3d8b2a3..5cb5f2a321 100644
--- a/crates/edit/src/text/rewrite.rs
+++ b/crates/edit/src/text/rewrite.rs
@@ -221,7 +221,7 @@ pub(crate) fn rewrite_block_from(
     // An alignment for a one-row paragraph is laid out across the column it sits in, as a
     // paragraph of that width moved to its left edge.
     let framed;
-    let style = match alignment_frame(&lines, &b, style) {
+    let style = match alignment_frame(&lines, &blocks, &b, style) {
         Some([left, right]) => {
             framed = BlockStyle { width: Some(right - left), offset: Some([left - b.rect[0], 0.0]), ..style.clone() };
             &framed
diff --git a/crates/edit/src/text_regions/grouping.rs b/crates/edit/src/text_regions/grouping.rs
index fce75880d3..4f2e8371a3 100644
--- a/crates/edit/src/text_regions/grouping.rs
+++ b/crates/edit/src/text_regions/grouping.rs
@@ -28,12 +28,11 @@ fn frame_row_rect(row: &[usize], lines: &[TextLine]) -> Option<[f64; 4]> {
 
 /// The left edge the rest of the page's text sits on, ignoring the rows of `block`. A single row
 /// that does not share it is not merely an indented or full-width left-aligned line, so its own
-/// centre is the only remaining explanation for where it sits. With `over`, only rows reaching
-/// across that span count: the edge of the column under it, however many rows another column has.
-fn neighbour_left(lines: &[TextLine], block: &TextBlock, over: Option<[f64; 2]>) -> Option<f64> {
+/// centre is the only remaining explanation for where it sits.
+fn neighbour_left(lines: &[TextLine], block: &TextBlock) -> Option<f64> {
     let mut edges: HashMap<i64, usize> = HashMap::new();
     for (i, line) in lines.iter().enumerate() {
-        if block.lines.contains(&i) || over.is_some_and(|[left, right]| line.rect[2] <= left || line.rect[0] >= right) {
+        if block.lines.contains(&i) {
             continue;
         }
         // Quarter-point buckets: equal edges found through different runs still agree.
@@ -44,25 +43,33 @@ fn neighbour_left(lines: &[TextLine], block: &TextBlock, over: Option<[f64; 2]>)
 }
 
 /// Where an alignment picked for a one-row paragraph is measured, as `[left, right]`: the column of
-/// text it sits in (the left edge the text under or over it uses, to the furthest right those rows
-/// reach) when that column holds it, otherwise its own box. A lone row's own box is no frame
+/// text it sits in (the nearest overlapping paragraph's left edge, to the furthest right
+/// its rows reach) when that column holds it, otherwise its own box. A lone row's own box is no frame
 /// to align in: left-aligning a title centred on the page left it where it was, and since a single
 /// row grows to the page's margin, centring it again moved it right each time. `None` when no
 /// alignment is asked for, or when the paragraph is several rows, turned, or given a width or a
 /// move of its own.
-pub(crate) fn alignment_frame(lines: &[TextLine], block: &TextBlock, style: &BlockStyle) -> Option<[f64; 2]> {
+pub(crate) fn alignment_frame(lines: &[TextLine], blocks: &[TextBlock], block: &TextBlock, style: &BlockStyle) -> Option<[f64; 2]> {
     let asked = style.align.is_some() || style.aligns.iter().any(Option::is_some);
     if !asked || style.width.is_some() || style.offset.is_some() || block.rows.len() != 1 || block.rotation.abs() > 0.01 {
         return None;
     }
     let own = [block.rect[0], block.rect[2]];
     let tolerance = block.size.max(1.0) * 0.5;
-    let Some(left) = neighbour_left(lines, block, Some(own)) else { return Some(own) };
-    let right = lines
+    let gap = |other: &TextBlock| (other.rect[1] - block.rect[3]).max(block.rect[1] - other.rect[3]).max(0.0);
+    // Page-wide headers and footers sharing this margin aren't part of the local column.
+    let neighbour = blocks
         .iter()
-        .enumerate()
-        .filter(|(i, line)| !block.lines.contains(i) && (line.rect[0] - left).abs() < tolerance)
-        .map(|(_, line)| line.rect[2])
+        .filter(|other| other.lines.iter().all(|i| !block.lines.contains(i)) && other.rect[2] > own[0] && other.rect[0] < own[1])
+        .min_by(|a, b| gap(a).total_cmp(&gap(b)));
+    let Some(neighbour) = neighbour else { return Some(own) };
+    let left = neighbour.rect[0];
+    let right = neighbour
+        .lines
+        .iter()
+        .filter_map(|i| lines.get(*i))
+        .filter(|line| (line.rect[0] - left).abs() < tolerance)
+        .map(|line| line.rect[2])
         .fold(f64::NEG_INFINITY, f64::max);
     let holds = right.is_finite() && right - left > own[1] - own[0] && own[0] >= left - tolerance && own[1] <= right + tolerance;
     Some(if holds { [left, right] } else { own })
@@ -84,9 +91,9 @@ pub(crate) fn is_centred(block: &TextBlock, lines: &[TextLine], page_centre: f64
         return left_span > size * 0.5
             && block.rows.iter().all(|row| row_rect(row, lines).is_some_and(|r| ((r[0] + r[2]) / 2.0 - centre).abs() < size));
     }
-    lefts.first().is_some_and(|left| {
-        (centre - page_centre).abs() < size && neighbour_left(lines, block, None).is_none_or(|edge| (*left - edge).abs() > size * 0.5)
-    })
+    lefts
+        .first()
+        .is_some_and(|left| (centre - page_centre).abs() < size && neighbour_left(lines, block).is_none_or(|edge| (*left - edge).abs() > size * 0.5))
 }
 
 pub(crate) fn group_blocks(lines: &[TextLine]) -> Vec<TextBlock> {
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index fc8d637a70..17366df250 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -220,6 +220,7 @@ impl PdfCraftApp {
             ed.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, true) else { return false };
             let before = std::mem::replace(&mut ed.text, text);
+            ed.selection = None;
             ed.follow_typed_rows(&ctx, &before);
             return true;
         }
@@ -227,6 +228,7 @@ impl PdfCraftApp {
             d.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, true) else { return false };
             let before = std::mem::replace(&mut d.text, text);
+            d.selection = None;
             crate::edit_text_ui::follow_typing(&ctx, crate::content_ui::input_id(), &before, &d.text, &mut [&mut d.style.aligns]);
             return true;
         }
@@ -253,6 +255,7 @@ impl PdfCraftApp {
             ed.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, false) else { return ed.has_unsaved_text() };
             let before = std::mem::replace(&mut ed.text, text);
+            ed.selection = None;
             ed.follow_typed_rows(&ctx, &before);
             return true;
         }
@@ -260,6 +263,7 @@ impl PdfCraftApp {
             d.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, false) else { return d.has_unapplied_typing() };
             let before = std::mem::replace(&mut d.text, text);
+            d.selection = None;
             crate::edit_text_ui::follow_typing(&ctx, crate::content_ui::input_id(), &before, &d.text, &mut [&mut d.style.aligns]);
             return true;
         }
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 69597591db..1dadc6adaa 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1096,7 +1096,13 @@ fn undo_from_the_menu_takes_back_retyping_in_the_added_text_box() {
     h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
     h.event(egui::Event::Text(" twice".into()));
     h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::SHIFT, egui::Key::Home);
+    h.run_steps(2);
+    assert!(h.state().views[0].content.draft.as_ref().unwrap().selection.is_some());
+    h.event(egui::Event::PointerMoved(egui::pos2(10.0, 10.0)));
+    h.ctx.memory_mut(|m| m.request_focus(egui::Id::unique("test-menu")));
     assert!(h.state_mut().execute("edit.undo"));
+    assert_eq!(h.state().views[0].content.draft.as_ref().unwrap().selection, None, "menu history clears the old byte range before the next frame");
     h.run_steps(3);
     assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes it back in the box");
     let s = h.state();
@@ -1123,7 +1129,12 @@ fn redo_from_the_menu_is_enabled_for_the_added_text_boxs_own_typing() {
     h.run_steps(3);
     assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes it back in the box");
     assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), None, "the document has nothing to redo");
+    // A range retained while the unfocused editor still showed its previous text.
+    h.state_mut().views[0].content.draft.as_mut().unwrap().selection = Some(0..1);
+    h.event(egui::Event::PointerMoved(egui::pos2(10.0, 10.0)));
+    h.ctx.memory_mut(|m| m.request_focus(egui::Id::unique("test-menu")));
     assert!(h.state_mut().execute("edit.redo"), "Redo is enabled for the box's own step");
+    assert_eq!(h.state().views[0].content.draft.as_ref().unwrap().selection, None, "menu history clears the old byte range before the next frame");
     h.run_steps(3);
     assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "Redo puts it back");
 }
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 03154369ab..e69eb63d85 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6742,7 +6742,13 @@ fn undo_from_the_menu_takes_back_typing_in_the_box() {
     h.key_press_modifiers(Modifiers::COMMAND, Key::End);
     h.event(egui::Event::Text(" more".into()));
     h.run_steps(2);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
+    h.run_steps(2);
+    assert!(h.state().views[0].line_editor.as_ref().unwrap().selection.is_some());
+    h.event(egui::Event::PointerMoved(egui::pos2(10.0, 10.0)));
+    h.ctx.memory_mut(|m| m.request_focus(egui::Id::unique("test-menu")));
     assert!(h.state_mut().execute("edit.undo"), "Undo is enabled for the box's typing");
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().selection, None, "menu history clears the old byte range before the next frame");
     h.run_steps(3);
     let s = h.state();
     let ed = s.views[0].line_editor.as_ref().expect("the box stays open");
@@ -6769,7 +6775,12 @@ fn redo_from_the_menu_is_enabled_for_the_boxs_own_typing() {
     h.run_steps(3);
     assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the typing is taken back");
     assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), None, "the document has nothing to redo");
+    // A range retained while the unfocused editor still showed its previous text.
+    h.state_mut().views[0].line_editor.as_mut().unwrap().selection = Some(0..1);
+    h.event(egui::Event::PointerMoved(egui::pos2(10.0, 10.0)));
+    h.ctx.memory_mut(|m| m.request_focus(egui::Id::unique("test-menu")));
     assert!(h.state_mut().execute("edit.redo"), "Redo is enabled for the box's own step");
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().selection, None, "menu history clears the old byte range before the next frame");
     h.run_steps(3);
     assert_eq!(h.state().views[0].line_editor.as_ref().expect("still open").text, typed, "Redo puts the typing back");
 }

From 503346efed84416cf167e8bb095c1cfe0f64338d Mon Sep 17 00:00:00 2001
From: songzhihui <song19891121@qq.com>
Date: Wed, 28 Oct 2026 08:32:17 +0800
Subject: [PATCH 088/270] M2: keep CJK roadmap separators inside blockquote

---
 docs/roadmap.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/roadmap.md b/docs/roadmap.md
index d6290a0ced..1ec73835e8 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -15,9 +15,9 @@
 > **Last reviewed:** 2026-10-23 | **Last updated:** 2026-10-23 | **Change:** minor (M10: table spans retain text from covered slots in Office exports; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M10: image export preserves soft-mask Decode opacity ranges; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M10: vector printing preserves existing page XObjects when adding annotation appearances; estimates unchanged)
-
+>
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M2, PR #4172: CJK fallback in Combine thumbnails and figure previews; FangSong and subset-prefixed Founder family matching; estimates unchanged)
-
+>
 > **Last reviewed:** 2026-10-22 · **Last updated:** 2026-10-22 · **Change:** minor (M14, #3558: rebase guarded macOS per-file association recovery onto current main; estimates unchanged)
 > **Last reviewed:** 2026-10-20 · **Last updated:** 2026-10-20 · **Change:** minor (M12 #3673: Character encoding accepts Identity-H/V with Adobe CJK collections; estimates unchanged)
 

From 0426c79bf55ad85480be12806918ace718ad4ea4 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Wed, 28 Oct 2026 10:43:16 +0100
Subject: [PATCH 089/270] parity: point delete-comment evidence at
 tools/comments/tests.rs

The test moved there with main's split of comments.rs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 parity/acrobat-features.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 31a21e2e73..1d15a25afe 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4003,7 +4003,7 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_delete"]
-evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/comments.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies"]
+evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies"]
 notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted."
 
 [[feature]]

From 0c5119791db7de268258b9d25f1286b82b563f8a Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Wed, 28 Oct 2026 20:59:30 +1100
Subject: [PATCH 090/270] fix(ui): keep the All tools rows clear of the
 scrollbar (#5133)

The scrollbar floats over the right edge of the tool list and covered the
right-hand rounded corners of a hovered row. The list now keeps an 18 px
gutter, so the highlight has the same 15 px gap to the panel edge on the
left and to the scrollbar on the right.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/panels/tools.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/crates/ui-egui/src/panels/tools.rs b/crates/ui-egui/src/panels/tools.rs
index 4ff76a7c43..9d106e38b3 100644
--- a/crates/ui-egui/src/panels/tools.rs
+++ b/crates/ui-egui/src/panels/tools.rs
@@ -58,6 +58,9 @@ pub(crate) fn panel_header(ui: &mut egui::Ui, t: &Tokens, title: &str, lead: Opt
     (go_back, close)
 }
 
+/// Width kept free at the right of the tool list for the floating scrollbar.
+const SCROLLBAR_GUTTER: f32 = 18.0;
+
 /// The All tools sidebar: Expand (the full view) and Close, then the tool list, the first few
 /// tools until View more shows them all.
 fn all_tools(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
@@ -70,6 +73,8 @@ fn all_tools(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
         app.left_open = false;
     }
     egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
+        // The scrollbar floats over the right edge: keep the rows (and their rounded hover wash) clear of it.
+        ui.set_max_width((ui.available_width() - SCROLLBAR_GUTTER).max(0.0));
         ui.add_space(2.0);
         let shown = if app.all_tools_expanded { TOOL_GROUPS.len() } else { COLLAPSED_TOOLS.min(TOOL_GROUPS.len()) };
         for g in &TOOL_GROUPS[..shown] {

From 72edd945e56724ece07d72625964a592f83344bb Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Wed, 28 Oct 2026 12:14:42 +0100
Subject: [PATCH 091/270] fix(comments): a locked reply keeps the comment or
 reply it answers

Deleting a comment or a reply took every reply to it, locked or not: only
the target's own Locked flag was checked. A locked reply can't be deleted
on its own, so delete_annotation now refuses while anything that would go
with the target is locked (pop-ups follow their comment).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/annot/src/modify.rs   | 10 ++++++++++
 crates/annot/src/tests.rs    | 19 +++++++++++++++++++
 parity/acrobat-features.toml |  4 ++--
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/crates/annot/src/modify.rs b/crates/annot/src/modify.rs
index fc81348075..92807babd0 100644
--- a/crates/annot/src/modify.rs
+++ b/crates/annot/src/modify.rs
@@ -80,6 +80,16 @@ pub fn delete_annotation(doc: &mut Document, page: usize, index: usize) -> Resul
     // An inline comment has no reference to collect; the pop-up it names still goes.
     let seed = target.as_ref().or_else(|| target.as_dict().and_then(|d| d.reference(b"Popup")));
     let doomed = with_replies_and_popups(doc, &list, seed);
+    // A locked reply can't be deleted on its own, so it doesn't go with the comment or reply it
+    // answers either. Pop-ups follow their comment.
+    for (_, e) in list.iter().enumerate().filter(|(i, e)| *i != index && goes_with(e, &doomed)) {
+        let obj = doc.resolve(e);
+        if let Some(d) = obj.as_dict().filter(|d| d.name(b"Subtype") != Some(b"Popup".as_slice()))
+            && annotation_flags(doc, d) & FLAG_LOCKED != 0
+        {
+            return Err(AnnotError::Invalid("a reply to it is locked".into()));
+        }
+    }
     let kept: Vec<Object> = list.into_iter().enumerate().filter(|(i, e)| *i != index && !goes_with(e, &doomed)).map(|(_, e)| e).collect();
     Ok(set_annots(doc, p, kept)?)
 }
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index eb8d1a0f15..d1e2f97e89 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -229,6 +229,25 @@ fn delete_takes_popup_and_reply_chain() {
     assert_eq!(delete_annotation(&mut doc, 0, 9), Err(AnnotError::NoSuchAnnotation { page: 0, index: 9 }));
 }
 
+/// A locked reply can't be deleted, so it doesn't go with what it answers either: deleting the
+/// reply above it, or the comment, is refused and changes nothing; once it is unlocked they go.
+#[test]
+fn a_locked_reply_keeps_what_it_answers() {
+    let mut doc = fixture();
+    let note = add_annotation(&mut doc, &new(0, Shape::Note { at: [100.0, 100.0], icon: NoteIcon::Comment }), &meta("n")).unwrap();
+    let reply = add_reply(&mut doc, 0, note, "first", "Bob", &meta("r1")).unwrap();
+    let answer = add_reply(&mut doc, 0, reply, "locked answer", "Ada", &meta("r2")).unwrap();
+    set_locked(&mut doc, 0, answer, true).unwrap();
+    let before = list(&doc, 0).len();
+    assert_eq!(delete_annotation(&mut doc, 0, reply), Err(AnnotError::Invalid("a reply to it is locked".into())));
+    assert_eq!(delete_annotation(&mut doc, 0, note), Err(AnnotError::Invalid("a reply to it is locked".into())));
+    assert_eq!(list(&doc, 0).len(), before, "nothing went");
+    set_locked(&mut doc, 0, answer, false).unwrap();
+    delete_annotation(&mut doc, 0, reply).unwrap();
+    let left: Vec<String> = list(&doc, 0).iter().map(|d| text(d, b"Contents")).collect();
+    assert!(!left.iter().any(|t| t == "first" || t == "locked answer"), "the reply and its answer went: {left:?}");
+}
+
 /// A reply or pop-up written inline in `/Annots` (a file can, though the standard asks for
 /// references) goes with the comment it points at, and so does a pop-up an inline reply or an
 /// inline comment names. An unrelated inline comment stays until it is deleted itself.
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 1d15a25afe..760fa0a338 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4003,8 +4003,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_delete"]
-evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies"]
-notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted."
+evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies", "crates/annot/src/tests.rs::a_locked_reply_keeps_what_it_answers"]
+notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted, nor the comment or reply it answers while it is locked."
 
 [[feature]]
 id = "comment.keyboard-nudge"

From 28a31aebc025bf728f8487b16d214f699dca5e8a Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Wed, 28 Oct 2026 12:33:14 +0100
Subject: [PATCH 092/270] fix(comments): previews lift a stamp whatever its
 replies' locks; Delete greys out over a locked reply

The locked-reply check in delete_annotation also reached stamp_preview
and signature_image, which only take the annotation off a copy to draw
the page beneath it: an unlocked stamp with a locked reply lost its drag
preview. They now use lift_annotation, which checks no locks.

The Comments panel's Delete (comment and reply menus) and the page's
context menu are greyed out while a reply below is locked
(comments::locked_below), rather than refusing after the click.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/annot/src/lib.rs                     |  4 +-
 crates/annot/src/modify.rs                  | 28 ++++++++++----
 crates/annot/src/tests.rs                   |  4 ++
 crates/engine/src/signature_image.rs        |  2 +-
 crates/engine/src/stamp_preview.rs          |  2 +-
 crates/engine/src/tests.rs                  | 18 +++++++++
 crates/ui-egui/src/panels/comments_panel.rs | 18 ++++++---
 crates/ui-egui/src/tools/comments.rs        |  2 +-
 crates/ui-egui/src/tools/comments/menu.rs   |  5 ++-
 crates/ui-egui/src/tools/comments/state.rs  | 41 ++++++++++++++-------
 crates/ui-egui/src/tools/comments/tests.rs  | 19 ++++++++++
 crates/ui-egui/tests/it/comments.rs         |  7 ++++
 parity/acrobat-features.toml                |  4 +-
 13 files changed, 120 insertions(+), 34 deletions(-)

diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index e9e0359ce0..ae7e5a8727 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -36,8 +36,8 @@ use lookup::{annots, page_ref};
 pub use lookup::{has_visible_fill_sign, is_fill_sign, isolate_annotation, page_refs, picture_rotation, set_annots, signature_image};
 pub(crate) use modify::n;
 pub use modify::{
-    add_reply, add_text_replacement, delete_annotation, erase_ink, fillable, goes_with, move_annotation, set_contents, set_fill, set_font_size,
-    set_locked, set_marked, set_points, set_rect, set_review_state, set_style, with_replies_and_popups,
+    add_reply, add_text_replacement, delete_annotation, erase_ink, fillable, goes_with, lift_annotation, move_annotation, set_contents, set_fill,
+    set_font_size, set_locked, set_marked, set_points, set_rect, set_review_state, set_style, with_replies_and_popups,
 };
 pub use types::{
     AttachIcon, FillMark, LineEnding, Markup, Meta, NOTE_SIZE, NewAnnotation, NoteIcon, OverlayFont, OverlayLook, ReviewState, Rgb, Shape,
diff --git a/crates/annot/src/modify.rs b/crates/annot/src/modify.rs
index 92807babd0..8204e65107 100644
--- a/crates/annot/src/modify.rs
+++ b/crates/annot/src/modify.rs
@@ -70,11 +70,23 @@ pub(crate) fn touch(d: &mut Dict, meta: &Meta) {
 }
 
 /// Delete a comment together with its pop-up and its replies (and theirs), as Acrobat does.
+/// Refused while it, or a reply that would go with it, is locked.
 pub fn delete_annotation(doc: &mut Document, page: usize, index: usize) -> Result<(), AnnotError> {
+    remove_with_replies(doc, page, index, true)
+}
+
+/// Take the annotation at `(page, index)` out of its page with its pop-up and replies, as
+/// [`delete_annotation`] does but whatever their locks: for drawing the page beneath it on a
+/// copy of the document (a stamp or signature being dragged), which changes nothing.
+pub fn lift_annotation(doc: &mut Document, page: usize, index: usize) -> Result<(), AnnotError> {
+    remove_with_replies(doc, page, index, false)
+}
+
+fn remove_with_replies(doc: &mut Document, page: usize, index: usize, check_locks: bool) -> Result<(), AnnotError> {
     let p = page_ref(doc, page)?;
     let list = annots(doc, p);
     let target = list.get(index).cloned().ok_or(AnnotError::NoSuchAnnotation { page, index })?;
-    if let Some(r) = target.as_ref() {
+    if check_locks && let Some(r) = target.as_ref() {
         unlocked(doc, r)?;
     }
     // An inline comment has no reference to collect; the pop-up it names still goes.
@@ -82,12 +94,14 @@ pub fn delete_annotation(doc: &mut Document, page: usize, index: usize) -> Resul
     let doomed = with_replies_and_popups(doc, &list, seed);
     // A locked reply can't be deleted on its own, so it doesn't go with the comment or reply it
     // answers either. Pop-ups follow their comment.
-    for (_, e) in list.iter().enumerate().filter(|(i, e)| *i != index && goes_with(e, &doomed)) {
-        let obj = doc.resolve(e);
-        if let Some(d) = obj.as_dict().filter(|d| d.name(b"Subtype") != Some(b"Popup".as_slice()))
-            && annotation_flags(doc, d) & FLAG_LOCKED != 0
-        {
-            return Err(AnnotError::Invalid("a reply to it is locked".into()));
+    if check_locks {
+        for (_, e) in list.iter().enumerate().filter(|(i, e)| *i != index && goes_with(e, &doomed)) {
+            let obj = doc.resolve(e);
+            if let Some(d) = obj.as_dict().filter(|d| d.name(b"Subtype") != Some(b"Popup".as_slice()))
+                && annotation_flags(doc, d) & FLAG_LOCKED != 0
+            {
+                return Err(AnnotError::Invalid("a reply to it is locked".into()));
+            }
         }
     }
     let kept: Vec<Object> = list.into_iter().enumerate().filter(|(i, e)| *i != index && !goes_with(e, &doomed)).map(|(_, e)| e).collect();
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index d1e2f97e89..f9992a949e 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -242,6 +242,10 @@ fn a_locked_reply_keeps_what_it_answers() {
     assert_eq!(delete_annotation(&mut doc, 0, reply), Err(AnnotError::Invalid("a reply to it is locked".into())));
     assert_eq!(delete_annotation(&mut doc, 0, note), Err(AnnotError::Invalid("a reply to it is locked".into())));
     assert_eq!(list(&doc, 0).len(), before, "nothing went");
+    // Lifted on a copy, to draw the page beneath, the locks don't count.
+    let mut copy = doc.clone();
+    lift_annotation(&mut copy, 0, note).unwrap();
+    assert!(list(&copy, 0).len() < before, "the thread is lifted off the copy");
     set_locked(&mut doc, 0, answer, false).unwrap();
     delete_annotation(&mut doc, 0, reply).unwrap();
     let left: Vec<String> = list(&doc, 0).iter().map(|d| text(d, b"Contents")).collect();
diff --git a/crates/engine/src/signature_image.rs b/crates/engine/src/signature_image.rs
index daff674c19..ae8842ddfb 100644
--- a/crates/engine/src/signature_image.rs
+++ b/crates/engine/src/signature_image.rs
@@ -61,7 +61,7 @@ impl Document {
                 pdfcraft_annot::props(&editor.cos, page, index).map(|p| p.opacity).filter(|v| v.is_finite()).unwrap_or(1.0).clamp(0.0, 1.0) as f32;
             let turn = pdfcraft_annot::picture_rotation(&editor.cos, page, index).map_err(|e| e.to_string())?;
             let mut cos = editor.cos.clone();
-            pdfcraft_annot::delete_annotation(&mut cos, page, index).map_err(|e| e.to_string())?;
+            pdfcraft_annot::lift_annotation(&mut cos, page, index).map_err(|e| e.to_string())?;
             let bytes = Arc::new(pdfcraft_cos::write_incremental(&cos, &pdfcraft_cos::SaveOptions::default()).map_err(|e| e.to_string())?);
             Ok(Some(ImageSignaturePreview { image, opacity, turn, page, bytes, config: self.config.clone() }))
         })?
diff --git a/crates/engine/src/stamp_preview.rs b/crates/engine/src/stamp_preview.rs
index 6e5758a7ce..d52496cdcd 100644
--- a/crates/engine/src/stamp_preview.rs
+++ b/crates/engine/src/stamp_preview.rs
@@ -73,7 +73,7 @@ impl Document {
                 return Ok(None);
             }
             let mut background = editor.cos.clone();
-            pdfcraft_annot::delete_annotation(&mut background, page, index).map_err(|e| e.to_string())?;
+            pdfcraft_annot::lift_annotation(&mut background, page, index).map_err(|e| e.to_string())?;
             // The page beneath as it is displayed: comments without an appearance get theirs.
             let background = pdfcraft_annot::with_missing_appearances(&background).unwrap_or(background);
             let write = |cos: &pdfcraft_cos::Document| write_incremental(cos, &SaveOptions::default()).map(Arc::new).map_err(|e| e.to_string());
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 14a61b2633..31b426992c 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -3245,6 +3245,24 @@ fn comment_text(s: &Session, id: DocId) -> Vec<String> {
     t
 }
 
+/// A stamp whose reply is locked can still be dragged, so its layers are still prepared: the page
+/// beneath is drawn on a copy, where locks don't count. Deleting the stamp is what they refuse.
+#[test]
+fn a_stamp_with_a_locked_reply_still_has_its_drag_layers() {
+    let (mut s, id) = session_with(1);
+    s.apply(id, fill_item(Shape::Mark { rect: [30.0, 60.0, 130.0, 66.0], mark: FillMark::Line }, "")).unwrap();
+    s.apply(id, Edit::ReplyToAnnotation { page: 0, index: 0, text: "Approved".into(), author: "Bob".into() }).unwrap();
+    let reply = s.get(id).unwrap().info.annotations.iter().find(|a| a.parent == Some((0, 0))).expect("the reply").index;
+    s.apply(id, Edit::LockAnnotation { page: 0, index: reply, locked: true }).unwrap();
+    let doc = s.get(id).unwrap();
+    let background = doc.stamp_preview(0, 0).unwrap().expect("the line is a stamp").render_background(1.0).unwrap();
+    let px = |p: &pdfcraft_render::RenderedPage, x: u32, y: u32| -> [u8; 4] {
+        p.rgba[(((300 - y) * p.width + x) * 4) as usize..][..4].try_into().unwrap()
+    };
+    assert!((30..=130).all(|x| px(&background, x, 63) == [255, 255, 255, 255]), "the page beneath has no line");
+    assert!(s.apply(id, Edit::DeleteAnnotation { page: 0, index: 0 }).is_err(), "the locked reply keeps the stamp");
+}
+
 /// A dragged stamp's layers: the page without it (its text and other comments kept) and the
 /// stamp alone on a transparent page. Preparing them changes nothing in the document.
 #[test]
diff --git a/crates/ui-egui/src/panels/comments_panel.rs b/crates/ui-egui/src/panels/comments_panel.rs
index 5a1b736f63..9d49a68c0b 100644
--- a/crates/ui-egui/src/panels/comments_panel.rs
+++ b/crates/ui-egui/src/panels/comments_panel.rs
@@ -405,7 +405,7 @@ fn card(ui: &mut egui::Ui, view: &mut DocView, context: CardContext<'_>) -> Opti
                             if selected && allowed && !r.grouped {
                                 ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
                                     let more = icons::button(ui, "ellipsis", 20.0, false, tl!("Options for this reply"));
-                                    if let Some(e) = reply_menu(ui, view, r, &more) {
+                                    if let Some(e) = reply_menu(ui, view, r, info, &more) {
                                         edit = Some(e);
                                     }
                                 });
@@ -524,7 +524,11 @@ fn card(ui: &mut egui::Ui, view: &mut DocView, context: CardContext<'_>) -> Opti
                 ui.close();
             }
             ui.separator();
-            if ui.add_enabled(!a.locked, egui::Button::new(tl!("Delete"))).clicked() {
+            // A locked reply can't be deleted, so it keeps the comment it answers too.
+            if ui
+                .add_enabled(!a.locked && !crate::comments::locked_below(&info.annotations, (a.page, a.index)), egui::Button::new(tl!("Delete")))
+                .clicked()
+            {
                 view.comments.selected = None;
                 edit = Some(Edit::DeleteAnnotation { page: a.page, index: a.index });
                 ui.close();
@@ -562,7 +566,7 @@ fn inline_editor(ui: &mut egui::Ui, t: &Tokens, view: &mut DocView, key: (usize,
 /// the reply alone, with what hangs off it (its own replies, status changes and pop-up), as
 /// deleting a comment takes its thread; the comment and its other replies stay. Returns the
 /// edit to apply.
-fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, more: &egui::Response) -> Option<Edit> {
+fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, info: &DocInfo, more: &egui::Response) -> Option<Edit> {
     let mut edit = None;
     let menu_id = ui.scope_id().with(("reply-menu", r.page, r.index));
     if more.clicked() {
@@ -583,8 +587,12 @@ fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, more: &egui::Re
                 ui.close();
             }
             ui.separator();
-            // The card stays selected: the app finds its comment again after the delete.
-            if ui.add_enabled(!r.locked, egui::Button::new(tl!("Delete"))).clicked() {
+            // The card stays selected: the app finds its comment again after the delete. A locked
+            // reply to this one keeps it.
+            if ui
+                .add_enabled(!r.locked && !crate::comments::locked_below(&info.annotations, (r.page, r.index)), egui::Button::new(tl!("Delete")))
+                .clicked()
+            {
                 edit = Some(Edit::DeleteAnnotation { page: r.page, index: r.index });
                 ui.close();
             }
diff --git a/crates/ui-egui/src/tools/comments.rs b/crates/ui-egui/src/tools/comments.rs
index 6f3c074427..d86a0d58d2 100644
--- a/crates/ui-egui/src/tools/comments.rs
+++ b/crates/ui-egui/src/tools/comments.rs
@@ -47,7 +47,7 @@ use paint::{changing_points, drawn_shape, edited_in_view};
 use state::after_delete;
 use state::login_name;
 pub use state::{CommentView, Composer, ComposerKind, Gesture, SortBy};
-pub(crate) use state::{EditorFocus, PageCx};
+pub(crate) use state::{EditorFocus, PageCx, locked_below};
 
 /// Acrobat's selection blue for annotation frames and handles (11-visual-spec §5).
 const SELECT_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
diff --git a/crates/ui-egui/src/tools/comments/menu.rs b/crates/ui-egui/src/tools/comments/menu.rs
index d3de66a4e7..0ce50e5077 100644
--- a/crates/ui-egui/src/tools/comments/menu.rs
+++ b/crates/ui-egui/src/tools/comments/menu.rs
@@ -1,5 +1,5 @@
 use super::paint::edit_anchor;
-use super::state::{Composer, ComposerKind};
+use super::state::{Composer, ComposerKind, locked_below};
 use super::{
     Annotation, Color32, CommentPrefs, CommentTool, DocInfo, DocView, Edit, Rect, ReviewState, Rgb, SELECT_BLUE, SWATCHES, Sense, Stroke, color32,
     icons, theme, tool_for, vec2,
@@ -89,7 +89,8 @@ pub(crate) fn context_menu(
                 ui.close();
             }
             ui.separator();
-            if ui.add_enabled(allowed && !a.locked, egui::Button::new(tl!("Delete"))).clicked() {
+            // A locked reply can't be deleted, so it keeps the comment it answers too.
+            if ui.add_enabled(allowed && !a.locked && !locked_below(&info.annotations, (page, index)), egui::Button::new(tl!("Delete"))).clicked() {
                 view.comments.selected = None;
                 action = Some(CanvasAction::Edit(Box::new(Edit::DeleteAnnotation { page, index })));
                 ui.close();
diff --git a/crates/ui-egui/src/tools/comments/state.rs b/crates/ui-egui/src/tools/comments/state.rs
index c405422481..c9ca91fb01 100644
--- a/crates/ui-egui/src/tools/comments/state.rs
+++ b/crates/ui-egui/src/tools/comments/state.rs
@@ -245,19 +245,7 @@ pub(super) fn after_delete(before: &[Annotation], after: &[Annotation], gone: (u
         return Some(keep);
     }
     let (old, new) = (on_page(before, gone.0), on_page(after, gone.0));
-    // Only replies on the page go with it: `/IRT` is followed through the page's `/Annots`.
-    let parents: HashMap<usize, usize> = old.iter().filter_map(|a| a.parent.filter(|p| p.0 == gone.0).map(|p| (a.index, p.1))).collect();
-    let goes = |mut i: usize| {
-        // `link_replies` settles every chain within 64 steps.
-        for _ in 0..=64 {
-            if i == gone.1 {
-                return true;
-            }
-            let Some(&up) = parents.get(&i) else { return false };
-            i = up;
-        }
-        false
-    };
+    let goes = in_thread(&old, gone);
     let stays: Vec<&Annotation> = old.iter().copied().filter(|a| !goes(a.index)).collect();
     if stays.len() != new.len() {
         return None;
@@ -268,6 +256,33 @@ pub(super) fn after_delete(before: &[Annotation], after: &[Annotation], gone: (u
     same.then_some((now.page, now.index))
 }
 
+/// Whether the annotation at an index on `top`'s page is `top` or a reply to it at any depth:
+/// what deleting `top` takes along. `page` is that page's listed annotations. Only replies on the
+/// page go with it (`pdfcraft_annot::delete_annotation` follows `/IRT` through the page's
+/// `/Annots`).
+fn in_thread(page: &[&Annotation], top: (usize, usize)) -> impl Fn(usize) -> bool {
+    let parents: HashMap<usize, usize> = page.iter().filter_map(|a| a.parent.filter(|p| p.0 == top.0).map(|p| (a.index, p.1))).collect();
+    move |mut i: usize| {
+        // `link_replies` settles every chain within 64 steps.
+        for _ in 0..=64 {
+            if i == top.1 {
+                return true;
+            }
+            let Some(&up) = parents.get(&i) else { return false };
+            i = up;
+        }
+        false
+    }
+}
+
+/// Whether a reply to the annotation at `top`, at any depth, is locked: deleting it is refused
+/// then, as the reply can't be deleted.
+pub(crate) fn locked_below(annotations: &[Annotation], top: (usize, usize)) -> bool {
+    let page = on_page(annotations, top.0);
+    let goes = in_thread(&page, top);
+    page.iter().any(|a| a.index != top.1 && a.locked && goes(a.index))
+}
+
 /// The annotations listed on `page`, in `/Annots` order.
 fn on_page(list: &[Annotation], page: usize) -> Vec<&Annotation> {
     let mut v: Vec<&Annotation> = list.iter().filter(|a| a.page == page).collect();
diff --git a/crates/ui-egui/src/tools/comments/tests.rs b/crates/ui-egui/src/tools/comments/tests.rs
index bf000539a5..36644bb445 100644
--- a/crates/ui-egui/src/tools/comments/tests.rs
+++ b/crates/ui-egui/src/tools/comments/tests.rs
@@ -90,6 +90,25 @@ fn listed(page: usize, index: usize, contents: &str, parent: Option<(usize, usiz
     }
 }
 
+/// A locked reply at any depth keeps what it answers, up its own chain only: its comment, the
+/// reply above it, but not a sibling reply or a comment on another page.
+#[test]
+fn a_locked_reply_keeps_the_replies_and_comment_above_it() {
+    let lock = |a: Annotation| Annotation { locked: true, ..a };
+    let list = vec![
+        listed(0, 0, "comment", None),
+        listed(0, 1, "A", Some((0, 0))),
+        lock(listed(0, 2, "to A, locked", Some((0, 1)))),
+        listed(0, 3, "B", Some((0, 0))),
+        listed(1, 0, "other page", None),
+    ];
+    assert!(locked_below(&list, (0, 0)), "the comment");
+    assert!(locked_below(&list, (0, 1)), "the reply above the locked one");
+    assert!(!locked_below(&list, (0, 2)), "the locked reply itself: its own lock says so");
+    assert!(!locked_below(&list, (0, 3)), "a sibling reply");
+    assert!(!locked_below(&list, (1, 0)), "another page");
+}
+
 /// What stays selected or open in the editor after a delete is found where it moved to: the
 /// reply's own replies go with it (pop-ups, unlisted, are gone too), and a page that lost
 /// something else, or whose annotation in that place reads differently, keeps nothing.
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index f8c26b59b8..2fcc2299d1 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -1411,6 +1411,13 @@ fn one_reply_is_deleted_from_its_menu_and_the_thread_stays() {
     h.run_steps(3);
     assert_eq!(texts(&h), ["The comment", "Right reply, reworded", "Accepted set by Ben"]);
 
+    // The locked reply keeps its comment too: deleting the comment would take it along.
+    h.get_by_label("More").click();
+    h.run_steps(2);
+    assert!(h.get_by_label("Delete").accesskit_node().is_disabled(), "the comment of a locked reply isn't deleted");
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+
     h.state_mut().undo();
     h.run_steps(2);
     h.state_mut().undo();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 760fa0a338..c4670a584b 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4003,8 +4003,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_delete"]
-evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies", "crates/annot/src/tests.rs::a_locked_reply_keeps_what_it_answers"]
-notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted, nor the comment or reply it answers while it is locked."
+evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies", "crates/annot/src/tests.rs::a_locked_reply_keeps_what_it_answers", "crates/ui-egui/src/tools/comments/tests.rs::a_locked_reply_keeps_the_replies_and_comment_above_it", "crates/engine/src/tests.rs::a_stamp_with_a_locked_reply_still_has_its_drag_layers"]
+notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted, nor the comment or reply it answers while it is locked (their Delete is greyed out; a stamp or signature with a locked reply still drags with its live preview)."
 
 [[feature]]
 id = "comment.keyboard-nudge"

From 6a1783599dbf1cca8c4912993f8b83745eed78c1 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Wed, 28 Oct 2026 13:09:59 +0100
Subject: [PATCH 093/270] fix(comments): Delete asks the engine whether it
 would delete

The menus greyed Delete out from the listing's reply links while the
engine refused on the PDF's own /IRT and /Parent links, so the two could
disagree. pdfcraft_annot::deletable is now the one check: delete_annotation
runs it, and Document::annotation_deletable gives the Comments panel and
the page's context menu the same answer before they offer Delete.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/annot/src/lib.rs                     |  4 +-
 crates/annot/src/modify.rs                  | 59 ++++++++++++---------
 crates/annot/src/tests.rs                   |  5 ++
 crates/engine/src/document.rs               |  7 +++
 crates/ui-egui/src/canvas.rs                |  3 +-
 crates/ui-egui/src/panels/comments_panel.rs | 24 ++++-----
 crates/ui-egui/src/panels/right.rs          |  2 +-
 crates/ui-egui/src/tools/comments.rs        |  2 +-
 crates/ui-egui/src/tools/comments/menu.rs   |  9 ++--
 crates/ui-egui/src/tools/comments/state.rs  |  8 ---
 crates/ui-egui/src/tools/comments/tests.rs  | 21 +-------
 parity/acrobat-features.toml                |  2 +-
 12 files changed, 70 insertions(+), 76 deletions(-)

diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index ae7e5a8727..f51c645148 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -36,8 +36,8 @@ use lookup::{annots, page_ref};
 pub use lookup::{has_visible_fill_sign, is_fill_sign, isolate_annotation, page_refs, picture_rotation, set_annots, signature_image};
 pub(crate) use modify::n;
 pub use modify::{
-    add_reply, add_text_replacement, delete_annotation, erase_ink, fillable, goes_with, lift_annotation, move_annotation, set_contents, set_fill,
-    set_font_size, set_locked, set_marked, set_points, set_rect, set_review_state, set_style, with_replies_and_popups,
+    add_reply, add_text_replacement, deletable, delete_annotation, erase_ink, fillable, goes_with, lift_annotation, move_annotation, set_contents,
+    set_fill, set_font_size, set_locked, set_marked, set_points, set_rect, set_review_state, set_style, with_replies_and_popups,
 };
 pub use types::{
     AttachIcon, FillMark, LineEnding, Markup, Meta, NOTE_SIZE, NewAnnotation, NoteIcon, OverlayFont, OverlayLook, ReviewState, Rgb, Shape,
diff --git a/crates/annot/src/modify.rs b/crates/annot/src/modify.rs
index 8204e65107..2e3ae0b7d0 100644
--- a/crates/annot/src/modify.rs
+++ b/crates/annot/src/modify.rs
@@ -72,42 +72,51 @@ pub(crate) fn touch(d: &mut Dict, meta: &Meta) {
 /// Delete a comment together with its pop-up and its replies (and theirs), as Acrobat does.
 /// Refused while it, or a reply that would go with it, is locked.
 pub fn delete_annotation(doc: &mut Document, page: usize, index: usize) -> Result<(), AnnotError> {
-    remove_with_replies(doc, page, index, true)
+    deletable(doc, page, index)?;
+    lift_annotation(doc, page, index)
+}
+
+/// Whether [`delete_annotation`] deletes the annotation at `(page, index)`, or why not, without
+/// changing anything: what a Delete command asks before it is offered. It is refused while the
+/// annotation is locked, or a reply that would go with it is.
+pub fn deletable(doc: &Document, page: usize, index: usize) -> Result<(), AnnotError> {
+    let list = annots(doc, page_ref(doc, page)?);
+    let target = list.get(index).ok_or(AnnotError::NoSuchAnnotation { page, index })?;
+    if let Some(r) = target.as_ref() {
+        unlocked(doc, r)?;
+    }
+    let doomed = with_replies_and_popups(doc, &list, seed(target));
+    // A locked reply can't be deleted on its own, so it doesn't go with the comment or reply it
+    // answers either. Pop-ups follow their comment.
+    for (_, e) in list.iter().enumerate().filter(|(i, e)| *i != index && goes_with(e, &doomed)) {
+        let obj = doc.resolve(e);
+        if let Some(d) = obj.as_dict().filter(|d| d.name(b"Subtype") != Some(b"Popup".as_slice()))
+            && annotation_flags(doc, d) & FLAG_LOCKED != 0
+        {
+            return Err(AnnotError::Invalid("a reply to it is locked".into()));
+        }
+    }
+    Ok(())
 }
 
 /// Take the annotation at `(page, index)` out of its page with its pop-up and replies, as
 /// [`delete_annotation`] does but whatever their locks: for drawing the page beneath it on a
 /// copy of the document (a stamp or signature being dragged), which changes nothing.
 pub fn lift_annotation(doc: &mut Document, page: usize, index: usize) -> Result<(), AnnotError> {
-    remove_with_replies(doc, page, index, false)
-}
-
-fn remove_with_replies(doc: &mut Document, page: usize, index: usize, check_locks: bool) -> Result<(), AnnotError> {
     let p = page_ref(doc, page)?;
     let list = annots(doc, p);
-    let target = list.get(index).cloned().ok_or(AnnotError::NoSuchAnnotation { page, index })?;
-    if check_locks && let Some(r) = target.as_ref() {
-        unlocked(doc, r)?;
-    }
-    // An inline comment has no reference to collect; the pop-up it names still goes.
-    let seed = target.as_ref().or_else(|| target.as_dict().and_then(|d| d.reference(b"Popup")));
-    let doomed = with_replies_and_popups(doc, &list, seed);
-    // A locked reply can't be deleted on its own, so it doesn't go with the comment or reply it
-    // answers either. Pop-ups follow their comment.
-    if check_locks {
-        for (_, e) in list.iter().enumerate().filter(|(i, e)| *i != index && goes_with(e, &doomed)) {
-            let obj = doc.resolve(e);
-            if let Some(d) = obj.as_dict().filter(|d| d.name(b"Subtype") != Some(b"Popup".as_slice()))
-                && annotation_flags(doc, d) & FLAG_LOCKED != 0
-            {
-                return Err(AnnotError::Invalid("a reply to it is locked".into()));
-            }
-        }
-    }
-    let kept: Vec<Object> = list.into_iter().enumerate().filter(|(i, e)| *i != index && !goes_with(e, &doomed)).map(|(_, e)| e).collect();
+    let target = list.get(index).ok_or(AnnotError::NoSuchAnnotation { page, index })?;
+    let doomed = with_replies_and_popups(doc, &list, seed(target));
+    let kept: Vec<Object> = list.iter().enumerate().filter(|(i, e)| *i != index && !goes_with(e, &doomed)).map(|(_, e)| e.clone()).collect();
     Ok(set_annots(doc, p, kept)?)
 }
 
+/// What deleting the `/Annots` entry `target` starts from: its reference, or for an inline
+/// comment (which has none to collect) the pop-up it names, which still goes.
+fn seed(target: &Object) -> Option<ObjRef> {
+    target.as_ref().or_else(|| target.as_dict().and_then(|d| d.reference(b"Popup")))
+}
+
 /// Whether the `/Annots` entry `entry` goes with `going` (from [`with_replies_and_popups`]): it is
 /// one of them, or it is written inline (a file can, though the standard asks for references) and
 /// replies to (`/IRT`) or pops up for (`/Parent`) one of them. An inline entry has no reference
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index f9992a949e..a3dc14e262 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -242,11 +242,16 @@ fn a_locked_reply_keeps_what_it_answers() {
     assert_eq!(delete_annotation(&mut doc, 0, reply), Err(AnnotError::Invalid("a reply to it is locked".into())));
     assert_eq!(delete_annotation(&mut doc, 0, note), Err(AnnotError::Invalid("a reply to it is locked".into())));
     assert_eq!(list(&doc, 0).len(), before, "nothing went");
+    // Asked first, read-only, as a Delete command does: the same answer, and the answer's own
+    // lock is its own.
+    assert_eq!(deletable(&doc, 0, note), Err(AnnotError::Invalid("a reply to it is locked".into())));
+    assert_eq!(deletable(&doc, 0, answer), Err(AnnotError::Invalid("the comment is locked".into())));
     // Lifted on a copy, to draw the page beneath, the locks don't count.
     let mut copy = doc.clone();
     lift_annotation(&mut copy, 0, note).unwrap();
     assert!(list(&copy, 0).len() < before, "the thread is lifted off the copy");
     set_locked(&mut doc, 0, answer, false).unwrap();
+    assert_eq!(deletable(&doc, 0, reply), Ok(()));
     delete_annotation(&mut doc, 0, reply).unwrap();
     let left: Vec<String> = list(&doc, 0).iter().map(|d| text(d, b"Contents")).collect();
     assert!(!left.iter().any(|t| t == "first" || t == "locked answer"), "the reply and its answer went: {left:?}");
diff --git a/crates/engine/src/document.rs b/crates/engine/src/document.rs
index 7023caa55e..6220841f3f 100644
--- a/crates/engine/src/document.rs
+++ b/crates/engine/src/document.rs
@@ -305,6 +305,13 @@ impl Document {
         self.config.hide_comments
     }
 
+    /// Whether `Edit::DeleteAnnotation` would delete the annotation at `(page, index)`: the
+    /// engine's own check (it, and every reply that would go with it, unlocked), for a Delete
+    /// command to ask before it is offered.
+    pub fn annotation_deletable(&self, page: usize, index: usize) -> bool {
+        self.editor.as_ref().is_some_and(|e| pdfcraft_annot::deletable(&e.cos, page, index).is_ok())
+    }
+
     pub fn can_undo(&self) -> Option<&str> {
         self.undo_label().map(Label::as_str)
     }
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index ea37eb0dfd..ae00e1edff 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -2074,7 +2074,8 @@ fn draw_pages(
                 ui.separator();
             }
         }
-        canvas_action = comments::context_menu(ui, view, info, prefs, allowed, can_modify).or(copy_image);
+        canvas_action =
+            comments::context_menu(ui, view, info, &|page, index| doc.annotation_deletable(page, index), prefs, allowed, can_modify).or(copy_image);
     });
     *out = PageOut {
         badge_hover,
diff --git a/crates/ui-egui/src/panels/comments_panel.rs b/crates/ui-egui/src/panels/comments_panel.rs
index 9d49a68c0b..c549ed8e3e 100644
--- a/crates/ui-egui/src/panels/comments_panel.rs
+++ b/crates/ui-egui/src/panels/comments_panel.rs
@@ -115,13 +115,14 @@ fn any_contains<'a>(fields: impl IntoIterator<Item = &'a str>, q: &str) -> bool
 pub(crate) fn show(
     ui: &mut egui::Ui,
     t: &Tokens,
-    info: &DocInfo,
+    doc: &pdfcraft_engine::Document,
     view: &mut DocView,
     prefs: &CommentPrefs,
     allowed: bool,
     nav: &mut Option<Nav>,
 ) -> Option<Edit> {
     crate::widgets::begin_dialog(ui);
+    let info = &doc.info;
     let mut edit = None;
     // Search (the header's magnifier toggles it).
     if let Some(q) = view.comments.search.as_mut() {
@@ -286,7 +287,7 @@ pub(crate) fn show(
         }
         let thread = replies_of(a);
         let rotation = info.pages.get(a.page).map_or(0, |p| p.rotation);
-        if let Some(e) = card(ui, view, CardContext { theme: t, annotation: a, rotation, thread, info, prefs, allowed, nav }) {
+        if let Some(e) = card(ui, view, CardContext { theme: t, annotation: a, rotation, thread, doc, prefs, allowed, nav }) {
             edit = Some(e);
         }
     }
@@ -301,14 +302,15 @@ struct CardContext<'a> {
     // The clockwise `/Rotate` of the comment's page.
     rotation: u16,
     thread: &'a [&'a Annotation],
-    info: &'a DocInfo,
+    doc: &'a pdfcraft_engine::Document,
     prefs: &'a CommentPrefs,
     allowed: bool,
     nav: &'a mut Option<Nav>,
 }
 
 fn card(ui: &mut egui::Ui, view: &mut DocView, context: CardContext<'_>) -> Option<Edit> {
-    let CardContext { theme: t, annotation: a, rotation, thread, info, prefs, allowed, nav } = context;
+    let CardContext { theme: t, annotation: a, rotation, thread, doc, prefs, allowed, nav } = context;
+    let info = &doc.info;
     let mut edit = None;
     let key = (a.page, a.index);
     let selected = view.comments.selected == Some(key);
@@ -405,7 +407,7 @@ fn card(ui: &mut egui::Ui, view: &mut DocView, context: CardContext<'_>) -> Opti
                             if selected && allowed && !r.grouped {
                                 ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
                                     let more = icons::button(ui, "ellipsis", 20.0, false, tl!("Options for this reply"));
-                                    if let Some(e) = reply_menu(ui, view, r, info, &more) {
+                                    if let Some(e) = reply_menu(ui, view, r, doc, &more) {
                                         edit = Some(e);
                                     }
                                 });
@@ -525,10 +527,7 @@ fn card(ui: &mut egui::Ui, view: &mut DocView, context: CardContext<'_>) -> Opti
             }
             ui.separator();
             // A locked reply can't be deleted, so it keeps the comment it answers too.
-            if ui
-                .add_enabled(!a.locked && !crate::comments::locked_below(&info.annotations, (a.page, a.index)), egui::Button::new(tl!("Delete")))
-                .clicked()
-            {
+            if ui.add_enabled(doc.annotation_deletable(a.page, a.index), egui::Button::new(tl!("Delete"))).clicked() {
                 view.comments.selected = None;
                 edit = Some(Edit::DeleteAnnotation { page: a.page, index: a.index });
                 ui.close();
@@ -566,7 +565,7 @@ fn inline_editor(ui: &mut egui::Ui, t: &Tokens, view: &mut DocView, key: (usize,
 /// the reply alone, with what hangs off it (its own replies, status changes and pop-up), as
 /// deleting a comment takes its thread; the comment and its other replies stay. Returns the
 /// edit to apply.
-fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, info: &DocInfo, more: &egui::Response) -> Option<Edit> {
+fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, doc: &pdfcraft_engine::Document, more: &egui::Response) -> Option<Edit> {
     let mut edit = None;
     let menu_id = ui.scope_id().with(("reply-menu", r.page, r.index));
     if more.clicked() {
@@ -589,10 +588,7 @@ fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, info: &DocInfo,
             ui.separator();
             // The card stays selected: the app finds its comment again after the delete. A locked
             // reply to this one keeps it.
-            if ui
-                .add_enabled(!r.locked && !crate::comments::locked_below(&info.annotations, (r.page, r.index)), egui::Button::new(tl!("Delete")))
-                .clicked()
-            {
+            if ui.add_enabled(doc.annotation_deletable(r.page, r.index), egui::Button::new(tl!("Delete"))).clicked() {
                 edit = Some(Edit::DeleteAnnotation { page: r.page, index: r.index });
                 ui.close();
             }
diff --git a/crates/ui-egui/src/panels/right.rs b/crates/ui-egui/src/panels/right.rs
index 0470543acb..a4bb7e62f8 100644
--- a/crates/ui-egui/src/panels/right.rs
+++ b/crates/ui-egui/src/panels/right.rs
@@ -178,7 +178,7 @@ pub fn right_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 }
                 egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| match panel {
                     RightPanel::Comments => {
-                        if let Some(e) = crate::comments_panel::show(ui, &t, info, view, prefs, comment_allowed, &mut nav) {
+                        if let Some(e) = crate::comments_panel::show(ui, &t, doc, view, prefs, comment_allowed, &mut nav) {
                             panel_edit = Some(e);
                         }
                     }
diff --git a/crates/ui-egui/src/tools/comments.rs b/crates/ui-egui/src/tools/comments.rs
index d86a0d58d2..6f3c074427 100644
--- a/crates/ui-egui/src/tools/comments.rs
+++ b/crates/ui-egui/src/tools/comments.rs
@@ -47,7 +47,7 @@ use paint::{changing_points, drawn_shape, edited_in_view};
 use state::after_delete;
 use state::login_name;
 pub use state::{CommentView, Composer, ComposerKind, Gesture, SortBy};
-pub(crate) use state::{EditorFocus, PageCx, locked_below};
+pub(crate) use state::{EditorFocus, PageCx};
 
 /// Acrobat's selection blue for annotation frames and handles (11-visual-spec §5).
 const SELECT_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
diff --git a/crates/ui-egui/src/tools/comments/menu.rs b/crates/ui-egui/src/tools/comments/menu.rs
index 0ce50e5077..52ea8d707d 100644
--- a/crates/ui-egui/src/tools/comments/menu.rs
+++ b/crates/ui-egui/src/tools/comments/menu.rs
@@ -1,5 +1,5 @@
 use super::paint::edit_anchor;
-use super::state::{Composer, ComposerKind, locked_below};
+use super::state::{Composer, ComposerKind};
 use super::{
     Annotation, Color32, CommentPrefs, CommentTool, DocInfo, DocView, Edit, Rect, ReviewState, Rgb, SELECT_BLUE, SWATCHES, Sense, Stroke, color32,
     icons, theme, tool_for, vec2,
@@ -24,10 +24,13 @@ pub(crate) fn attachment_items(ui: &mut egui::Ui, view: &mut DocView, info: &Doc
 
 /// Items of the canvas context menu for the selected comment (or the page).
 /// `can_modify`: the document's pages may change (Flatten comments draws into them).
+/// `deletable`: whether Delete would delete the comment at (page, index) (the engine's
+/// `Document::annotation_deletable`: unlocked, and no locked reply to it).
 pub(crate) fn context_menu(
     ui: &mut egui::Ui,
     view: &mut DocView,
     info: &DocInfo,
+    deletable: &dyn Fn(usize, usize) -> bool,
     prefs: &CommentPrefs,
     allowed: bool,
     can_modify: bool,
@@ -89,8 +92,8 @@ pub(crate) fn context_menu(
                 ui.close();
             }
             ui.separator();
-            // A locked reply can't be deleted, so it keeps the comment it answers too.
-            if ui.add_enabled(allowed && !a.locked && !locked_below(&info.annotations, (page, index)), egui::Button::new(tl!("Delete"))).clicked() {
+            // The engine's own check: a locked comment, or one with a locked reply, stays.
+            if ui.add_enabled(allowed && deletable(page, index), egui::Button::new(tl!("Delete"))).clicked() {
                 view.comments.selected = None;
                 action = Some(CanvasAction::Edit(Box::new(Edit::DeleteAnnotation { page, index })));
                 ui.close();
diff --git a/crates/ui-egui/src/tools/comments/state.rs b/crates/ui-egui/src/tools/comments/state.rs
index c9ca91fb01..db45041906 100644
--- a/crates/ui-egui/src/tools/comments/state.rs
+++ b/crates/ui-egui/src/tools/comments/state.rs
@@ -275,14 +275,6 @@ fn in_thread(page: &[&Annotation], top: (usize, usize)) -> impl Fn(usize) -> boo
     }
 }
 
-/// Whether a reply to the annotation at `top`, at any depth, is locked: deleting it is refused
-/// then, as the reply can't be deleted.
-pub(crate) fn locked_below(annotations: &[Annotation], top: (usize, usize)) -> bool {
-    let page = on_page(annotations, top.0);
-    let goes = in_thread(&page, top);
-    page.iter().any(|a| a.index != top.1 && a.locked && goes(a.index))
-}
-
 /// The annotations listed on `page`, in `/Annots` order.
 fn on_page(list: &[Annotation], page: usize) -> Vec<&Annotation> {
     let mut v: Vec<&Annotation> = list.iter().filter(|a| a.page == page).collect();
diff --git a/crates/ui-egui/src/tools/comments/tests.rs b/crates/ui-egui/src/tools/comments/tests.rs
index 36644bb445..2d6641f2d3 100644
--- a/crates/ui-egui/src/tools/comments/tests.rs
+++ b/crates/ui-egui/src/tools/comments/tests.rs
@@ -90,25 +90,6 @@ fn listed(page: usize, index: usize, contents: &str, parent: Option<(usize, usiz
     }
 }
 
-/// A locked reply at any depth keeps what it answers, up its own chain only: its comment, the
-/// reply above it, but not a sibling reply or a comment on another page.
-#[test]
-fn a_locked_reply_keeps_the_replies_and_comment_above_it() {
-    let lock = |a: Annotation| Annotation { locked: true, ..a };
-    let list = vec![
-        listed(0, 0, "comment", None),
-        listed(0, 1, "A", Some((0, 0))),
-        lock(listed(0, 2, "to A, locked", Some((0, 1)))),
-        listed(0, 3, "B", Some((0, 0))),
-        listed(1, 0, "other page", None),
-    ];
-    assert!(locked_below(&list, (0, 0)), "the comment");
-    assert!(locked_below(&list, (0, 1)), "the reply above the locked one");
-    assert!(!locked_below(&list, (0, 2)), "the locked reply itself: its own lock says so");
-    assert!(!locked_below(&list, (0, 3)), "a sibling reply");
-    assert!(!locked_below(&list, (1, 0)), "another page");
-}
-
 /// What stays selected or open in the editor after a delete is found where it moved to: the
 /// reply's own replies go with it (pop-ups, unlisted, are gone too), and a page that lost
 /// something else, or whose annotation in that place reads differently, keeps nothing.
@@ -371,7 +352,7 @@ fn context_menu_colour_submenu_keeps_its_picker_open_and_a_swatch_closes_the_men
     let mut h = egui_kittest::Harness::new_ui_state(
         |ui, (view, actions): &mut (DocView, Vec<CanvasAction>)| {
             ui.button("Page").context_menu(|ui| {
-                if let Some(a) = context_menu(ui, view, &info, &prefs, true, true) {
+                if let Some(a) = context_menu(ui, view, &info, &|_, _| true, &prefs, true, true) {
                     actions.push(a);
                 }
             });
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index c4670a584b..4f897b4897 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4003,7 +4003,7 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_delete"]
-evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies", "crates/annot/src/tests.rs::a_locked_reply_keeps_what_it_answers", "crates/ui-egui/src/tools/comments/tests.rs::a_locked_reply_keeps_the_replies_and_comment_above_it", "crates/engine/src/tests.rs::a_stamp_with_a_locked_reply_still_has_its_drag_layers"]
+evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies", "crates/annot/src/tests.rs::a_locked_reply_keeps_what_it_answers", "crates/engine/src/tests.rs::a_stamp_with_a_locked_reply_still_has_its_drag_layers"]
 notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted, nor the comment or reply it answers while it is locked (their Delete is greyed out; a stamp or signature with a locked reply still drags with its live preview)."
 
 [[feature]]

From 30ed249a280686903a0c7b541578de1f228cba5d Mon Sep 17 00:00:00 2001
From: Hamza <mail.hamzanaveed@gmail.com>
Date: Wed, 28 Oct 2026 19:32:00 +0500
Subject: [PATCH 094/270] Content streams: step over a malformed token instead
 of ending the page

A malformed token ended the content stream where it stood, so the renderer,
text extraction, Find and search-based redaction all lost the rest of the
page -- while the edit reader, MuPDF and pdftotext read it (#3565, #3568). A
redaction that cannot see the text below the bad token cannot remove it,
which is the part that matters.

Each malformed shape is stepped over instead: an unterminated string, a
number that is only a sign or a dot, a name with a bad hex escape, an
unbalanced dictionary or array. Content after an inline image whose data
holds `EI` is still read, under a bounded lookahead.

Rebased onto main, 1,898 commits on: the tokenizer is still
vendor/hayro-syntax/src/content/mod.rs and applied as it was, and render's
raster.rs is split, so the two tests went to render/raster/tests.rs.
---
 crates/render/src/raster/tests.rs      |  73 ++++++++++++++++
 vendor/hayro-syntax/src/content/mod.rs | 116 +++++++++++++++++++++----
 2 files changed, 174 insertions(+), 15 deletions(-)

diff --git a/crates/render/src/raster/tests.rs b/crates/render/src/raster/tests.rs
index 36299d74fd..696eaddb61 100644
--- a/crates/render/src/raster/tests.rs
+++ b/crates/render/src/raster/tests.rs
@@ -7035,3 +7035,76 @@ fn test_clip_only_text_raster_preserves_clipping_without_painting() {
     assert!(pixels.contains(&[0, 0, 255, 255]), "fill shows through the 7 Tr clip");
     assert!(pixels.contains(&white), "the clip is text-shaped, not the whole page");
 }
+
+/// A malformed token in a content stream used to end the stream there, so the renderer, text
+/// extraction, Find and search-based redaction lost the rest of the page while the edit
+/// reader, MuPDF and pdftotext read it (#3565, #3568). Each token below is now stepped over.
+#[test]
+fn a_malformed_token_does_not_end_the_content_stream() {
+    // One token between two text objects. `BEFORE` is drawn before it, `AFTER` after.
+    let page = |token: &str| {
+        let stream = format!("BT /F1 8 Tf 2 30 Td (BEFORE) Tj ET {token} BT /F1 8 Tf 2 10 Td (AFTER) Tj ET");
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 60 40] /Resources << /Font << /F1 5 0 R >> >> /Contents 4 0 R >> endobj\n5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", stream.len()).as_bytes());
+        pdf.extend_from_slice(stream.as_bytes());
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let text = renderer.render(RenderRequest { page: 0, kind: RequestKind::Text, ..Default::default() });
+        assert!(text.error.is_none(), "{token}: {:?}", text.error);
+        text.text.expect("a text layer").plain_text()
+    };
+
+    for token in [
+        // A `re` with three operands: the typed iterator used to abort on a path operator it
+        // could not dispatch, which is what #3568 reports.
+        "20 10 10 re",
+        // More operands than the limit (ISO 32000-2 Annex C gives 10): the instruction is
+        // dropped, not the stream.
+        "0 0 0 0 0 0 0 0 0 0 0 g",
+        // A stray delimiter: the lexer could not read an operator and jumped to the end.
+        ")",
+        // The same with no space after it. Stepping over the regular characters that follow a
+        // delimiter ate the next operator, so the page lost its second text object
+        // (#3636 review); only the delimiter is stepped over.
+        ")BT ET",
+        // A malformed `#` escape in a name, so neither an object nor an operator read.
+        "/C#2 gs",
+        // And the well-formed forms still work.
+        "20 10 10 5 re n",
+        "0.5 g",
+    ] {
+        let text = page(token);
+        assert!(text.contains("BEFORE"), "{token}: {text:?}");
+        assert!(text.contains("AFTER"), "{token}: the rest of the page was lost: {text:?}");
+        assert!(text.find("BEFORE") < text.find("AFTER"), "{token}: the page is read in order: {text:?}");
+    }
+}
+
+/// Content after an inline image whose data holds `EI` is still read. This pins the property
+/// but does **not** exercise the look-ahead gating added for #3636's review: accepting a false
+/// `EI` truncates the image, while the text after the real one is read either way, and this
+/// assertion passes with the gating removed. Showing the truncation needs valid ASCII85 data
+/// that contains `EI`, which this fixture does not have.
+#[test]
+fn content_after_an_inline_image_holding_ei_is_still_read() {
+    // An ASCII85 image whose data holds `EI\n`, then an `re` with three operands and twenty
+    // `q`s -- enough steps to satisfy the look-ahead's counter if the bad `re` were skipped --
+    // before the real `EI`. `AFTER` is drawn once the image is over.
+    let stream = b"q 100 0 0 100 10 10 cm BI /W 4 /H 4 /CS /G /BPC 8 /F /A85 ID EI
+20 10 10 re q q q q q q q q q q q q q q q q q q q q EI Q BT /F1 8 Tf 2 4 Td (AFTER) Tj ET"
+        .to_vec();
+    let mut pdf =
+        b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 120 120] /Resources << /Font << /F1 5 0 R >> >> /Contents 4 0 R >> endobj\n5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj\n"
+            .to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", stream.len()).as_bytes());
+    pdf.extend_from_slice(&stream);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+
+    let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+    let text = renderer.render(RenderRequest { page: 0, kind: RequestKind::Text, ..Default::default() });
+    assert!(text.error.is_none(), "{:?}", text.error);
+    let page = text.text.expect("a text layer").plain_text();
+    // The image ran to the real `EI`, so the text after it is the page's only text: the first
+    // `EI` inside the data was not taken for the end.
+    assert!(page.contains("AFTER"), "the content after the image was lost: {page:?}");
+}
diff --git a/vendor/hayro-syntax/src/content/mod.rs b/vendor/hayro-syntax/src/content/mod.rs
index e37044c5d7..33c0e5bd05 100644
--- a/vendor/hayro-syntax/src/content/mod.rs
+++ b/vendor/hayro-syntax/src/content/mod.rs
@@ -117,6 +117,15 @@ const MAX_EI_LOOKAHEAD_STEPS: u32 = 256;
 pub trait ContentTokenizer<'a> {
     /// Return the next instruction, or `None` after the content stream ends or becomes invalid.
     fn next_instruction<'b>(&'b mut self) -> Option<Instruction<'b, 'a>>;
+
+    /// PdfCraft patch: whether this tokenizer is only judging whether bytes read as content, as
+    /// the look-ahead past a candidate `EI` does. Such a pass must not recover from a malformed
+    /// token: its whole purpose is to find out whether the bytes are content, and answering
+    /// "yes, once the bad parts are skipped" of an inline image's data would cut the image at a
+    /// false `EI` (#3636 review).
+    fn judging_only(&self) -> bool {
+        false
+    }
 }
 
 /// An iterator over operators in the PDF content streams, providing raw access to the
@@ -181,6 +190,11 @@ impl<'a> UntypedIter<'a> {
             self.committed = self.skip_blanks_and_comments();
         }
 
+        // PdfCraft patch: set when this instruction carried more operands than the limit. Its
+        // operator is then dropped with them, rather than applied to the ones that did fit
+        // (#3568).
+        let mut overflowed = false;
+
         while !self.reader.at_end() {
             // I believe booleans/null never appear as an operator?
             if matches!(
@@ -198,14 +212,31 @@ impl<'a> UntypedIter<'a> {
                     if self.undecided() {
                         return None;
                     }
-                    self.stack.push(object)?;
+                    if self.stack.push(object).is_none() {
+                        overflowed = true;
+                    }
                 } else if self.reader.read_without_context::<Operator<'_>>().is_some() {
                     if self.undecided() {
                         return None;
                     }
                     self.stack.clear();
+                } else if self.undecided() {
+                    return None;
+                } else if !self.lookahead && self.reader.peek_byte() == Some(b'/') && self.skip_bad_token() {
+                    // PdfCraft patch: a name the lexer cannot read -- a malformed `#` escape, as
+                    // in `/C#2 gs` -- used to end the stream, losing the rest of the page. Step
+                    // over it and carry on, as the edit reader and other readers do (#3568).
+                    //
+                    // Only a name. An operand that is well formed but refused by a resource cap
+                    // (a dictionary nested past the limit) still ends the stream, which is what
+                    // `dictionaries_nested_without_keys_are_read_up_to_the_nesting_cap` in
+                    // pdfcraft's renderer asserts: reading on there would draw a page whose
+                    // content was deliberately not parsed.
+                    warn!("skipped an unreadable name in content stream");
+                    self.stack.clear();
+                    overflowed = false;
+                    continue;
                 } else {
-                    self.undecided();
                     return None;
                 }
             } else {
@@ -218,6 +249,14 @@ impl<'a> UntypedIter<'a> {
 
                         warn!("failed to read operator in content stream");
 
+                        // PdfCraft patch: a stray delimiter (`)`, say) ended the stream here, so
+                        // the rest of the page was lost. Step over it and carry on (#3568).
+                        if !self.lookahead && self.skip_bad_token() {
+                            self.stack.clear();
+                            overflowed = false;
+                            continue;
+                        }
+
                         self.reader.jump_to_end();
                         return None;
                     }
@@ -443,6 +482,17 @@ impl<'a> UntypedIter<'a> {
                     }
                 }
 
+                if overflowed && !self.lookahead {
+                    // PdfCraft patch: see `overflowed` above. ISO 32000-2 Annex C gives 10 as the
+                    // historical operand limit; past it the instruction is dropped whole.
+                    warn!("dropped an instruction with more operands than the limit");
+                    self.stack.clear();
+                    overflowed = false;
+                    self.committed = self.reader.offset();
+                    self.reader.skip_white_spaces_and_comments();
+                    continue;
+                }
+
                 self.operator = Some(operator);
                 self.committed = self.reader.offset();
                 // PdfCraft patch (28): operands in reading order, if some were dropped.
@@ -484,6 +534,36 @@ impl<'a> UntypedIter<'a> {
         open_comment.unwrap_or(self.reader.offset())
     }
 
+    /// PdfCraft patch: step over one token the lexer could not read, so the rest of the stream is
+    /// still read instead of the page ending there. A delimiter stands alone; anything else runs
+    /// to the next delimiter or space. At least one byte is always consumed when this returns
+    /// true, so the loop in `next` cannot spin (#3568).
+    fn skip_bad_token(&mut self) -> bool {
+        let before = self.reader.offset();
+        match self.reader.peek_byte() {
+            None => return false,
+            // Never step over a good token: called where the blanks after the last one have not
+            // been skipped yet, there is nothing bad here to skip. Skipping ` BT` cost the page
+            // its second text object while this was being written.
+            Some(b) if is_white_space_character(b) || b == b'%' => {}
+            // A name reads to the next delimiter, malformed escapes included.
+            Some(b'/') => {
+                let _ = skip_name_like(&mut self.reader, true);
+            }
+            // A token of regular characters runs to the next delimiter or space.
+            Some(b) if is_regular_character(b) => {
+                self.reader.forward_while(is_regular_character);
+            }
+            // A delimiter stands alone. Consuming what follows it would eat the next operator:
+            // `)BT` cost the page its second text object while this was being written
+            // (#3636 review).
+            Some(_) => self.reader.forward(),
+        }
+        // Land on the next token, as the end of the loop in `next` does.
+        self.reader.skip_white_spaces_and_comments();
+        self.reader.offset() > before
+    }
+
     /// PdfCraft patch: whether the instruction being read ran into the end of a window, so it
     /// cannot be decided yet. Records that more data is needed.
     fn undecided(&mut self) -> bool {
@@ -499,6 +579,10 @@ impl<'a> ContentTokenizer<'a> for UntypedIter<'a> {
     fn next_instruction<'b>(&'b mut self) -> Option<Instruction<'b, 'a>> {
         self.next()
     }
+
+    fn judging_only(&self) -> bool {
+        self.lookahead
+    }
 }
 
 
@@ -557,6 +641,8 @@ where
     /// Return the next typed instruction.
     #[allow(clippy::should_implement_trait)]
     pub fn next(&mut self) -> Option<TypedInstruction<'_, 'a>> {
+        // Read before the instruction borrows the tokenizer.
+        let judging = self.untyped.judging_only();
         let op = self.untyped.next_instruction()?;
         // TODO: Explore whether dispatching can be made more efficient.
         match TypedInstruction::dispatch(&op) {
@@ -565,22 +651,22 @@ where
             // operator was used, let's abort completely, otherwise we might end up drawing random stuff.
             // However, for other operators it could be worth it to just skip it but keep attempting
             // to read other content operators.
+            // PdfCraft patch: a path operator whose operands do not fit it contributes nothing to
+            // the path, so skipping it leaves the path as it was -- the same state the abort
+            // below used to leave it in, except that the rest of the page is still read. Ending
+            // the stream here lost every later operator, and with it the rest of the page, its
+            // text and anything a redaction search would have matched (#3568).
             None => {
-                if [
-                    &b"m"[..],
-                    &b"l"[..],
-                    &b"c"[..],
-                    &b"v"[..],
-                    &b"y"[..],
-                    &b"h"[..],
-                    &b"re"[..],
-                ]
-                .contains(&op.operator.0.deref())
+                // A pass that is only judging whether bytes read as content must still stop at a
+                // path operator it cannot dispatch: counting it as a step would let an inline
+                // image's data pass for a content stream and cut the image at a false `EI`
+                // (#3636 review).
+                if judging
+                    && [&b"m"[..], &b"l"[..], &b"c"[..], &b"v"[..], &b"y"[..], &b"h"[..], &b"re"[..]].contains(&op.operator.0.deref())
                 {
-                    None
-                } else {
-                    Some(TypedInstruction::Fallback(op.operator))
+                    return None;
                 }
+                Some(TypedInstruction::Fallback(op.operator))
             }
         }
     }

From bcaead540438f9aa52dcca940697bbd339998104 Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 28 Oct 2026 15:49:39 -0400
Subject: [PATCH 095/270] =?UTF-8?q?M10:=20PDF=20=E2=96=B8=20Markdown=20exp?=
 =?UTF-8?q?ort,=20through=20doc=5Fexport=5Foffice=20with=20a=20.md=20path?=
 =?UTF-8?q?=20(#1595)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ROADMAP.md                               |   1 +
 crates/automation/src/a11y/documents.rs  |   2 +-
 crates/automation/src/tools.rs           |   2 +-
 crates/automation/tests/it/automation.rs |   6 +-
 crates/engine/src/compare.rs             |  11 ++-
 crates/export/src/as_markdown.rs         | 104 +++++++++++++++++++++++
 crates/export/src/lib.rs                 |   6 +-
 crates/export/src/tests.rs               |  63 ++++++++++++++
 8 files changed, 188 insertions(+), 7 deletions(-)
 create mode 100644 crates/export/src/as_markdown.rs

diff --git a/ROADMAP.md b/ROADMAP.md
index f5de8044e1..e230d6e578 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -449,6 +449,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 Newest first: the date, what moved, and the new overall estimate.
 
+- **2026-10-28 (M10, #1595):** Export to Markdown: `doc_export_office` with a `.md` or `.markdown` path writes CommonMark with GitHub pipe tables (headings, paragraphs with bold and italic, tables with their first row as the header, a rule between pages); text that Markdown would read as markup is escaped. Images, lists and links are not in the export's layout model and are left out. No menu item yet. Estimates unchanged.
 - **2026-10-12 (M3, GNOME title bar, #553):** On GNOME's Wayland session, whose compositor draws no window frames (it offers no `zxdg_decoration_manager_v1`), PdfCraft no longer shows winit's fallback title bar: it turns the frame off and the tab strip becomes the header bar, as in GNOME's own apps. Minimize, maximize/restore and close are drawn in Adwaita's style, in the order and on the side GNOME's `button-layout` names (Fedora's default shows only close); the window's edges and corners resize it, and a hairline outlines it while it isn't maximized. Preferences ▸ Use system title bar (shown only there) gives the window back winit's frame at once, without a restart (part of #1001), and `PDFCRAFT_TITLEBAR=app|system` overrides the choice. KDE, Sway, Hyprland, COSMIC and X11 keep the frame their desktop draws. Not done: right-clicking the header bar doesn't open GNOME's window menu (egui can't ask for it), the window has no shadow or rounded corners, the resize edges lie just inside the window rather than outside it, and Windows still uses its system frame (the rest of #1001). Estimates unchanged.
 - **2026-10-12 (M0, build label):** A local or patched build can carry a label, set at compile time with `PDFCRAFT_BUILD_LABEL`: `pdfcraft --version`, `pdfcraft-cli --version`, About and the log show `0.7.1 (titlebar)`, and `packaging/linux/package.sh` names the files `pdfcraft-0.7.1-titlebar-…` and makes the .rpm/.deb release `1.titlebar`, which upgrades over the release of the same version (and the next release over it). The version itself is unchanged, so the update check still compares it with published releases. Unlabelled builds are as before. Estimates unchanged.
 - **2026-10-11 (M6, #1208):** Dropdown and list-box Field Properties expose the existing Left/Center/Right alignment picker. Existing alignment stays intact until changed; cancel, undo/redo and save/reopen are covered through the real UI without changing options, values or flags. Estimates unchanged.
diff --git a/crates/automation/src/a11y/documents.rs b/crates/automation/src/a11y/documents.rs
index f2c9f6b77d..e52768d535 100644
--- a/crates/automation/src/a11y/documents.rs
+++ b/crates/automation/src/a11y/documents.rs
@@ -5,7 +5,7 @@ impl Automation {
         let path = self.resolve(a.str("path")?, true)?;
         let ext = path.extension().map(|e| e.to_string_lossy().into_owned()).unwrap_or_default();
         let format = pdfcraft_engine::compare::OfficeFormat::from_extension(&ext)
-            .ok_or_else(|| ToolError::InvalidArgs(format!("unsupported extension {ext:?} (docx, pptx, html or rtf)")))?;
+            .ok_or_else(|| ToolError::InvalidArgs(format!("unsupported extension {ext:?} (docx, pptx, html, rtf or md)")))?;
         let export = self.doc_to_copy(a)?.export_office_checked(format);
         write_atomic(&path, &export.bytes)?;
         // Text left out to keep a hostile page bounded is said, not silent (#3120).
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 4b4ac8873b..38ed3306fd 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1154,7 +1154,7 @@ pub fn tools() -> Vec<ToolDef> {
                 json!({ "doc": doc(), "field": { "type": "string" }, "event": { "type": "string", "enum": ["keystroke", "format", "validate", "calculate", "mouse_up"] }, "script": { "type": "string" } }),
                 &["doc", "field", "event"],
             )),
-        t("doc_export_office", "Export to Word, PowerPoint, HTML or RTF", "Export a PDF ▸ Word (.docx), PowerPoint (.pptx, one slide per page), HTML (.html, one file with images inline) or RTF (.rtf), chosen by path's extension: text, headings, bold and italic. Word uses borderless inferred tables and positioned editable shapes on pages with artwork, rotated or large text; each source page retains its size. Font matching and vector graphics remain limited. Export reads forms 50 deep and up to 50 000 a page, counting forms the page draws itself. Pages that go past either limit are listed in truncated_pages, with a warning; the text and images of the forms left out are missing.")
+        t("doc_export_office", "Export to Word, PowerPoint, HTML, RTF or Markdown", "Export a PDF ▸ Word (.docx), PowerPoint (.pptx, one slide per page), HTML (.html, one file with images inline), RTF (.rtf) or Markdown (.md or .markdown: pipe tables, images left out), chosen by path's extension: text, headings, bold and italic. Word uses borderless inferred tables and positioned editable shapes on pages with artwork, rotated or large text; each source page retains its size. Font matching and vector graphics remain limited. Export reads forms 50 deep and up to 50 000 a page, counting forms the page draws itself. Pages that go past either limit are listed in truncated_pages, with a warning; the text and images of the forms left out are missing.")
             .cmd("export.docx")
             .with(schema(json!({ "doc": doc(), "path": { "type": "string" } }), &["doc", "path"])),
         t("pdfa_verify", "Verify PDF/A", "Standards ▸ Verify PDF/A compliance: the PDF/A-2b or 3b rules the document breaks (ISO 19005 clause, message, page, whether Save as PDF/A can fix it), plus what it declares.")
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 78038d8ebd..4cdf0c8a03 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6830,7 +6830,7 @@ fn exporting_to_word_html_and_rtf() {
     let dir = workdir("office");
     let mut a = auto(&dir);
     let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
-    for ext in ["docx", "pptx", "html", "rtf"] {
+    for ext in ["docx", "pptx", "html", "rtf", "md"] {
         let r = ok(&mut a, "doc_export_office", json!({ "doc": doc, "path": format!("a.{ext}") }));
         assert_eq!(r["format"], ext);
     }
@@ -6839,6 +6839,10 @@ fn exporting_to_word_html_and_rtf() {
     assert!(std::fs::read(dir.join("a.docx")).unwrap().starts_with(b"PK"));
     assert!(std::fs::read(dir.join("a.pptx")).unwrap().starts_with(b"PK"));
     assert!(std::fs::read_to_string(dir.join("a.rtf")).unwrap().contains("Page 2"));
+    // #1595: Markdown, with a rule between pages.
+    let md = std::fs::read_to_string(dir.join("a.md")).unwrap();
+    assert!(md.contains("Page 1") && md.contains("Page 3") && md.matches("\n---\n").count() == 2, "{md}");
+    assert_eq!(ok(&mut a, "doc_export_office", json!({ "doc": doc, "path": "b.markdown" }))["format"], "md");
     assert!(a.call("doc_export_office", &json!({ "doc": doc, "path": "a.xyz" })).is_err());
 }
 
diff --git a/crates/engine/src/compare.rs b/crates/engine/src/compare.rs
index 044e40e2e2..dca1e24af5 100644
--- a/crates/engine/src/compare.rs
+++ b/crates/engine/src/compare.rs
@@ -141,6 +141,7 @@ pub enum OfficeFormat {
     Pptx,
     Html,
     Rtf,
+    Markdown,
 }
 
 impl OfficeFormat {
@@ -150,6 +151,7 @@ impl OfficeFormat {
             OfficeFormat::Pptx => "pptx",
             OfficeFormat::Html => "html",
             OfficeFormat::Rtf => "rtf",
+            OfficeFormat::Markdown => "md",
         }
     }
 
@@ -159,12 +161,13 @@ impl OfficeFormat {
             "pptx" => Some(OfficeFormat::Pptx),
             "html" | "htm" => Some(OfficeFormat::Html),
             "rtf" => Some(OfficeFormat::Rtf),
+            "md" | "markdown" => Some(OfficeFormat::Markdown),
             _ => None,
         }
     }
 }
 
-/// A Word, PowerPoint, HTML or RTF export ([`crate::Document::export_office_checked`]).
+/// A Word, PowerPoint, HTML, RTF or Markdown export ([`crate::Document::export_office_checked`]).
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct OfficeExport {
     /// The exported file.
@@ -275,14 +278,16 @@ impl crate::Document {
     /// [`Self::export_office`], and the pages whose text it had to leave out
     /// ([`OfficeExport::truncated_pages`]).
     pub fn export_office_checked(&self, format: OfficeFormat) -> OfficeExport {
-        // RTF leaves pictures out.
-        let (pages, truncated_pages) = self.export_pages_checked(format != OfficeFormat::Rtf, MAX_EXPORT_IMAGE_BYTES);
+        // RTF and Markdown leave pictures out.
+        let (pages, truncated_pages) =
+            self.export_pages_checked(!matches!(format, OfficeFormat::Rtf | OfficeFormat::Markdown), MAX_EXPORT_IMAGE_BYTES);
         let title = self.info.title.clone().unwrap_or_else(|| self.name.trim_end_matches(".pdf").to_string());
         let bytes = match format {
             OfficeFormat::Docx => pdfcraft_export::docx(&pages, &title),
             OfficeFormat::Pptx => pdfcraft_export::pptx(&pages, &title),
             OfficeFormat::Html => pdfcraft_export::html(&pages, &title).into_bytes(),
             OfficeFormat::Rtf => pdfcraft_export::rtf(&pages).into_bytes(),
+            OfficeFormat::Markdown => pdfcraft_export::markdown(&pages).into_bytes(),
         };
         OfficeExport { bytes, truncated_pages }
     }
diff --git a/crates/export/src/as_markdown.rs b/crates/export/src/as_markdown.rs
new file mode 100644
index 0000000000..0d2657f55e
--- /dev/null
+++ b/crates/export/src/as_markdown.rs
@@ -0,0 +1,104 @@
+use super::as_html::allowed;
+use super::layout::{Cell, Item, MAX_COLS, Page, items};
+
+/// Markdown's deepest heading.
+const MAX_HEADING: u8 = 6;
+
+/// `s` as Markdown text on one line: line breaks become spaces, control characters are dropped,
+/// and every character Markdown would read as markup is escaped with a backslash.
+fn md_text(s: &str) -> String {
+    let mut o = String::with_capacity(s.len());
+    for c in s.chars().filter(|c| allowed(*c)) {
+        match c {
+            '\n' | '\r' | '\t' => o.push(' '),
+            '\\' | '`' | '*' | '_' | '[' | ']' | '<' | '>' | '#' | '|' | '~' | '!' | '&' => {
+                o.push('\\');
+                o.push(c);
+            }
+            c => o.push(c),
+        }
+    }
+    o
+}
+
+/// `line` with its start escaped where Markdown would read a list item there (`- `, `+ `,
+/// `1. `, `1) `); the other block markers (`#`, `>`) are escaped by [`md_text`] already.
+fn block_start(line: String) -> String {
+    let digits = line.bytes().take_while(u8::is_ascii_digit).count();
+    match line.as_bytes().get(digits) {
+        Some(b'.' | b')') if digits > 0 => format!("{}\\{}", line.get(..digits).unwrap_or_default(), line.get(digits..).unwrap_or_default()),
+        Some(b'-' | b'+') if digits == 0 => format!("\\{line}"),
+        _ => line,
+    }
+}
+
+/// `text` (already escaped) in bold and/or italic. The markers go around the text without its
+/// outer spaces, which Markdown would not read as emphasis.
+pub(crate) fn emphasis(text: &str, bold: bool, italic: bool) -> String {
+    let core = text.trim();
+    if core.is_empty() || !(bold || italic) {
+        return text.to_string();
+    }
+    let lead = text.get(..text.len().saturating_sub(text.trim_start().len())).unwrap_or_default();
+    let trail = text.get(text.trim_end().len()..).unwrap_or_default();
+    let mark = match (bold, italic) {
+        (true, true) => "***",
+        (true, false) => "**",
+        _ => "*",
+    };
+    format!("{lead}{mark}{core}{mark}{trail}")
+}
+
+fn cell(c: &Cell) -> String {
+    emphasis(&md_text(&c.text), c.bold, c.italic)
+}
+
+/// Markdown (CommonMark, with GitHub's pipe tables): headings, paragraphs with bold and italic,
+/// tables with their first row as the header, and a rule between pages. Images are left out.
+pub fn markdown(pages: &[Page]) -> String {
+    let mut blocks: Vec<String> = Vec::new();
+    for it in items(pages) {
+        match it {
+            Item::Para(runs, lvl) => {
+                // A heading's weight is the heading's own, as in the HTML export.
+                let text: String = runs.iter().map(|r| emphasis(&md_text(&r.text), r.block.bold && lvl == 0, r.block.italic)).collect();
+                let text = text.trim();
+                if text.is_empty() {
+                    continue;
+                }
+                blocks.push(match lvl {
+                    0 => block_start(text.to_string()),
+                    l => format!("{} {text}", "#".repeat(usize::from(l.min(MAX_HEADING)))),
+                });
+            }
+            Item::Table(t) => {
+                // Each row as wide as the widest; a cell spanning columns is followed by empty ones.
+                // Detected tables have at most MAX_COLS columns, and a span never counts for more.
+                let span = |c: &Cell| c.span.clamp(1, MAX_COLS);
+                let width = t.rows.iter().map(|r| r.iter().map(span).fold(0usize, usize::saturating_add)).max().unwrap_or(0);
+                if width == 0 {
+                    continue;
+                }
+                let mut lines = Vec::with_capacity(t.rows.len().saturating_add(1));
+                for (i, row) in t.rows.iter().enumerate() {
+                    let mut cells: Vec<String> = Vec::with_capacity(width);
+                    for c in row {
+                        cells.push(cell(c));
+                        cells.extend(std::iter::repeat_n(String::new(), span(c).saturating_sub(1)));
+                    }
+                    cells.resize(width, String::new());
+                    lines.push(format!("| {} |", cells.join(" | ")));
+                    if i == 0 {
+                        lines.push(format!("|{}", " --- |".repeat(width)));
+                    }
+                }
+                blocks.push(lines.join("\n"));
+            }
+            Item::Img(_) => {}
+            Item::PageBreak => blocks.push("---".into()),
+        }
+    }
+    let mut s = blocks.join("\n\n");
+    s.push('\n');
+    s
+}
diff --git a/crates/export/src/lib.rs b/crates/export/src/lib.rs
index 5275b02439..54d8500a99 100644
--- a/crates/export/src/lib.rs
+++ b/crates/export/src/lib.rs
@@ -1,4 +1,4 @@
-//! pdfcraft-export — Export a PDF ▸ Word, HTML, RTF (L4).
+//! pdfcraft-export — Export a PDF ▸ Word, HTML, RTF, Markdown (L4).
 //!
 //! The engine reduces each page to [`Page`]: paragraphs (text, box, size, bold/italic) and
 //! images (encoded bytes and box), in reading order. The writers turn that into a flowing
@@ -18,6 +18,7 @@ pub use zip::Zip;
 
 mod as_docx;
 mod as_html;
+mod as_markdown;
 mod as_rtf;
 mod layout;
 
@@ -29,6 +30,9 @@ pub(crate) use as_html::esc;
 pub use as_html::html;
 #[cfg(test)]
 use as_html::{allowed, base64};
+#[cfg(test)]
+use as_markdown::emphasis;
+pub use as_markdown::markdown;
 pub use as_rtf::rtf;
 pub use layout::{Block, Cell, Image, Page, Table};
 #[cfg(test)]
diff --git a/crates/export/src/tests.rs b/crates/export/src/tests.rs
index d735eb4c20..be4708da42 100644
--- a/crates/export/src/tests.rs
+++ b/crates/export/src/tests.rs
@@ -769,3 +769,66 @@ fn a_paragraph_is_a_heading_only_when_its_text_is() {
     assert!(!xml.contains("Heading2"), "the lead-in made its paragraph a heading: {xml}");
     assert_eq!(word_paragraphs(&xml).len(), 2, "{xml}");
 }
+
+/// #1595: Markdown gets the headings, paragraphs and a rule between pages, in reading order;
+/// images are left out.
+#[test]
+fn markdown_has_headings_paragraphs_and_page_rules_in_order() {
+    let md = markdown(&[page(), page()]);
+    let order: Vec<usize> = ["# Annual Report\n\n", "## Overview\n\n", "Some \\<body\\> text \\& more", "Body text after the picture", "\n\n---\n\n"]
+        .iter()
+        .map(|x| md.find(x).unwrap_or_else(|| panic!("{x:?} missing in {md}")))
+        .collect();
+    assert!(order.windows(2).all(|w| w[0] < w[1]), "{md}");
+    assert_eq!(md.matches("\n---\n").count(), 1, "one rule between two pages: {md}");
+    assert_eq!(md.matches("# Annual Report").count(), 2, "{md}");
+    assert!(!md.contains("PNG") && !md.contains("!["), "images are left out: {md}");
+    assert!(md.ends_with(".\n") && !md.ends_with("\n\n"), "{md:?}");
+}
+
+/// #1595: text Markdown would read as markup stays text, emphasis wraps a run without its outer
+/// spaces, and a detected table becomes a pipe table with its first row as the header.
+#[test]
+fn markdown_escapes_markup_and_keeps_emphasis_and_tables() {
+    let b = |t: &str, y: f64, bold: bool, italic: bool| Block {
+        text: t.into(),
+        rect: [72.0, y, 500.0, y + 11.0],
+        size: 11.0,
+        bold,
+        italic,
+        color: [0.0; 3],
+        rotation: 0.0,
+        space_around: [false; 2],
+    };
+    let p = Page {
+        width: 612.0,
+        height: 792.0,
+        blocks: vec![
+            b("- not a list item, and long enough to make eleven points the body size here", 700.0, false, false),
+            b("1. not a numbered item either", 650.0, false, false),
+            b("*stars* _under_ `tick` [link](x) a|b # #tag\u{1}\nnext", 600.0, false, false),
+            b("Strong words in a sentence of their own.", 550.0, true, false),
+            b("slanted", 500.0, false, true),
+        ],
+        images: Vec::new(),
+        background: None,
+    };
+    let md = markdown(&[p]);
+    assert!(md.contains("\\- not a list item"), "{md}");
+    assert!(md.contains("1\\. not a numbered item"), "{md}");
+    assert!(md.contains("\\*stars\\* \\_under\\_ \\`tick\\` \\[link\\](x) a\\|b \\# \\#tag next"), "{md}");
+    assert!(md.contains("**Strong words in a sentence of their own.**"), "{md}");
+    // Markdown reads no emphasis where a marker sits next to a space: the outer spaces go outside.
+    assert_eq!(emphasis(" two words ", true, false), " **two words** ");
+    assert_eq!(emphasis("both", true, true), "***both***");
+    assert_eq!(emphasis("  ", true, true), "  ", "nothing to mark");
+    assert!(md.contains("*slanted*"), "{md}");
+    assert!(!md.chars().any(|c| !allowed(c)), "{md:?}");
+
+    let md = markdown(&[table_page()]);
+    let rows: Vec<&str> = md.lines().filter(|l| l.starts_with('|')).collect();
+    assert_eq!(rows.first(), Some(&"| Meter | Unit | Reading |"), "{md}");
+    assert_eq!(rows.get(1), Some(&"| --- | --- | --- |"), "{md}");
+    assert!(rows.contains(&"| A1 | kWh | 37414.00 |"), "{md}");
+    assert!(rows.iter().all(|r| r.matches(" | ").count() == 2), "every row has the header's three cells: {md}");
+}

From 20d396d180a33139908a3a1fad6178ab77b90eff Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 28 Oct 2026 15:56:25 -0400
Subject: [PATCH 096/270] M10: Markdown emphasis follows CommonMark's rules at
 run boundaries, and the export has a parity entry (#1595)

---
 crates/export/src/as_markdown.rs | 67 +++++++++++++++++++++++++++-----
 crates/export/src/lib.rs         |  4 +-
 crates/export/src/tests.rs       | 15 +++++--
 parity/acrobat-features.toml     | 12 ++++++
 4 files changed, 83 insertions(+), 15 deletions(-)

diff --git a/crates/export/src/as_markdown.rs b/crates/export/src/as_markdown.rs
index 0d2657f55e..a5c986c6b3 100644
--- a/crates/export/src/as_markdown.rs
+++ b/crates/export/src/as_markdown.rs
@@ -32,25 +32,71 @@ fn block_start(line: String) -> String {
     }
 }
 
-/// `text` (already escaped) in bold and/or italic. The markers go around the text without its
-/// outer spaces, which Markdown would not read as emphasis.
-pub(crate) fn emphasis(text: &str, bold: bool, italic: bool) -> String {
+/// `text` (already escaped) in bold and/or italic, its outer spaces kept outside. `open` and
+/// `close` say whether `*` markers would be read as emphasis on that side (see [`marks`]);
+/// where they would not, as in `foo` + bold `.` + `bar`, the run is wrapped in HTML tags, which
+/// CommonMark takes inline. The text's own outer spaces count as a side that marks.
+pub(crate) fn emphasis(text: &str, bold: bool, italic: bool, open: bool, close: bool) -> String {
     let core = text.trim();
     if core.is_empty() || !(bold || italic) {
         return text.to_string();
     }
     let lead = text.get(..text.len().saturating_sub(text.trim_start().len())).unwrap_or_default();
     let trail = text.get(text.trim_end().len()..).unwrap_or_default();
-    let mark = match (bold, italic) {
-        (true, true) => "***",
-        (true, false) => "**",
-        _ => "*",
+    let markers = (open || !lead.is_empty()) && (close || !trail.is_empty());
+    let (before, after) = match (markers, bold, italic) {
+        (true, true, true) => ("***", "***"),
+        (true, true, false) => ("**", "**"),
+        (true, false, _) => ("*", "*"),
+        (false, true, true) => ("<strong><em>", "</em></strong>"),
+        (false, true, false) => ("<strong>", "</strong>"),
+        (false, false, _) => ("<em>", "</em>"),
     };
-    format!("{lead}{mark}{core}{mark}{trail}")
+    format!("{lead}{before}{core}{after}{trail}")
+}
+
+/// A paragraph's runs (text, bold, italic) as one line of Markdown. Neighbouring runs in the
+/// same style are joined first, so two bold runs never meet as `****`.
+pub(crate) fn paragraph(runs: &[(&str, bool, bool)]) -> String {
+    let mut merged: Vec<(String, bool, bool)> = Vec::new();
+    for &(text, bold, italic) in runs {
+        match merged.last_mut() {
+            Some(last) if last.1 == bold && last.2 == italic => last.0.push_str(text),
+            _ => merged.push((text.to_string(), bold, italic)),
+        }
+    }
+    let texts: Vec<String> = merged.iter().map(|(text, ..)| md_text(text)).collect();
+    let mut out = String::new();
+    for (k, ((_, bold, italic), text)) in merged.iter().zip(&texts).enumerate() {
+        let core = text.trim();
+        let open = marks(core.chars().next(), out.chars().last());
+        // Markers of a styled neighbour right next to these would join them into one run.
+        let close = match (merged.get(k.saturating_add(1)), texts.get(k.saturating_add(1))) {
+            (Some((_, b, i)), Some(next)) if (*b || *i) && !next.starts_with(char::is_whitespace) => false,
+            (_, next) => marks(core.chars().last(), next.and_then(|n| n.chars().next())),
+        };
+        out.push_str(&emphasis(text, *bold, *italic, open, close));
+    }
+    out
+}
+
+/// Whether a `*` marker between the text's `edge` character and the `outside` one is read as
+/// emphasis (CommonMark's flanking rules for `*`): always next to a space or the line's edge,
+/// never next to another `*`, and otherwise unless the text's edge is punctuation while the
+/// outside is a letter or digit.
+fn marks(edge: Option<char>, outside: Option<char>) -> bool {
+    match (edge, outside) {
+        (_, None) => true,
+        (_, Some(o)) if o.is_whitespace() => true,
+        (_, Some('*')) => false,
+        (Some(e), Some(o)) => e.is_alphanumeric() || o.is_ascii_punctuation(),
+        (None, Some(_)) => false,
+    }
 }
 
 fn cell(c: &Cell) -> String {
-    emphasis(&md_text(&c.text), c.bold, c.italic)
+    // A cell sits between `| ` and ` |`, so its markers always have a space outside.
+    emphasis(&md_text(&c.text), c.bold, c.italic, true, true)
 }
 
 /// Markdown (CommonMark, with GitHub's pipe tables): headings, paragraphs with bold and italic,
@@ -61,7 +107,8 @@ pub fn markdown(pages: &[Page]) -> String {
         match it {
             Item::Para(runs, lvl) => {
                 // A heading's weight is the heading's own, as in the HTML export.
-                let text: String = runs.iter().map(|r| emphasis(&md_text(&r.text), r.block.bold && lvl == 0, r.block.italic)).collect();
+                let runs: Vec<(&str, bool, bool)> = runs.iter().map(|r| (r.text.as_str(), r.block.bold && lvl == 0, r.block.italic)).collect();
+                let text = paragraph(&runs);
                 let text = text.trim();
                 if text.is_empty() {
                     continue;
diff --git a/crates/export/src/lib.rs b/crates/export/src/lib.rs
index 54d8500a99..db53ee59c8 100644
--- a/crates/export/src/lib.rs
+++ b/crates/export/src/lib.rs
@@ -30,9 +30,9 @@ pub(crate) use as_html::esc;
 pub use as_html::html;
 #[cfg(test)]
 use as_html::{allowed, base64};
-#[cfg(test)]
-use as_markdown::emphasis;
 pub use as_markdown::markdown;
+#[cfg(test)]
+use as_markdown::{emphasis, paragraph};
 pub use as_rtf::rtf;
 pub use layout::{Block, Cell, Image, Page, Table};
 #[cfg(test)]
diff --git a/crates/export/src/tests.rs b/crates/export/src/tests.rs
index be4708da42..27cd8264e0 100644
--- a/crates/export/src/tests.rs
+++ b/crates/export/src/tests.rs
@@ -819,9 +819,18 @@ fn markdown_escapes_markup_and_keeps_emphasis_and_tables() {
     assert!(md.contains("\\*stars\\* \\_under\\_ \\`tick\\` \\[link\\](x) a\\|b \\# \\#tag next"), "{md}");
     assert!(md.contains("**Strong words in a sentence of their own.**"), "{md}");
     // Markdown reads no emphasis where a marker sits next to a space: the outer spaces go outside.
-    assert_eq!(emphasis(" two words ", true, false), " **two words** ");
-    assert_eq!(emphasis("both", true, true), "***both***");
-    assert_eq!(emphasis("  ", true, true), "  ", "nothing to mark");
+    assert_eq!(emphasis(" two words ", true, false, false, false), " **two words** ");
+    assert_eq!(emphasis("both", true, true, true, true), "***both***");
+    assert_eq!(emphasis("  ", true, true, true, true), "  ", "nothing to mark");
+    // Runs in one style are one: two bold runs side by side don't meet as `****`.
+    assert_eq!(paragraph(&[("hello", true, false), ("world", true, false)]), "**helloworld**");
+    // Markers inside a word would stay literal in CommonMark, so a run there gets HTML tags.
+    assert_eq!(paragraph(&[("foo", false, false), (".", true, false), ("bar", false, false)]), "foo<strong>.</strong>bar");
+    assert_eq!(paragraph(&[("x", true, false), ("y", false, true)]), "<strong>x</strong>*y*", "two styles side by side");
+    // `*` may sit inside a word, and before punctuation that follows a letter.
+    assert_eq!(paragraph(&[("foo", false, false), ("bar", true, false), ("baz", false, false)]), "foo**bar**baz");
+    assert_eq!(paragraph(&[("a ", false, false), ("b", true, false), (" c", false, false)]), "a **b** c");
+    assert_eq!(paragraph(&[("say ", false, false), ("this", false, true), (", then", false, false)]), "say *this*, then");
     assert!(md.contains("*slanted*"), "{md}");
     assert!(!md.chars().any(|c| !allowed(c)), "{md:?}");
 
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 47ac06fdd4..3ba6f85cf2 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7067,6 +7067,18 @@ tools = ["doc_export_office"]
 evidence = ["crates/export/src/tests.rs::table_spans_do_not_consume_text_they_do_not_emit", "crates/export/src/tests.rs::rtf_escapes_and_sizes", "crates/export/src/tests.rs::text_colour_survives_every_format", "crates/export/src/tests.rs::word_opens_text_with_control_characters_and_long_pages", "crates/automation/tests/it/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/it/compare.rs::export_to_word_html_and_rtf"]
 notes = "Text in slots covered by a preceding table-cell span remains in paragraph flow instead of being discarded. Paragraphs with sizes, bold, italic, text colour (colortbl), Unicode; a block that continues another on its line is a formatted group inside that paragraph (#4158), though a style change that wraps onto the next line still splits it; page breaks. Images are left out."
 
+
+[[feature]]
+id = "create.export-markdown"
+title = "Export to Markdown"
+area = "J"
+tier = "P3"
+milestone = "M10"
+status = "partial"
+commands = []
+tools = ["doc_export_office"]
+evidence = ["crates/export/src/tests.rs::markdown_has_headings_paragraphs_and_page_rules_in_order", "crates/export/src/tests.rs::markdown_escapes_markup_and_keeps_emphasis_and_tables", "crates/automation/tests/it/automation.rs::exporting_to_word_html_and_rtf"]
+notes = "Requested in #1595; not an Acrobat export. doc_export_office with a .md or .markdown path writes CommonMark with GitHub pipe tables: headings (levels 1 to 6), paragraphs with bold and italic (as HTML tags where Markdown's markers would not be read as emphasis), tables with their first row as the header, and a rule between pages; text Markdown would read as markup is escaped. Missing: a menu item, images, lists and links (the export's layout model has none of the last two), and text colour."
 [[feature]]
 id = "create.export-xlsx"
 title = "Export to Excel (.xlsx) with table detection"

From 48090eadcda3119a241de8f413d30cc1c5c10f18 Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 21 Oct 2026 01:14:51 -0400
Subject: [PATCH 097/270] Alt+Left / Alt+Right go back and forward through the
 view history (#3632)

Previous view and Next view had only Cmd+[ / Cmd+] (Ctrl elsewhere), and
Alt+Left turned the page, since the arrow keys ignore Alt. The document
view now takes Alt+Left / Alt+Right (Option on macOS) for them, as Acrobat
and browsers do, before the arrows turn the page. Following a link
already records where it was followed from.

With a picture or objects selected in Edit text & images, the arrow-key
nudge ran first and also matched a press with Alt, so Alt+Left moved the
selection. It now takes only arrows pressed alone or with Shift, judged
by each key press's own modifiers rather than the frame's.

Help > Keyboard shortcuts lists the pair under the existing Previous view
/ Next view labels.
---
 crates/ui-egui/src/canvas/navigation.rs |  8 +++-
 crates/ui-egui/src/dialogs.rs           |  8 ++++
 crates/ui-egui/src/tools/object_ui.rs   | 32 ++++++++------
 crates/ui-egui/tests/it/editing.rs      | 57 ++++++++++++++++++++++---
 crates/ui-egui/tests/it/viewer.rs       | 27 ++++++++++++
 parity/acrobat-features.toml            |  4 +-
 6 files changed, 114 insertions(+), 22 deletions(-)

diff --git a/crates/ui-egui/src/canvas/navigation.rs b/crates/ui-egui/src/canvas/navigation.rs
index 46468a112d..731b2c2586 100644
--- a/crates/ui-egui/src/canvas/navigation.rs
+++ b/crates/ui-egui/src/canvas/navigation.rs
@@ -369,10 +369,14 @@ pub fn shortcuts(view: &mut DocView, ctx: &egui::Context, speed: crate::scroll_s
         view.rotate_view(false);
     }
     zoom_shortcuts(view, &pressed);
-    if pressed(cmd(Key::OpenBracket)) {
+    // Alt+← / Alt+→ (⌥ on macOS) too, as in Acrobat and browsers, back to where a link was
+    // followed from (#3632). Consumed here, before ← / → turn the page. egui matches the pattern
+    // logically, so an extra Shift is ignored and Shift+Alt+← goes back as well (harmless).
+    let alt = |k| KeyboardShortcut::new(Modifiers::ALT, k);
+    if pressed(cmd(Key::OpenBracket)) || pressed(alt(Key::ArrowLeft)) {
         view.view_history(false);
     }
-    if pressed(cmd(Key::CloseBracket)) {
+    if pressed(cmd(Key::CloseBracket)) || pressed(alt(Key::ArrowRight)) {
         view.view_history(true);
     }
     let key = |k| (arrows || !matches!(k, Key::ArrowLeft | Key::ArrowRight | Key::ArrowUp | Key::ArrowDown)) && ctx.input(|i| i.key_pressed(k));
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index 138b18e1c5..ebe5110cff 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -1463,6 +1463,13 @@ fn dialog_shortcuts(ui: &mut egui::Ui) -> bool {
     let pair = |a, b| format!("{} / {}", key(a), key(b));
     // Key names, translated where a catalog has them (not scanned as UI literals).
     let named = |k: &str| tl!(k).to_string();
+    // Alt+← / Alt+→ (`canvas::shortcuts`): not a registered command, which has no Alt.
+    let alt_arrows = if crate::commands::mac_shortcuts(ui.ctx()) {
+        "⌥← / ⌥→".to_owned()
+    } else {
+        let alt = crate::i18n::key_name("Alt");
+        format!("{alt}+← / {alt}+→")
+    };
     let scroll = crate::i18n::fmt(tl!("Zoom in / out (also pinch or {key}-scroll)"), &[("key", crate::commands::command_modifier_label(ui.ctx()))]);
     for (k, v) in [
         (pair(FIND_NEXT, FIND_PREV), tl!("Next / previous match").to_string()),
@@ -1476,6 +1483,7 @@ fn dialog_shortcuts(ui: &mut egui::Ui) -> bool {
         (pair(ROTATE_CW, ROTATE_CCW), tl!("Rotate view").to_string()),
         (format!("{} / {}", crate::i18n::key_name("Home"), crate::i18n::key_name("End")), tl!("First / last page").to_string()),
         (format!("← / →, {}", pair(PAGE_PREV, PAGE_NEXT)), tl!("Previous / next page").to_string()),
+        (alt_arrows, format!("{} / {}", tl!("Previous view"), tl!("Next view"))),
         (named("V"), tl!("Select (V)").to_string()),
         (named("H / Space (hold)"), tl!("Hand (H)").to_string()),
         (crate::i18n::key_name("Delete").to_string(), tl!("Delete selected pages (Organize)").to_string()),
diff --git a/crates/ui-egui/src/tools/object_ui.rs b/crates/ui-egui/src/tools/object_ui.rs
index 96cc0adf25..114ccbd436 100644
--- a/crates/ui-egui/src/tools/object_ui.rs
+++ b/crates/ui-egui/src/tools/object_ui.rs
@@ -351,22 +351,28 @@ pub(crate) fn nudge_keys(ctx: &egui::Context, view: &mut DocView, doc: &Document
     let objects = view.objects.page.filter(|_| !view.objects.selected.is_empty() && view.objects.gesture.is_none());
     let Some(page) = objects.or(image.map(|(page, _)| page)) else { return };
     let Some(xf) = view.page_xform(page) else { return };
-    use egui::{Key, Modifiers};
+    use egui::Key;
     let mut step = egui::Vec2::ZERO;
     ctx.input_mut(|i| {
-        for (key, direction) in [
-            (Key::ArrowLeft, egui::vec2(-1.0, 0.0)),
-            (Key::ArrowRight, egui::vec2(1.0, 0.0)),
-            (Key::ArrowUp, egui::vec2(0.0, -1.0)),
-            (Key::ArrowDown, egui::vec2(0.0, 1.0)),
-        ] {
-            // Shift first: a plain key pattern also matches a Shift press.
-            if i.consume_key(Modifiers::SHIFT, key) {
-                step += direction * 10.0;
-            } else if i.consume_key(Modifiers::NONE, key) {
-                step += direction;
+        // Only an arrow pressed alone or with Shift, judged by each press's own modifiers (the
+        // frame's can differ when a key is let go in the same frame). Alt+← / Alt+→ go back and
+        // forward through the view history (#3632) and Ctrl/⌘+← / → turn the page, both in
+        // `canvas::shortcuts`.
+        i.events.retain(|e| {
+            let egui::Event::Key { key, pressed: true, modifiers, .. } = e else { return true };
+            if modifiers.alt || modifiers.ctrl || modifiers.command || modifiers.mac_cmd {
+                return true;
             }
-        }
+            let direction = match key {
+                Key::ArrowLeft => egui::vec2(-1.0, 0.0),
+                Key::ArrowRight => egui::vec2(1.0, 0.0),
+                Key::ArrowUp => egui::vec2(0.0, -1.0),
+                Key::ArrowDown => egui::vec2(0.0, 1.0),
+                _ => return true,
+            };
+            step += direction * if modifiers.shift { 10.0 } else { 1.0 };
+            false
+        });
     });
     if step == egui::Vec2::ZERO {
         return;
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 0d44f91067..6b5ab31bc9 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -4242,8 +4242,9 @@ fn press(h: &mut Harness<'static, PdfCraftApp>, modifiers: Modifiers, key: Key)
     h.run_steps(4);
 }
 
-#[test]
-fn arrow_keys_nudge_a_selected_image_instead_of_turning_the_page() {
+/// A two-page document whose first page draws one picture (a Form XObject), open in Edit text
+/// & images with the picture selected.
+fn selected_figure() -> Harness<'static, PdfCraftApp> {
     use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_incremental};
     let mut doc = Document::open(std::sync::Arc::new(fixture(2))).unwrap();
     let page = pdfcraft_model::pages(&doc)[0].clone();
@@ -4271,12 +4272,18 @@ fn arrow_keys_nudge_a_selected_image_instead_of_turning_the_page() {
     h.run_steps(4);
     assert!(h.state_mut().execute("edit.edit_text"));
     h.run_steps(2);
-    let id = h.state().views[0].id;
-    let rect = |h: &Harness<'static, PdfCraftApp>| h.state().session.get(id).unwrap().page_images(0)[0].rect;
-    let before = rect(&h);
     let r = h.state().views[0].page_screen_rect(0).expect("on screen");
     click_at(&mut h, egui::pos2(r.left() + 100.0 / 200.0 * r.width(), r.top() + (300.0 - 240.0) / 300.0 * r.height()));
     assert!(h.state().views[0].image_selection.is_some(), "selected");
+    h
+}
+
+#[test]
+fn arrow_keys_nudge_a_selected_image_instead_of_turning_the_page() {
+    let mut h = selected_figure();
+    let id = h.state().views[0].id;
+    let rect = |h: &Harness<'static, PdfCraftApp>| h.state().session.get(id).unwrap().page_images(0)[0].rect;
+    let before = rect(&h);
     // As in Acrobat: an arrow moves it a point, Shift and an arrow ten.
     press(&mut h, Modifiers::NONE, Key::ArrowRight);
     press(&mut h, Modifiers::SHIFT, Key::ArrowDown);
@@ -4289,6 +4296,46 @@ fn arrow_keys_nudge_a_selected_image_instead_of_turning_the_page() {
     assert!(h.state().views[0].image_selection.is_some(), "it stays selected for the next nudge");
 }
 
+/// #3632: with a picture selected, Alt+← / Alt+→ still go back and forward through the view
+/// history. They don't nudge it (the nudge patterns also match a press with Alt), so nothing moves
+/// and the document isn't edited.
+#[test]
+fn alt_arrows_navigate_instead_of_nudging_a_selected_image() {
+    let mut h = selected_figure();
+    let id = h.state().views[0].id;
+    let rect = |h: &Harness<'static, PdfCraftApp>| h.state().session.get(id).unwrap().page_images(0)[0].rect;
+    let before = rect(&h);
+    // A followed link's jump to page 2 and back, as `go_to_dest` makes it.
+    h.state_mut().views[0].go_to_page(1);
+    h.run_steps(2);
+    h.state_mut().views[0].go_to_page(0);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "still selected, so a nudge could take the keys");
+    press(&mut h, Modifiers::ALT, Key::ArrowLeft);
+    assert_eq!(h.state().views[0].current, 1, "Alt+← went back");
+    press(&mut h, Modifiers::ALT, Key::ArrowRight);
+    assert_eq!(h.state().views[0].current, 0, "Alt+→ went forward");
+    // Each press is judged by its own modifiers, not the frame's: Alt let go in the same frame
+    // as Alt+← leaves the frame with none, and the press still goes back.
+    let arrow = |key, modifiers| egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers };
+    h.event(arrow(Key::ArrowLeft, Modifiers::ALT));
+    h.run_steps(4);
+    assert_eq!(h.state().views[0].current, 1, "an Alt+← press went back");
+    assert_eq!(rect(&h), before, "the picture didn't move");
+    let doc = h.state().session.get(id).unwrap();
+    assert!(!doc.dirty && doc.can_undo().is_none(), "nothing was edited");
+    // And a plain → pressed before Alt goes down in the same frame still nudges.
+    h.state_mut().views[0].go_to_page(0);
+    h.run_steps(2);
+    h.event(arrow(Key::ArrowRight, Modifiers::NONE));
+    h.event(egui::Event::ModifiersChanged(Modifiers::ALT));
+    h.run_steps(4);
+    h.event(egui::Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(2);
+    let moved = rect(&h);
+    assert!((moved[0] - before[0] - 1.0).abs() < 0.01, "a plain → nudged a point: {before:?} → {moved:?}");
+}
+
 #[test]
 fn an_open_paragraph_moves_by_its_frame_and_by_the_arrow_keys() {
     let mut h = harness(2, |_| {});
diff --git a/crates/ui-egui/tests/it/viewer.rs b/crates/ui-egui/tests/it/viewer.rs
index f2a12b69aa..9b37970670 100644
--- a/crates/ui-egui/tests/it/viewer.rs
+++ b/crates/ui-egui/tests/it/viewer.rs
@@ -70,6 +70,33 @@ fn revert_after_confirming() {
     assert_eq!((d.info.pages.len(), d.dirty), (2, false));
 }
 
+/// #3632: Alt+← / Alt+→ go back to where a link was followed from and forward again, as in
+/// Acrobat and browsers, while ← / → still turn the page.
+#[test]
+fn alt_arrows_go_back_and_forward_through_the_view_history() {
+    use egui::{Key, Modifiers};
+    let mut h = harness();
+    h.state_mut().active = Some(0);
+    h.run_steps(2);
+    // A followed link jumps the same way (`go_to_dest` → `go_to_page`).
+    h.state_mut().views[0].go_to_page(3);
+    h.run_steps(2);
+    h.key_press_modifiers(Modifiers::ALT, Key::ArrowLeft);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].current, 0, "back to where the jump started");
+    h.key_press_modifiers(Modifiers::ALT, Key::ArrowRight);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].current, 3, "forward to the jump's target");
+    h.key_press(Key::ArrowLeft);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].current, 2, "← still turns the page");
+    h.ctx.set_os(egui::os::OperatingSystem::Nix);
+    assert!(h.state_mut().execute("help.shortcuts"));
+    h.run_steps(3);
+    h.get_by_label("Alt+← / Alt+→");
+    h.get_by_label("Previous view / Next view");
+}
+
 #[test]
 fn view_history_select_all_and_find_options() {
     let mut h = harness();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 51b4f55aea..897ed017bc 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1178,8 +1178,8 @@ milestone = "M3"
 status = "shipped"
 commands = ["view.previous_view", "view.next_view"]
 tools = []
-evidence = ["crates/ui-egui/tests/it/viewer.rs::view_history_select_all_and_find_options", "crates/ui-egui/tests/it/control.rs::navigation_history_commands_and_rail_are_per_tab_and_non_editing", "crates/ui-egui/tests/it/control.rs::routine_continuous_scrolling_does_not_add_navigation_history"]
-notes = "Per-tab page history: explicit search-result jumps, page navigation, bookmarks and links; no continuous-scroll history or restart persistence; existing page-step history is retained. Rail buttons, View ▸ Page navigation and Ctrl/⌘[ / Ctrl/⌘]. UI control ui.command exposes view.previous_view / view.next_view; standalone engine sessions have no viewport history. Restores page tops, not exact scroll/zoom positions."
+evidence = ["crates/ui-egui/tests/it/viewer.rs::view_history_select_all_and_find_options", "crates/ui-egui/tests/it/control.rs::navigation_history_commands_and_rail_are_per_tab_and_non_editing", "crates/ui-egui/tests/it/control.rs::routine_continuous_scrolling_does_not_add_navigation_history", "crates/ui-egui/tests/it/viewer.rs::alt_arrows_go_back_and_forward_through_the_view_history", "crates/ui-egui/tests/it/editing.rs::alt_arrows_navigate_instead_of_nudging_a_selected_image", "crates/ui-egui/tests/it/comments.rs::alt_arrows_navigate_instead_of_nudging_the_selected_comment"]
+notes = "Per-tab page history: explicit search-result jumps, page navigation, bookmarks and links; no continuous-scroll history or restart persistence; existing page-step history is retained. Rail buttons, View ▸ Page navigation, Ctrl/⌘[ / Ctrl/⌘] and Alt/⌥+← / →, also with a picture, object or comment selected (the View menu shows only the bracket shortcuts). UI control ui.command exposes view.previous_view / view.next_view; standalone engine sessions have no viewport history. Restores page tops, not exact scroll/zoom positions."
 
 [[feature]]
 id = "view.follow-links"

From 5d6f36f06029a179d2412d5556ec80fe9931f6db Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 28 Oct 2026 18:16:42 -0400
Subject: [PATCH 098/270] M5: Alt+Left / Alt+Right go back through the view
 history with a comment selected (#3632)

The comment nudge matched arrows with egui's key patterns, which let an
extra Alt through, so with a comment selected Alt+Left moved it a pixel
instead of going back. It now takes only arrows pressed alone or with
Cmd/Ctrl or Shift, judged by each key press's own modifiers, as the
picture and object nudge does.
---
 crates/ui-egui/src/tools/comments/input.rs | 29 +++++++++++++-------
 crates/ui-egui/tests/it/comments.rs        | 32 ++++++++++++++++++++++
 2 files changed, 51 insertions(+), 10 deletions(-)

diff --git a/crates/ui-egui/src/tools/comments/input.rs b/crates/ui-egui/src/tools/comments/input.rs
index af78a1e46a..2c4f4f059e 100644
--- a/crates/ui-egui/src/tools/comments/input.rs
+++ b/crates/ui-egui/src/tools/comments/input.rs
@@ -637,19 +637,28 @@ pub(crate) fn nudge_keys(ctx: &egui::Context, view: &mut DocView, info: &DocInfo
     if !movable {
         return;
     }
-    use egui::{Key, Modifiers};
+    use egui::Key;
     let mut step = egui::Vec2::ZERO;
     ctx.input_mut(|i| {
-        for (key, direction) in
-            [(Key::ArrowLeft, vec2(-1.0, 0.0)), (Key::ArrowRight, vec2(1.0, 0.0)), (Key::ArrowUp, vec2(0.0, -1.0)), (Key::ArrowDown, vec2(0.0, 1.0))]
-        {
-            // The modified patterns first: a plain one also matches a Shift press.
-            if i.consume_key(Modifiers::COMMAND, key) || i.consume_key(Modifiers::SHIFT, key) {
-                step += direction * 10.0;
-            } else if i.consume_key(Modifiers::NONE, key) {
-                step += direction;
+        // Only an arrow pressed alone or with ⌘/Ctrl or Shift, judged by each press's own
+        // modifiers. Alt+← / Alt+→ go back and forward through the view history in
+        // `canvas::shortcuts` (#3632), and egui's key patterns would let an extra Alt through.
+        // A Ctrl that isn't the command key (macOS) is left alone, as the patterns left it.
+        i.events.retain(|e| {
+            let egui::Event::Key { key, pressed: true, modifiers, .. } = e else { return true };
+            if modifiers.alt || (modifiers.ctrl && !modifiers.command) {
+                return true;
             }
-        }
+            let direction = match key {
+                Key::ArrowLeft => vec2(-1.0, 0.0),
+                Key::ArrowRight => vec2(1.0, 0.0),
+                Key::ArrowUp => vec2(0.0, -1.0),
+                Key::ArrowDown => vec2(0.0, 1.0),
+                _ => return true,
+            };
+            step += direction * if modifiers.command || modifiers.shift { 10.0 } else { 1.0 };
+            false
+        });
     });
     if step == egui::Vec2::ZERO {
         return;
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 3a3169576c..3351013c24 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -1004,6 +1004,38 @@ fn arrow_keys_nudge_the_selected_comment() {
     assert_eq!(h.state().views[0].current, 1, "and the view goes to the next page");
 }
 
+/// #3632: with a comment selected, Alt+← / Alt+→ still go back and forward through the view
+/// history instead of nudging it (egui's key patterns let an extra Alt through).
+#[test]
+fn alt_arrows_navigate_instead_of_nudging_the_selected_comment() {
+    use egui::{Key, Modifiers};
+    let mut h = harness(|app| app.set_option("quick", "square").unwrap());
+    drag_pt(&mut h, (40.0, 100.0), (140.0, 40.0));
+    h.state_mut().set_option("quick", "select").unwrap();
+    click_pt(&mut h, (90.0, 70.0));
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 0)));
+    let before = comments(&h)[0].rect;
+    // A followed link's jump to page 2 and back, as `go_to_dest` makes it.
+    h.state_mut().views[0].go_to_page(1);
+    h.run_steps(2);
+    h.state_mut().views[0].go_to_page(0);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 0)), "still selected, so a nudge could take the keys");
+    h.key_press_modifiers(Modifiers::ALT, Key::ArrowLeft);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].current, 1, "Alt+← went back");
+    h.key_press_modifiers(Modifiers::ALT, Key::ArrowRight);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].current, 0, "Alt+→ went forward");
+    assert_eq!(comments(&h)[0].rect, before, "the comment didn't move");
+    let id = h.state().views[0].id;
+    assert_ne!(h.state().session.get(id).unwrap().can_undo(), Some("Move comment"), "nothing was nudged");
+    // A plain arrow still nudges it.
+    h.key_press(Key::ArrowRight);
+    h.run_steps(3);
+    assert!(comments(&h)[0].rect[0] > before[0], "→ nudged it");
+}
+
 #[test]
 fn a_shape_just_drawn_resizes_from_its_handles_without_the_select_tool() {
     // #2338: the new shape showed its handles, but only the Select tool answered them.

From dda63fda0fe4c9534c7507539270d100a8925966 Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Tue, 20 Oct 2026 23:09:54 -0400
Subject: [PATCH 099/270] Window title: mark unsaved changes, and set it on the
 web (#3640)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The title now reads "<name> • — PdfCraft" while the active document
has unsaved changes, as the other Craft apps write it, and goes back to
"<name> — PdfCraft" once saved.

eframe's web runner ignores ViewportCommand::Title, so the web build
never named the open document. It now also sets the page's
document.title, which an embedding host reads to confirm which document
opened and whether it has unsaved changes.
---
 crates/ui-egui/src/app.rs                | 13 ++++++++--
 crates/ui-egui/tests/it/accessibility.rs |  2 +-
 crates/ui-egui/tests/it/viewer.rs        | 33 +++++++++++++++++++++---
 3 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
index 23bee9babc..352178bb7b 100644
--- a/crates/ui-egui/src/app.rs
+++ b/crates/ui-egui/src/app.rs
@@ -546,14 +546,23 @@ impl eframe::App for PdfCraftApp {
         for view in &mut self.views {
             view.begin_render_frame();
         }
-        // The window shows the active document's name (or title, if it asks for that).
+        // The window shows the active document's name (or title, if it asks for that), with •
+        // while it has unsaved changes, as the other Craft apps write it (#3640).
+        let view = self.active.and_then(|i| self.views.get(i));
+        let dirty = view.and_then(|v| self.session.get(v.id)).is_some_and(|d| d.dirty);
+        let mark = if dirty { " •" } else { "" };
         let title = self
             .active
             .and_then(|i| crate::canvas::tab_label(self, i))
             .or_else(|| self.combine_showing().then(|| tl!("Combine files").to_owned()))
-            .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name} — PdfCraft"));
+            .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name}{mark} — PdfCraft"));
         if title != self.window_title {
             ctx.send_viewport_cmd(egui::ViewportCommand::Title(title.clone()));
+            // eframe's web runner ignores Title: set the page's own, which an embedding host reads.
+            #[cfg(target_arch = "wasm32")]
+            if let Some(document) = web_sys::window().and_then(|w| w.document()) {
+                document.set_title(&title);
+            }
             self.window_title = title;
         }
         // The accessible window takes the same name, so a screen reader (AT-SPI on Linux, UIA on
diff --git a/crates/ui-egui/tests/it/accessibility.rs b/crates/ui-egui/tests/it/accessibility.rs
index 7d13df6adc..eebfc40020 100644
--- a/crates/ui-egui/tests/it/accessibility.rs
+++ b/crates/ui-egui/tests/it/accessibility.rs
@@ -91,7 +91,7 @@ fn checking_fixing_skipping_and_reporting() {
     assert_eq!(status(&h, Rule::Title), Status::Passed);
     assert_eq!(h.state().a11y.previous.as_ref().unwrap().1.result(Rule::Title).unwrap().status, Status::Failed);
     assert!(matches!(h.state().dialog, Some(Dialog::Properties(_))));
-    assert_eq!(h.state().window_title, "notes — PdfCraft");
+    assert_eq!(h.state().window_title, "notes • — PdfCraft");
     h.state_mut().dialog = None;
     h.run_steps(2);
     h.get_by_label("Compare");
diff --git a/crates/ui-egui/tests/it/viewer.rs b/crates/ui-egui/tests/it/viewer.rs
index f2a12b69aa..0db837f901 100644
--- a/crates/ui-egui/tests/it/viewer.rs
+++ b/crates/ui-egui/tests/it/viewer.rs
@@ -974,10 +974,36 @@ fn tab_and_window_show_the_document_title_when_asked() {
         s.session.apply(id, Edit::SetInitialView(Box::new(v))).unwrap();
     }
     h.run_steps(2);
-    assert_eq!(h.state().window_title, "Quarterly report — PdfCraft");
+    // The edits are unsaved, so the title says so (#3640).
+    assert_eq!(h.state().window_title, "Quarterly report • — PdfCraft");
     h.get_by_label_contains("Quarterly report");
 }
 
+#[test]
+fn the_window_title_marks_unsaved_changes_until_saved() {
+    use pdfcraft_engine::Edit;
+    let mut h = harness();
+    h.run_steps(2);
+    assert_eq!(h.state().window_title, "b.pdf — PdfCraft");
+    {
+        let s = h.state_mut();
+        let id = s.views[s.active.unwrap()].id;
+        s.session.apply(id, Edit::SetInfo { key: "Subject".into(), value: "Budget".into() }).unwrap();
+    }
+    h.run_steps(2);
+    assert_eq!(h.state().window_title, "b.pdf • — PdfCraft", "unsaved changes (#3640)");
+    // Saved under its own name, so the title changes only by the mark.
+    let dir = std::env::temp_dir().join(format!("pdfcraft-title-dirty-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    h.state_mut().save_override = Some(dir.join("b.pdf").to_string_lossy().into_owned());
+    assert!(h.state_mut().execute("file.save"));
+    h.run_steps(2);
+    let _ = std::fs::remove_dir_all(&dir);
+    let s = h.state();
+    assert!(!s.session.get(s.views[s.active.unwrap()].id).unwrap().dirty);
+    assert_eq!(s.window_title, "b.pdf — PdfCraft", "saved");
+}
+
 #[test]
 fn a_placeholder_title_leaves_the_file_name_on_the_tab_and_window() {
     // A browser's "Save as PDF" of a blank page or pop-up titles the document "about:blank"
@@ -993,7 +1019,7 @@ fn a_placeholder_title_leaves_the_file_name_on_the_tab_and_window() {
         s.session.apply(id, Edit::SetInitialView(Box::new(v))).unwrap();
     }
     h.run_steps(2);
-    assert_eq!(h.state().window_title, "b.pdf — PdfCraft");
+    assert_eq!(h.state().window_title, "b.pdf • — PdfCraft");
     assert!(h.query_by_label_contains("about:blank").is_none());
 }
 
@@ -2265,6 +2291,7 @@ fn the_accessible_window_has_the_window_title_as_its_name() {
         s.session.apply(id, Edit::SetInitialView(Box::new(v))).unwrap();
     }
     h.run_steps(2);
-    assert_eq!(name(&h).as_deref(), Some("Quarterly report — PdfCraft"));
+    // Unsaved, so it carries the window title's mark too (#3640).
+    assert_eq!(name(&h).as_deref(), Some("Quarterly report • — PdfCraft"));
     assert_eq!(name(&h), Some(h.state().window_title.clone()));
 }

From 75f9c48c3958c325520e6b6392ee6249cd5c3efb Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 28 Oct 2026 14:10:44 -0400
Subject: [PATCH 100/270] M3: the window-title save test removes its temp
 folder even when an assert fails (#3640)

---
 crates/ui-egui/tests/it/viewer.rs | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/crates/ui-egui/tests/it/viewer.rs b/crates/ui-egui/tests/it/viewer.rs
index 0db837f901..e151f4cfca 100644
--- a/crates/ui-egui/tests/it/viewer.rs
+++ b/crates/ui-egui/tests/it/viewer.rs
@@ -992,13 +992,19 @@ fn the_window_title_marks_unsaved_changes_until_saved() {
     }
     h.run_steps(2);
     assert_eq!(h.state().window_title, "b.pdf • — PdfCraft", "unsaved changes (#3640)");
+    // Removed on drop, so a failing assert below doesn't leave it behind.
+    struct Dir(std::path::PathBuf);
+    impl Drop for Dir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+    let dir = Dir(std::env::temp_dir().join(format!("pdfcraft-title-dirty-{}", std::process::id())));
+    std::fs::create_dir_all(&dir.0).unwrap();
     // Saved under its own name, so the title changes only by the mark.
-    let dir = std::env::temp_dir().join(format!("pdfcraft-title-dirty-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    h.state_mut().save_override = Some(dir.join("b.pdf").to_string_lossy().into_owned());
+    h.state_mut().save_override = Some(dir.0.join("b.pdf").to_string_lossy().into_owned());
     assert!(h.state_mut().execute("file.save"));
     h.run_steps(2);
-    let _ = std::fs::remove_dir_all(&dir);
     let s = h.state();
     assert!(!s.session.get(s.views[s.active.unwrap()].id).unwrap().dirty);
     assert_eq!(s.window_title, "b.pdf — PdfCraft", "saved");

From 4b73850671221f64a4668129e70126ff74f477f1 Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 28 Oct 2026 21:07:09 -0400
Subject: [PATCH 101/270] M3: the title marks drafts not yet applied, and the
 web page title names the file (#3640)

The dirty mark now follows has_unsaved_work, the same test the close
prompt uses, so text typed into a field or text box shows the mark before
it is applied. The web page's title, which an embedding host reads to tell
which file opened, now always names the file, even when the document asks
to show its own title; the native window title is unchanged.
---
 crates/ui-egui/src/app.rs         | 29 +++++++++++++++----------
 crates/ui-egui/src/lib.rs         |  2 ++
 crates/ui-egui/tests/it/viewer.rs | 36 +++++++++++++++++++++++++++++++
 3 files changed, 56 insertions(+), 11 deletions(-)

diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
index 352178bb7b..54f8717960 100644
--- a/crates/ui-egui/src/app.rs
+++ b/crates/ui-egui/src/app.rs
@@ -198,6 +198,7 @@ impl PdfCraftApp {
             field_table_draft: None,
             form_preview: false,
             window_title: String::new(),
+            page_title: String::new(),
             recovery: None,
             recoverable: Vec::new(),
             recovery_keys: Default::default(),
@@ -547,23 +548,29 @@ impl eframe::App for PdfCraftApp {
             view.begin_render_frame();
         }
         // The window shows the active document's name (or title, if it asks for that), with •
-        // while it has unsaved changes, as the other Craft apps write it (#3640).
-        let view = self.active.and_then(|i| self.views.get(i));
-        let dirty = view.and_then(|v| self.session.get(v.id)).is_some_and(|d| d.dirty);
+        // while it has unsaved changes, as the other Craft apps write it (#3640). Unsaved means
+        // what closing would ask about, so a draft not yet applied counts too.
+        let dirty = self.active.is_some_and(|i| self.has_unsaved_work(i));
         let mark = if dirty { " •" } else { "" };
-        let title = self
-            .active
-            .and_then(|i| crate::canvas::tab_label(self, i))
-            .or_else(|| self.combine_showing().then(|| tl!("Combine files").to_owned()))
-            .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name}{mark} — PdfCraft"));
+        let titled = |name: Option<String>| {
+            name.or_else(|| self.combine_showing().then(|| tl!("Combine files").to_owned()))
+                .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name}{mark} — PdfCraft"))
+        };
+        let title = titled(self.active.and_then(|i| crate::canvas::tab_label(self, i)));
+        // The web page's title is what an embedding host reads to tell which file opened, so it
+        // names the file even when the document asks to show its own title.
+        let page_title = titled(self.active.and_then(|i| self.views.get(i)).and_then(|v| self.session.get(v.id)).map(|d| d.name.clone()));
         if title != self.window_title {
             ctx.send_viewport_cmd(egui::ViewportCommand::Title(title.clone()));
-            // eframe's web runner ignores Title: set the page's own, which an embedding host reads.
+            self.window_title = title;
+        }
+        if page_title != self.page_title {
+            // eframe's web runner ignores Title: set the page's own.
             #[cfg(target_arch = "wasm32")]
             if let Some(document) = web_sys::window().and_then(|w| w.document()) {
-                document.set_title(&title);
+                document.set_title(&page_title);
             }
-            self.window_title = title;
+            self.page_title = page_title;
         }
         // The accessible window takes the same name, so a screen reader (AT-SPI on Linux, UIA on
         // Windows) can tell it apart (#4614). egui builds the root node afresh every pass.
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 8a8c51775a..f8237f7fa6 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -566,6 +566,8 @@ pub struct PdfCraftApp {
     fonts_cjk: theme::CjkPreference,
     /// The window title last sent to the platform.
     pub window_title: String,
+    /// The web page's title last set: the window title, but always with the file's name.
+    pub page_title: String,
     /// The UI control channel, when enabled (`--control`; off by default).
     control: Option<control::Control>,
     /// A bookmark being renamed in the Bookmarks panel: (path, text so far).
diff --git a/crates/ui-egui/tests/it/viewer.rs b/crates/ui-egui/tests/it/viewer.rs
index e151f4cfca..b08c7bd702 100644
--- a/crates/ui-egui/tests/it/viewer.rs
+++ b/crates/ui-egui/tests/it/viewer.rs
@@ -1010,6 +1010,42 @@ fn the_window_title_marks_unsaved_changes_until_saved() {
     assert_eq!(s.window_title, "b.pdf — PdfCraft", "saved");
 }
 
+/// #3640: text typed but not yet applied is unsaved work too, as closing the tab says, so the
+/// title marks it.
+#[test]
+fn the_window_title_marks_a_draft_that_is_not_applied_yet() {
+    use pdfcraft_ui_egui::fill_sign::TypeBox;
+    let mut h = harness();
+    h.run_steps(2);
+    assert_eq!(h.state().window_title, "b.pdf — PdfCraft");
+    let i = h.state().active.unwrap();
+    h.state_mut().views[i].fill_text = Some(TypeBox { page: 0, at: [40.0, 200.0], text: "Typed".into(), size: 10.0, focus: false });
+    h.run_steps(2);
+    let s = h.state();
+    assert!(!s.session.get(s.views[i].id).unwrap().dirty, "nothing applied to the document yet");
+    assert_eq!(s.window_title, "b.pdf • — PdfCraft");
+    assert_eq!(s.page_title, "b.pdf • — PdfCraft");
+}
+
+/// #3640: a document that asks to show its own title shows it in the window, but the web page's
+/// title, which an embedding host reads to tell which file opened, keeps the file's name.
+#[test]
+fn the_web_page_title_names_the_file_when_the_document_shows_its_title() {
+    use pdfcraft_engine::Edit;
+    let mut h = harness();
+    {
+        let s = h.state_mut();
+        let id = s.views[s.active.unwrap()].id;
+        s.session.apply(id, Edit::SetInfo { key: "Title".into(), value: "Budget 2026".into() }).unwrap();
+        let mut v = s.session.get(id).unwrap().initial_view();
+        v.display_title = true;
+        s.session.apply(id, Edit::SetInitialView(Box::new(v))).unwrap();
+    }
+    h.run_steps(2);
+    assert_eq!(h.state().window_title, "Budget 2026 • — PdfCraft");
+    assert_eq!(h.state().page_title, "b.pdf • — PdfCraft");
+}
+
 #[test]
 fn a_placeholder_title_leaves_the_file_name_on_the_tab_and_window() {
     // A browser's "Save as PDF" of a blank page or pop-up titles the document "about:blank"

From 08f3991ab9808b71fa015f22d49dbc4720044c78 Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 28 Oct 2026 21:41:33 -0400
Subject: [PATCH 102/270] M5: Alt+Left / Alt+Right go back through the view
 history with a form field selected, judged by each press's modifiers (#3632)

Prepare's arrow nudge read the frame's Alt, so an Alt+arrow whose Alt was
let go in the same frame nudged the field instead. Each press's own
modifiers now decide, as for objects, pictures and comments.
---
 crates/ui-egui/src/tools/prepare.rs | 34 ++++++++++++++++-------------
 crates/ui-egui/tests/it/prepare.rs  | 34 +++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 15 deletions(-)

diff --git a/crates/ui-egui/src/tools/prepare.rs b/crates/ui-egui/src/tools/prepare.rs
index c5fa2b684e..e54bdd0468 100644
--- a/crates/ui-egui/src/tools/prepare.rs
+++ b/crates/ui-egui/src/tools/prepare.rs
@@ -618,30 +618,34 @@ pub(crate) fn delete_selected(view: &mut DocView) -> Option<Edit> {
 /// as the object nudge does (`object_ui::nudge_keys`) and as dragging it does (#2608). The keys
 /// are consumed before the view turns the page with them; one press is one undo step.
 pub(crate) fn nudge_keys(ctx: &egui::Context, view: &mut DocView, doc: &Document) {
-    // `consume_key` lets an extra Alt through, and Alt+↑/↓ belongs to Calculation order's move.
-    if ctx.egui_wants_keyboard_input() || view.prepare.grab.is_some() || ctx.input(|i| i.modifiers.alt) {
+    if ctx.egui_wants_keyboard_input() || view.prepare.grab.is_some() {
         return;
     }
     let Some((name, wi)) = view.prepare.selected.clone() else { return };
     let Some(w) = doc.form.iter().find(|f| f.name == name).and_then(|f| f.widgets.get(wi)) else { return };
     let Some(page) = w.page else { return };
     let Some(xf) = view.page_xform(page) else { return };
-    use egui::{Key, Modifiers};
+    use egui::Key;
     let mut step = egui::Vec2::ZERO;
     ctx.input_mut(|i| {
-        for (key, direction) in [
-            (Key::ArrowLeft, egui::vec2(-1.0, 0.0)),
-            (Key::ArrowRight, egui::vec2(1.0, 0.0)),
-            (Key::ArrowUp, egui::vec2(0.0, -1.0)),
-            (Key::ArrowDown, egui::vec2(0.0, 1.0)),
-        ] {
-            // Shift first: a plain key pattern also matches a Shift press.
-            if i.consume_key(Modifiers::SHIFT, key) {
-                step += direction * 10.0;
-            } else if i.consume_key(Modifiers::NONE, key) {
-                step += direction;
+        // Only an arrow pressed alone or with Shift, judged by each press's own modifiers (the
+        // frame's can differ when a key is let go in the same frame). Alt+← / Alt+→ go back and
+        // forward through the view history (#3632) and Alt+↑ / ↓ is Calculation order's move.
+        i.events.retain(|e| {
+            let egui::Event::Key { key, pressed: true, modifiers, .. } = e else { return true };
+            if modifiers.alt || modifiers.ctrl || modifiers.command || modifiers.mac_cmd {
+                return true;
             }
-        }
+            let direction = match key {
+                Key::ArrowLeft => egui::vec2(-1.0, 0.0),
+                Key::ArrowRight => egui::vec2(1.0, 0.0),
+                Key::ArrowUp => egui::vec2(0.0, -1.0),
+                Key::ArrowDown => egui::vec2(0.0, 1.0),
+                _ => return true,
+            };
+            step += direction * if modifiers.shift { 10.0 } else { 1.0 };
+            false
+        });
     });
     if step == egui::Vec2::ZERO {
         return;
diff --git a/crates/ui-egui/tests/it/prepare.rs b/crates/ui-egui/tests/it/prepare.rs
index 5c7850c2c0..838e04f85f 100644
--- a/crates/ui-egui/tests/it/prepare.rs
+++ b/crates/ui-egui/tests/it/prepare.rs
@@ -156,6 +156,40 @@ fn arrow_keys_nudge_the_selected_field_instead_of_turning_the_page() {
     assert_eq!(h.state().views[0].current, 0, "the arrows moved the field, not the page");
 }
 
+/// #3632: Alt+← / Alt+→ go back and forward through the view history with a field selected, and
+/// leave the field where it is, even when Alt is let go in the same frame as the arrow, so the
+/// frame has no modifiers and only the press carries Alt.
+#[test]
+fn alt_arrows_navigate_instead_of_nudging_the_selected_field() {
+    let mut h = harness();
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::InsertBlankPage { at: 1, width: 612.0, height: 792.0 }));
+    h.run_steps(2);
+    h.state_mut().execute("form.add.text");
+    h.run_steps(1);
+    let p = at(&h, 40.0, 250.0);
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(1);
+    h.drop_at(p);
+    h.run_steps(4);
+    let name = h.state().views[0].prepare.selected.clone().expect("the placed field is selected").0;
+    let before = rect_of(&h, &name);
+    h.state_mut().views[0].go_to_page(1);
+    h.run_steps(2);
+    h.state_mut().views[0].go_to_page(0);
+    h.run_steps(2);
+    assert!(h.state().views[0].prepare.selected.is_some(), "still selected, so a nudge could take the keys");
+    let arrow = |key, modifiers| egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers };
+    h.event(arrow(egui::Key::ArrowLeft, egui::Modifiers::ALT));
+    h.run_steps(4);
+    assert_eq!(h.state().views[0].current, 1, "an Alt+← press went back");
+    h.event(arrow(egui::Key::ArrowRight, egui::Modifiers::ALT));
+    h.run_steps(4);
+    assert_eq!(h.state().views[0].current, 0, "an Alt+→ press went forward");
+    assert_eq!(rect_of(&h, &name), before, "the field didn't move");
+}
+
 #[test]
 fn format_validate_and_calculate_tabs() {
     use pdfcraft_engine::form_scripts::{Calculate, Format, Validate};

From 3850c9f52e073e51f8e4a1665b3ae36fae6f8e66 Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Thu, 29 Oct 2026 00:37:47 -0400
Subject: [PATCH 103/270] M3: the titles follow a document opened while the
 window or tab is hidden (#3640)

eframe runs only App::logic while a window or browser tab is hidden, so a
?file= download that finished then opened the document without the titles
changing. The titles are now set at the end of logic as well as in ui.
---
 crates/ui-egui/src/app.rs         | 58 ++++++++++++++++++-------------
 crates/ui-egui/tests/it/viewer.rs | 25 +++++++++++++
 2 files changed, 58 insertions(+), 25 deletions(-)

diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
index 54f8717960..583b55a6bf 100644
--- a/crates/ui-egui/src/app.rs
+++ b/crates/ui-egui/src/app.rs
@@ -31,6 +31,37 @@ impl Default for PdfCraftApp {
 }
 
 impl PdfCraftApp {
+    /// The window's title and, on the web, the page's, from the active document (#3640). Done in
+    /// `logic` too, which also runs while the window or browser tab is hidden: a document opened
+    /// then (a `?file=` download finishing) still names the page an embedding host reads.
+    fn sync_titles(&mut self, ctx: &egui::Context) {
+        // The window shows the active document's name (or title, if it asks for that), with •
+        // while it has unsaved changes, as the other Craft apps write it (#3640). Unsaved means
+        // what closing would ask about, so a draft not yet applied counts too.
+        let dirty = self.active.is_some_and(|i| self.has_unsaved_work(i));
+        let mark = if dirty { " •" } else { "" };
+        let titled = |name: Option<String>| {
+            name.or_else(|| self.combine_showing().then(|| tl!("Combine files").to_owned()))
+                .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name}{mark} — PdfCraft"))
+        };
+        let title = titled(self.active.and_then(|i| crate::canvas::tab_label(self, i)));
+        // The web page's title is what an embedding host reads to tell which file opened, so it
+        // names the file even when the document asks to show its own title.
+        let page_title = titled(self.active.and_then(|i| self.views.get(i)).and_then(|v| self.session.get(v.id)).map(|d| d.name.clone()));
+        if title != self.window_title {
+            ctx.send_viewport_cmd(egui::ViewportCommand::Title(title.clone()));
+            self.window_title = title;
+        }
+        if page_title != self.page_title {
+            // eframe's web runner ignores Title: set the page's own.
+            #[cfg(target_arch = "wasm32")]
+            if let Some(document) = web_sys::window().and_then(|w| w.document()) {
+                document.set_title(&page_title);
+            }
+            self.page_title = page_title;
+        }
+    }
+
     /// Construct an application with the default session, panels, theme and control state.
     pub fn new() -> Self {
         Self {
@@ -528,6 +559,7 @@ impl eframe::App for PdfCraftApp {
         // Last, after everything that can open or answer the "save changes?" question.
         self.attend_save_prompt(ctx);
         self.sync_native_menu(ctx);
+        self.sync_titles(ctx);
     }
 
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
@@ -547,31 +579,7 @@ impl eframe::App for PdfCraftApp {
         for view in &mut self.views {
             view.begin_render_frame();
         }
-        // The window shows the active document's name (or title, if it asks for that), with •
-        // while it has unsaved changes, as the other Craft apps write it (#3640). Unsaved means
-        // what closing would ask about, so a draft not yet applied counts too.
-        let dirty = self.active.is_some_and(|i| self.has_unsaved_work(i));
-        let mark = if dirty { " •" } else { "" };
-        let titled = |name: Option<String>| {
-            name.or_else(|| self.combine_showing().then(|| tl!("Combine files").to_owned()))
-                .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name}{mark} — PdfCraft"))
-        };
-        let title = titled(self.active.and_then(|i| crate::canvas::tab_label(self, i)));
-        // The web page's title is what an embedding host reads to tell which file opened, so it
-        // names the file even when the document asks to show its own title.
-        let page_title = titled(self.active.and_then(|i| self.views.get(i)).and_then(|v| self.session.get(v.id)).map(|d| d.name.clone()));
-        if title != self.window_title {
-            ctx.send_viewport_cmd(egui::ViewportCommand::Title(title.clone()));
-            self.window_title = title;
-        }
-        if page_title != self.page_title {
-            // eframe's web runner ignores Title: set the page's own.
-            #[cfg(target_arch = "wasm32")]
-            if let Some(document) = web_sys::window().and_then(|w| w.document()) {
-                document.set_title(&page_title);
-            }
-            self.page_title = page_title;
-        }
+        self.sync_titles(&ctx);
         // The accessible window takes the same name, so a screen reader (AT-SPI on Linux, UIA on
         // Windows) can tell it apart (#4614). egui builds the root node afresh every pass.
         ctx.accesskit_node_builder(egui::accesskit_root_id(), |root| root.set_label(self.window_title.as_str()));
diff --git a/crates/ui-egui/tests/it/viewer.rs b/crates/ui-egui/tests/it/viewer.rs
index b08c7bd702..187a8057fd 100644
--- a/crates/ui-egui/tests/it/viewer.rs
+++ b/crates/ui-egui/tests/it/viewer.rs
@@ -1027,6 +1027,31 @@ fn the_window_title_marks_a_draft_that_is_not_applied_yet() {
     assert_eq!(s.page_title, "b.pdf • — PdfCraft");
 }
 
+/// #3640: a document that arrives while the window or browser tab is hidden, when eframe runs
+/// only `App::logic` and no frame is drawn, still gives the titles its name.
+#[test]
+fn a_document_opened_while_hidden_names_the_titles() {
+    let mut h = harness();
+    h.run_steps(2);
+    let before = h.state().views.len();
+    let bytes = pdfcraft_engine::Session::new().create_from_text("Arrived", "Arrived while hidden").unwrap();
+    h.state().inbox.lock().unwrap().push(("arrived.pdf".into(), bytes.to_vec()));
+    let ctx = h.ctx.clone();
+    let mut frame = eframe::Frame::_new_kittest();
+    // The open runs on a worker and is taken in by a later `logic`, as eframe keeps calling it.
+    for _ in 0..500 {
+        let _ = ctx.run_logic(&egui::RawInput::default(), |ctx| eframe::App::logic(h.state_mut(), ctx, &mut frame));
+        if h.state().views.len() > before {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    let s = h.state();
+    assert_eq!(s.views.len(), before + 1, "the document opened in logic");
+    assert_eq!(s.page_title, "arrived.pdf — PdfCraft");
+    assert_eq!(s.window_title, "arrived.pdf — PdfCraft");
+}
+
 /// #3640: a document that asks to show its own title shows it in the window, but the web page's
 /// title, which an embedding host reads to tell which file opened, keeps the file's name.
 #[test]

From 67b5b2dcf6b78718c8ac1f8091533ee4eaeaa98f Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Sat, 24 Oct 2026 08:20:34 +0200
Subject: [PATCH 104/270] A moved comment is drawn where it goes while it is
 dragged

Moving a rectangle, an oval or any other comment showed only its blue
frame going, the shape staying where it was until release. The comment is
now rendered alone once as the drag starts (Document::comment_layer: a
read-only copy with only that comment, no page content) and laid over the
page where it goes; the page beneath keeps showing it where it was until
the move is applied, as a CAD program's move does. Rendering the page
without it would cost a whole page's render at every drag on a heavy plan.
Stamps and Fill & Sign marks keep their own layers. annot: isolate_annotations
for several comments of a page, so a group can be drawn together.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ROADMAP.md                                  |   1 +
 crates/annot/src/lookup.rs                  |  29 +++-
 crates/engine/src/lib.rs                    |   2 +-
 crates/engine/src/stamp_preview.rs          |  59 ++++++-
 crates/engine/src/tests.rs                  |  38 +++++
 crates/ui-egui/src/canvas.rs                |   5 +
 crates/ui-egui/src/canvas/signature_drag.rs | 171 +++++++++++++++-----
 crates/ui-egui/tests/it/comments.rs         |  61 +++++++
 docs/ui-parity.md                           |   1 +
 parity/acrobat-features.toml                |  12 ++
 10 files changed, 330 insertions(+), 49 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index f5de8044e1..1793d39298 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -220,6 +220,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
   The regression checks two distinct appearances, inherited resources, print/reopen pixels and unchanged source data.
   Estimates unchanged.
 - **2026-10-21 (M3, window resize and move on Wayland):** With PdfCraft's own title bar on GNOME/Wayland, a second resize by a window edge, or a second move by the empty tab strip, works straight after the first; it waited for a click inside the window, because the compositor keeps the button's release from egui. A unit test covers the release given back; checked by hand in a test build. Estimates unchanged.
+- **2026-10-24 (M5, move preview):** A comment being moved is drawn where it goes while it is dragged (a rectangle or oval showed only its blue frame): the comment is rendered alone once as the drag starts and laid over the page, which shows it where it was until the move is applied. Engine `Document::comment_layer`; synthetic engine and UI regressions. Estimates unchanged.
 - **2026-10-22 (M4, #3916 partial):** Document edits and Undo/Redo cancel an Organize page drag. Pointer-release regressions check exact page order and save/reopen.
 - **2026-10-22 (M10, #3752 paper):** CUPS jobs ask for the chosen paper in every size. The 13 sizes the Print dialog sent no paper for (A6, A0–A2, ARCH, ANSI C–E) use PWG 5101.1 names, checked against a synthetic PPD with `cupsfilter`, and `doc_print` to a printer sends the paper too. The macOS tray half (Auto Select instead of the PPD's default tray) is a craft-print change that needs a pin bump here. Estimates unchanged.
 - **2026-10-22 (M14, macOS association recovery candidate):** Successful desktop open/save/sign can queue recovery of an existing per-file binding to the running PDFCraft bundle through NSWorkspace. Metadata-only watcher changes retain undo and avoid false overwrite prompts; real same-length/same-mtime edits remain protected. Rebased on 0.12.0 and reuses #3042's shared atomic metadata preservation; the bounded recovery parser does not narrow save limits. Prior native Preview TEST-signature and Finder workflows passed on macOS 27.0.1; other versions remain unqualified. Estimates unchanged.
diff --git a/crates/annot/src/lookup.rs b/crates/annot/src/lookup.rs
index c81ec78ef4..50097a5e9f 100644
--- a/crates/annot/src/lookup.rs
+++ b/crates/annot/src/lookup.rs
@@ -226,16 +226,31 @@ pub fn picture_rotation(doc: &Document, page: usize, index: usize) -> Result<i64
 /// over the page while it is dragged. `false`, with `doc` unchanged, when the annotation has no
 /// normal appearance (`/AP /N`) for that render to draw.
 pub fn isolate_annotation(doc: &mut Document, page: usize, index: usize) -> Result<bool, AnnotError> {
+    isolate_annotations(doc, page, &[index])
+}
+
+/// [`isolate_annotation`] for several annotations of one page: those of them with a normal
+/// appearance stay, in their order on the page. `false`, with `doc` unchanged, when none has one.
+pub fn isolate_annotations(doc: &mut Document, page: usize, indices: &[usize]) -> Result<bool, AnnotError> {
     let p = page_ref(doc, page)?;
-    let entry = annots(doc, p).get(index).cloned().ok_or(AnnotError::NoSuchAnnotation { page, index })?;
-    let has_normal = {
-        let obj = doc.resolve(&entry);
-        obj.as_dict().and_then(|d| d.get(b"AP")).is_some_and(|ap| doc.resolve(ap).as_dict().is_some_and(|ap| ap.contains(b"N")))
-    };
-    if !has_normal {
+    let list = annots(doc, p);
+    let mut kept = Vec::new();
+    for (index, entry) in list.iter().enumerate() {
+        if !indices.contains(&index) {
+            continue;
+        }
+        let obj = doc.resolve(entry);
+        if obj.as_dict().and_then(|d| d.get(b"AP")).is_some_and(|ap| doc.resolve(ap).as_dict().is_some_and(|ap| ap.contains(b"N"))) {
+            kept.push(entry.clone());
+        }
+    }
+    if let Some(&index) = indices.iter().find(|&&i| i >= list.len()) {
+        return Err(AnnotError::NoSuchAnnotation { page, index });
+    }
+    if kept.is_empty() {
         return Ok(false);
     }
-    set_annots(doc, p, vec![entry])?;
+    set_annots(doc, p, kept)?;
     doc.update_dict(p, |d| {
         d.remove(b"Contents");
     })?;
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index c41c0466c4..cb3297b9d2 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -66,7 +66,7 @@ pub use links::{
 };
 pub use signature_image::{ImageSignaturePreview, SignatureImage};
 pub use signature_scan::{PhotoRect, ScanError, SignaturePhoto, Turn};
-pub use stamp_preview::StampPreview;
+pub use stamp_preview::{CommentLayer, StampPreview};
 pub use text_preview::{TextEditPreview, UnmarkedPages};
 
 pub use pdfcraft_organize::{BoxSpec, FieldConflicts, PageBox, SplitBy, Transition, TransitionSpec, mime_for_name, split_ranges};
diff --git a/crates/engine/src/stamp_preview.rs b/crates/engine/src/stamp_preview.rs
index 6e5758a7ce..e6307234ae 100644
--- a/crates/engine/src/stamp_preview.rs
+++ b/crates/engine/src/stamp_preview.rs
@@ -1,4 +1,5 @@
-//! A stamp while it is moved or resized: the page without it, and the stamp alone.
+//! A stamp while it is moved or resized: the page without it, and the stamp alone. Any other
+//! comment while it is moved: the comment alone.
 
 use std::sync::Arc;
 
@@ -81,3 +82,59 @@ impl Document {
         })?
     }
 }
+
+/// Comments alone on a transparent page, for drawing them where they go while they are moved.
+/// The page beneath keeps showing them where they were until the move is applied: rendering the page
+/// without it would cost a whole page's render at every drag on a heavy plan. Read-only, as
+/// [`StampPreview`] is.
+pub struct CommentLayer {
+    page: usize,
+    bytes: Arc<Vec<u8>>,
+    config: RenderConfig,
+}
+
+impl CommentLayer {
+    /// One worker for the comments alone: their page has no content and no other annotations.
+    pub fn renderer(&self) -> RenderPool {
+        RenderPool::new(self.bytes.clone(), 1, self.transparent())
+    }
+
+    /// The comments alone, rendered synchronously with the renderer's normal pixel limits.
+    pub fn render(&self, scale: f32) -> Result<RenderedPage, String> {
+        if !scale.is_finite() || scale <= 0.0 {
+            return Err("preview scale must be finite and positive".into());
+        }
+        guard(|| {
+            let out =
+                PageRenderer::new(self.bytes.clone(), self.transparent()).render(RenderRequest { page: self.page, scale, ..Default::default() });
+            if let Some(e) = &out.error {
+                return Err(e.clone());
+            }
+            Ok(out)
+        })?
+    }
+
+    fn transparent(&self) -> RenderConfig {
+        RenderConfig { transparent: true, ..self.config.clone() }
+    }
+}
+
+impl Document {
+    /// The comments at `indices` on `page` alone (the ones moved together), drawn as on screen:
+    /// one without an appearance of its own gets the one the page view draws. `None` when one
+    /// of them doesn't exist or none has anything to draw.
+    pub fn comment_layer(&self, page: usize, indices: &[usize]) -> Result<Option<CommentLayer>, String> {
+        guard(|| {
+            let editor = self.editor.as_ref().ok_or("the document can't be read")?;
+            if indices.is_empty() || !indices.iter().all(|&i| self.info.annotations.iter().any(|a| a.page == page && a.index == i)) {
+                return Ok(None);
+            }
+            let mut alone = pdfcraft_annot::with_missing_appearances(&editor.cos).unwrap_or_else(|| editor.cos.clone());
+            if !pdfcraft_annot::isolate_annotations(&mut alone, page, indices).map_err(|e| e.to_string())? {
+                return Ok(None);
+            }
+            let bytes = write_incremental(&alone, &SaveOptions::default()).map(Arc::new).map_err(|e| e.to_string())?;
+            Ok(Some(CommentLayer { page, bytes, config: self.config.clone() }))
+        })?
+    }
+}
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 6a68916dff..f59f8af159 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -3485,6 +3485,44 @@ trailer << /Root 1 0 R >>
     assert!(doc.stamp_preview(0, 1).unwrap().is_none(), "a stamp without an appearance");
 }
 
+/// A moved comment's layer: the comment alone on a transparent page (no page text, no other
+/// comment), drawn as on screen, another app's comment without an appearance too. Preparing it
+/// changes nothing in the document.
+#[test]
+fn comment_layer_draws_the_comment_alone() {
+    let (mut s, id) = session_with(1);
+    s.apply(id, rect_comment(0, [140.0, 40.0, 190.0, 90.0])).unwrap();
+    s.apply(id, rect_comment(0, [20.0, 20.0, 60.0, 60.0])).unwrap();
+    let doc = s.get(id).unwrap();
+    let (generation, dirty) = (doc.edit_generation(), doc.dirty);
+    let layer = doc.comment_layer(0, &[0]).unwrap().expect("a rectangle").render(1.0).unwrap();
+    let px = |p: &pdfcraft_render::RenderedPage, x: u32, y: u32| -> [u8; 4] {
+        p.rgba[(((300 - y) * p.width + x) * 4) as usize..][..4].try_into().unwrap()
+    };
+    assert_eq!(px(&layer, 165, 65), [255, 0, 0, 255], "the rectangle is drawn");
+    let near = |x: u32, y: u32| (137..=193).contains(&x) && (37..=93).contains(&y);
+    let stray: Vec<(u32, u32)> =
+        (1..300).flat_map(|y| (0..200).map(move |x| (x, y))).filter(|&(x, y)| !near(x, y) && px(&layer, x, y) != [0, 0, 0, 0]).collect();
+    assert!(stray.is_empty(), "only the rectangle is on its layer: {:?}", &stray[..stray.len().min(8)]);
+    assert!(doc.comment_layer(0, &[9]).unwrap().is_none(), "no such comment");
+    let both = doc.comment_layer(0, &[0, 1]).unwrap().expect("both").render(1.0).unwrap();
+    assert_eq!((px(&both, 165, 65), px(&both, 40, 40)), ([255, 0, 0, 255], [255, 0, 0, 255]), "moved together, drawn together");
+    let doc = s.get(id).unwrap();
+    assert_eq!((doc.edit_generation(), doc.dirty, doc.can_undo()), (generation, dirty, Some("Add rectangle")), "the document is unchanged");
+
+    let bare = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /Annots [4 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Square /Rect [140 40 190 90] /C [1 0 0] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let mut s = Session::new();
+    let id = s.open("bare.pdf", None, Arc::new(bare.to_vec()), None).unwrap();
+    let layer = s.get(id).unwrap().comment_layer(0, &[0]).unwrap().expect("drawn as on screen").render(1.0).unwrap();
+    assert!((138..=142).any(|x| px(&layer, x, 65)[..3] == [255, 0, 0]), "the square without an appearance is drawn");
+}
+
 #[test]
 fn flattening_fill_and_sign_keeps_other_comments_fields_and_undoes() {
     let (mut s, id) = session_with(1);
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 91d2c41367..35069064de 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1743,6 +1743,11 @@ fn draw_page(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, i
     let preview_target = (matches!(tool, QuickTool::Select | QuickTool::Fill(_)) && !comments_hidden).then_some(view.comments.selected).flatten();
     view.signature_drag.prepare(ui.ctx(), doc, preview_target, scale);
     view.signature_drag.paint(painter, &pcx, &view.comments, view.pending_edit.as_ref());
+    // Any other comment being moved: drawn where it goes, over the page that still shows it
+    // where it was.
+    let stale = view.signature_drag.moving_page().is_some_and(|p| view.page_out_of_date(p));
+    view.signature_drag.prepare_move(ui.ctx(), doc, &view.comments, view.pending_edit.as_ref(), stale, scale);
+    view.signature_drag.paint_move(painter, &pcx, &view.comments, view.pending_edit.as_ref());
 
     // Any press on the page ends Select All of the document: text read or not, any tool,
     // on a link too.
diff --git a/crates/ui-egui/src/canvas/signature_drag.rs b/crates/ui-egui/src/canvas/signature_drag.rs
index e574d68ec4..c864d5354a 100644
--- a/crates/ui-egui/src/canvas/signature_drag.rs
+++ b/crates/ui-egui/src/canvas/signature_drag.rs
@@ -1,5 +1,6 @@
 //! Cached page and stamp layers: a stamp (an image signature, a Fill & Sign mark, any other stamp)
-//! follows each pointer frame, moved or resized, without editing the PDF.
+//! follows each pointer frame, moved or resized, without editing the PDF. Any other comment
+//! follows the pointer while it is moved: its own layer is drawn where it goes.
 
 use egui::{ColorImage, TextureHandle, TextureOptions, pos2, vec2};
 use pdfcraft_engine::{Document, Edit};
@@ -16,6 +17,16 @@ pub(crate) struct SignatureDrag {
     key: Option<(u64, usize, usize)>,
     aspect_ratio: Option<f32>,
     layers: Option<Layers>,
+    /// The comment being moved that has no stamp layers: (edit generation, page, index), and
+    /// the comment alone, drawn over the page where it goes.
+    moving: Option<((u64, usize, usize), Moving)>,
+}
+
+struct Moving {
+    /// The comment's layer: `from` is its box when the move started.
+    layer: StampLayer,
+    /// Released and applied: keep it where it went until the page shows it there.
+    settling: bool,
 }
 
 struct Layers {
@@ -109,29 +120,14 @@ impl SignatureDrag {
         let mut pending = layers.received_tag != Some(tag);
         // The stamp itself is small: it stays sharp at every zoom.
         if let Front::Stamp(stamp) = &mut layers.front {
-            let Some((scale, tile)) = stamp_tile(p, stamp.from, scale) else {
+            match stamp.update(ctx, page, p, scale) {
+                Some(waiting) => pending |= waiting,
                 // Nothing to lay over the page: the frame alone follows the pointer, as before.
-                self.layers = None;
-                return;
-            };
-            let tag = (scale * 1000.0) as u64;
-            if stamp.tag != Some(tag) {
-                stamp.renderer.set_queue(vec![RenderRequest { page, scale, tag, tile: Some(tile), ..Default::default() }]);
-                stamp.tag = Some(tag);
-            }
-            if let Some(out) = stamp.renderer.try_recv()
-                && out.request.tag == tag
-            {
-                let (Some(t), None) = (out.request.tile, &out.error) else {
+                None => {
                     self.layers = None;
                     return;
-                };
-                let s = out.request.scale;
-                let area = [t.x as f32 / s, t.y as f32 / s, t.x.saturating_add(t.w) as f32 / s, t.y.saturating_add(t.h) as f32 / s];
-                let image = crate::canvas::texture_image([out.width as usize, out.height as usize], out.rgba);
-                stamp.pixels = Some((tag, ctx.load_texture("signature-drag-stamp", image, TextureOptions::LINEAR), area));
+                }
             }
-            pending |= stamp.pixels.as_ref().is_none_or(|(received, ..)| *received != tag);
         }
         if pending {
             ctx.request_repaint_after(std::time::Duration::from_millis(16));
@@ -150,6 +146,14 @@ impl SignatureDrag {
 
     /// Movement/resizing only change this stamp's geometry, so its layers are reusable.
     pub fn committed(&mut self, edit: &Edit, generation: u64) {
+        if let Some((key, m)) = self.moving.as_mut()
+            && matches!(edit, Edit::MoveAnnotation { page, index, .. } if (*page, *index) == (key.1, key.2))
+        {
+            key.0 = generation;
+            m.settling = true;
+        } else {
+            self.moving = None;
+        }
         if let Edit::MoveAnnotation { page, index, .. } | Edit::ResizeAnnotation { page, index, .. } = edit
             && self.contains(*page, *index)
         {
@@ -158,7 +162,7 @@ impl SignatureDrag {
                 layers.settling = true;
             }
         } else {
-            *self = Self::default();
+            *self = Self { moving: self.moving.take(), ..Self::default() };
         }
     }
 
@@ -199,27 +203,114 @@ impl SignatureDrag {
                 *turn,
                 egui::Color32::from_white_alpha((opacity * 255.0).round() as u8),
             ),
-            Front::Stamp(stamp) => {
-                let Some((_, texture, area)) = &stamp.pixels else { return };
-                // Where the stamp's pixels were rendered, stretched as its box is from `from` to `rect`.
-                let from = cx.xf.user_rect(cx.info, page, stamp.from);
-                if from.width() < 0.01 || from.height() < 0.01 {
-                    return;
-                }
-                let stretch = vec2(rect.width() / from.width(), rect.height() / from.height());
-                let mut mesh = egui::Mesh::with_texture(texture.id());
-                for (u, v) in [(0.0, 0.0), (1.0, 0.0), (1.0, 1.0), (0.0, 1.0)] {
-                    let (x, y) = (area[0] + u * (area[2] - area[0]), area[1] + v * (area[3] - area[1]));
-                    let at = cx.xf.norm_to_screen(x / cx.xf.pw, y / cx.xf.ph);
-                    let pos = rect.min + (at - from.min) * stretch;
-                    mesh.vertices.push(egui::epaint::Vertex { pos, uv: pos2(u, v), color: egui::Color32::WHITE });
-                }
-                mesh.add_triangle(0, 1, 2);
-                mesh.add_triangle(0, 2, 3);
-                painter.add(egui::Shape::mesh(mesh));
-            }
+            Front::Stamp(stamp) => stamp.paint(&painter, cx, page, rect),
         }
     }
+
+    /// The page of the comment being moved, whose raster [`Self::prepare_move`] asks about.
+    pub fn moving_page(&self) -> Option<usize> {
+        self.moving.as_ref().map(|((_, page, _), _)| *page)
+    }
+
+    /// While a comment without stamp layers is moved, its own layer: rendered when the move
+    /// starts, kept after release until the page's raster shows it where it went (`stale`: the
+    /// page is still drawn as before its last change).
+    pub fn prepare_move(&mut self, ctx: &egui::Context, doc: &Document, cv: &CommentView, pending: Option<&Edit>, stale: bool, scale: f32) {
+        let generation = doc.edit_generation();
+        let dragged = match cv.gesture {
+            Some(Gesture::Move { page, index, .. }) if !self.contains(page, index) => Some((generation, page, index)),
+            _ => None,
+        };
+        let keep = |key: (u64, usize, usize), m: &Moving| {
+            let (_, page, index) = key;
+            dragged == Some(key)
+                || matches!(pending, Some(Edit::MoveAnnotation { page: p, index: i, .. }) if (*p, *i) == (page, index))
+                || m.settling && stale
+        };
+        if self.moving.as_ref().is_some_and(|(key, m)| !keep(*key, m)) {
+            self.moving = None;
+        }
+        if self.moving.is_none()
+            && let Some(key @ (_, page, index)) = dragged
+            && let Some(a) = doc.info.annotations.iter().find(|a| a.page == page && a.index == index && !a.locked)
+            && let Ok(Some(alone)) = doc.comment_layer(page, &[index])
+        {
+            let layer = StampLayer { renderer: alone.renderer(), from: a.rect, tag: None, pixels: None };
+            self.moving = Some((key, Moving { layer, settling: false }));
+        }
+        let Some(((_, page, _), m)) = self.moving.as_mut() else { return };
+        let Some(p) = doc.info.pages.get(*page) else { return };
+        match m.layer.update(ctx, *page, p, scale) {
+            Some(pending) => {
+                if pending {
+                    ctx.request_repaint_after(std::time::Duration::from_millis(16));
+                }
+            }
+            // Nothing to lay over the page: the frame alone follows the pointer, as before.
+            None => self.moving = None,
+        }
+    }
+
+    /// The comment being moved, drawn where it goes (as far as its frame has gone).
+    pub fn paint_move(&self, painter: &egui::Painter, cx: &PageCx<'_>, cv: &CommentView, pending: Option<&Edit>) {
+        let Some(((_, page, index), m)) = &self.moving else { return };
+        if *page != cx.page || cx.hidden {
+            return;
+        }
+        let Some(a) = cx.get(*index) else { return };
+        let (pointer, shift) = painter.ctx().input(|i| (i.pointer.hover_pos(), i.modifiers.shift));
+        // As far as its frame has gone from where the move started (once applied, its box is
+        // already where it went).
+        let rect = cx.adjusted_rect(a, cv.gesture.as_ref(), pointer, shift, pending);
+        let from = cx.xf.user_rect(cx.info, *page, m.layer.from);
+        let painter = painter.with_clip_rect(painter.clip_rect().intersect(cx.xf.rect));
+        m.layer.paint(&painter, cx, *page, from.translate(rect.min - from.min));
+    }
+}
+
+impl StampLayer {
+    /// Render the layer's tile at `scale` (or less, within [`MAX_STAMP_SIDE`]) and take it when
+    /// it arrives. `Some(true)` while the pixels at this scale are still on their way, `None`
+    /// when there is nothing to draw.
+    fn update(&mut self, ctx: &egui::Context, page: usize, p: &PageInfo, scale: f32) -> Option<bool> {
+        let (scale, tile) = stamp_tile(p, self.from, scale)?;
+        let tag = (scale * 1000.0) as u64;
+        if self.tag != Some(tag) {
+            self.renderer.set_queue(vec![RenderRequest { page, scale, tag, tile: Some(tile), ..Default::default() }]);
+            self.tag = Some(tag);
+        }
+        if let Some(out) = self.renderer.try_recv()
+            && out.request.tag == tag
+        {
+            let (Some(t), None) = (out.request.tile, &out.error) else { return None };
+            let s = out.request.scale;
+            let area = [t.x as f32 / s, t.y as f32 / s, t.x.saturating_add(t.w) as f32 / s, t.y.saturating_add(t.h) as f32 / s];
+            let image = crate::canvas::texture_image([out.width as usize, out.height as usize], out.rgba);
+            self.pixels = Some((tag, ctx.load_texture("signature-drag-stamp", image, TextureOptions::LINEAR), area));
+        }
+        Some(self.pixels.as_ref().is_none_or(|(received, ..)| *received != tag))
+    }
+
+    /// The layer's pixels where its box goes on screen, `rect`: moved, and stretched as its box
+    /// is from `from` to `rect`.
+    fn paint(&self, painter: &egui::Painter, cx: &PageCx<'_>, page: usize, rect: egui::Rect) {
+        let Some((_, texture, area)) = &self.pixels else { return };
+        let from = cx.xf.user_rect(cx.info, page, self.from);
+        if from.width() < 0.01 || from.height() < 0.01 {
+            return;
+        }
+        let stretch = vec2(rect.width() / from.width(), rect.height() / from.height());
+        let mut mesh = egui::Mesh::with_texture(texture.id());
+        for (u, v) in [(0.0, 0.0), (1.0, 0.0), (1.0, 1.0), (0.0, 1.0)] {
+            let (x, y) = (area[0] + u * (area[2] - area[0]), area[1] + v * (area[3] - area[1]));
+            let at = cx.xf.norm_to_screen(x / cx.xf.pw, y / cx.xf.ph);
+            let pos = rect.min + (at - from.min) * stretch;
+            mesh.vertices.push(egui::epaint::Vertex { pos, uv: pos2(u, v), color: egui::Color32::WHITE });
+        }
+        mesh.add_triangle(0, 1, 2);
+        mesh.add_triangle(0, 2, 3);
+        painter.add(egui::Shape::mesh(mesh));
+    }
 }
 
 impl Layers {
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 3a3169576c..5b261f28e2 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -2657,3 +2657,64 @@ fn text_comments_can_save_a_zero_width_default() {
     assert_eq!(restored.comment_prefs.style(CommentTool::TextBox).width, 0.0);
     assert_eq!(restored.comment_prefs.style(CommentTool::Callout).width, 0.0);
 }
+
+/// Moving a rectangle or an oval showed only its blue frame going while the shape stayed where
+/// it was until release. Now the comment itself is drawn where it goes (the page beneath shows it
+/// where it was until the move is applied), and the pointer frames change nothing.
+#[test]
+fn a_moved_comment_is_drawn_where_it_goes_before_release() {
+    let _gpu = crate::gpu();
+    let mut h = harness(|_| {});
+    let id = h.state().views[0].id;
+    for shape in
+        [pdfcraft_engine::Shape::Rectangle { rect: [30.0, 30.0, 70.0, 70.0] }, pdfcraft_engine::Shape::Oval { rect: [230.0, 30.0, 270.0, 70.0] }]
+    {
+        let style = pdfcraft_engine::Style { color: [1.0, 0.0, 0.0], opacity: 1.0, width: 2.0, fill: Some([1.0, 0.0, 0.0]) };
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddAnnotation(pdfcraft_engine::NewAnnotation {
+            page: 0,
+            shape,
+            style,
+            contents: String::new(),
+            author: "Tester".into(),
+        })));
+    }
+    h.state_mut().views[0].comments.selected = None;
+    crate::support::settle(&mut h);
+    let red = |v: [u8; 4]| v[0] > 200 && v[1] < 80 && v[2] < 80;
+    for ((x, y), (tx, ty)) in [((50.0, 50.0), (150.0, 120.0)), ((250.0, 50.0), (200.0, 150.0))] {
+        let generation = h.state().session.get(id).unwrap().edit_generation();
+        let (from, to) = (at(&h, x, y), at(&h, tx, ty));
+        // Beside the pointer, whose arrow is drawn over the page.
+        let (was, goes) = (at(&h, x - 10.0, y - 10.0), at(&h, tx - 10.0, ty - 10.0));
+        let px = |pixels: &image::RgbaImage, p: Pos2| pixels.get_pixel(p.x.round() as u32, p.y.round() as u32).0;
+        h.hover_at(from);
+        h.run_steps(1);
+        h.drag_at(from);
+        h.run_steps(1);
+        for k in 1..=4 {
+            h.hover_at(from + (to - from) * (k as f32 / 4.0));
+            h.run_steps(1);
+        }
+        let mut shown = false;
+        for _ in 0..100 {
+            h.run_steps(2);
+            let pixels = h.render().unwrap();
+            if red(px(&pixels, goes)) {
+                shown = true;
+                assert!(red(px(&pixels, was)), "the page still shows it where it was");
+                break;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(10));
+        }
+        assert!(shown, "the comment at ({x}, {y}) is drawn under the pointer before release");
+        assert_eq!(h.state().session.get(id).unwrap().edit_generation(), generation, "pointer frames never edit the document");
+        h.drop_at(to);
+        h.run_steps(3);
+        let doc = h.state().session.get(id).unwrap();
+        assert_eq!(doc.can_undo(), Some("Move comment"));
+        crate::support::settle(&mut h);
+        let pixels = h.render().unwrap();
+        assert!(!red(px(&pixels, was)), "once applied it is gone from where it was");
+        assert!(red(px(&pixels, goes)), "and shown where it went");
+    }
+}
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index 703f1e9d8b..86eb0c66e7 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -47,6 +47,7 @@ No dump of Acrobat's menu tree has been diffed against the registry yet (gap 24)
 | Hand tool, middle-button pan, autoscroll | yes | hand tool; Linux autoscroll | partial |
 | Text selection, column select | yes, Alt-drag columns | reading-order selection; Alt/Option-drag or Edit ▸ Column select (#740) | shipped |
 | Select and move several objects at once | yes | on one page: Shift/Ctrl/⌘-click and marquee, one undo step (#844); not across pages, no group resize | partial |
+| Moved comments drawn where they go while dragged | yes | yes: the comment's own pixels follow the pointer, the page shows it where it was until release; stamps and Fill & Sign marks also hide the original | shipped |
 | Object handles: corners keep proportion, edges free | yes | yes for added images and signatures; Shift on a corner keeps the proportions of comments, stamps and form fields (#2199); no Alt resize from the centre | shipped |
 | Arrange, align and distribute page objects | yes | fields only | partial |
 | Rulers, grids, snap to grid, guides | yes | no | planned |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 3b8dba920c..98e9f2bb2e 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4042,6 +4042,18 @@ tools = ["comment_edit"]
 evidence = ["crates/annot/src/tests.rs::lines_and_polygons_are_reshaped_by_their_points", "crates/ui-egui/tests/it/comments.rs::line_ends_are_dragged_to_change_length_and_angle", "crates/automation/tests/it/automation.rs::comments_are_reshaped_through_the_tool"]
 notes = "A selected line, arrow, connected lines, polygon or cloud has a handle on each end or corner (instead of the frame); dragging one changes the length and angle (Shift holds it to 45° from the point before), with the new shape drawn while dragging, as one undo step (Edit::ReshapeAnnotation). The drawing tools keep drawing from an end (a new line starts there); the Select tool reshapes. /Rect follows the points with room for the width and arrowheads, and the appearance is drawn anew. Headless: comment_edit `points`; comment_list reports them. Measurements keep the points they measured; locked comments keep their shape. Not yet: adding or removing a corner."
 
+[[feature]]
+id = "comment.move-preview"
+title = "A moved comment is drawn where it goes while it is dragged"
+area = "E"
+tier = "P1"
+milestone = "M5"
+status = "shipped"
+commands = []
+tools = []
+evidence = ["crates/ui-egui/tests/it/comments.rs::a_moved_comment_is_drawn_where_it_goes_before_release", "crates/engine/src/tests.rs::comment_layer_draws_the_comment_alone"]
+notes = "Dragging a rectangle, oval, line, text box or any other comment with the Select tool draws the comment itself under the pointer, not only its blue frame: it is rendered alone once as the drag starts (Document::comment_layer, a read-only copy with only that comment and no page content) and laid over the page where it goes; the page beneath keeps showing it where it was until the move is applied, as a CAD program's move does (rendering the page without it would cost a whole page at every drag on a heavy plan). Stamps and Fill & Sign marks keep their own layers, which also hide the original. Pointer frames never edit the document. Not yet: resizing shows the frame only."
+
 [[feature]]
 id = "comment.edit-comment-text"
 title = "Edit comment text"

From 158318c09b2327014e3fae3aa75b490e02341725 Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Sat, 24 Oct 2026 23:14:23 +0200
Subject: [PATCH 105/270] Review: the move preview cuts a comment kept upright
 on a turned page from the box it is drawn in

A NoRotate comment on a quarter-turned page isn't drawn in its /Rect; its layer's tile and
its offset now come from the box it is shown in, as the frame it follows does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas/signature_drag.rs |  5 +-
 crates/ui-egui/tests/it/comments.rs         | 59 +++++++++++++++++++++
 2 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/crates/ui-egui/src/canvas/signature_drag.rs b/crates/ui-egui/src/canvas/signature_drag.rs
index c864d5354a..d05be0eaa2 100644
--- a/crates/ui-egui/src/canvas/signature_drag.rs
+++ b/crates/ui-egui/src/canvas/signature_drag.rs
@@ -235,7 +235,10 @@ impl SignatureDrag {
             && let Some(a) = doc.info.annotations.iter().find(|a| a.page == page && a.index == index && !a.locked)
             && let Ok(Some(alone)) = doc.comment_layer(page, &[index])
         {
-            let layer = StampLayer { renderer: alone.renderer(), from: a.rect, tag: None, pixels: None };
+            // The box it is drawn in: a comment kept upright on a turned page (NoRotate) isn't
+            // drawn in its /Rect, and the frame it follows is that box too.
+            let rotation = doc.info.pages.get(page).map_or(0, |p| p.rotation);
+            let layer = StampLayer { renderer: alone.renderer(), from: a.shown_rect(rotation), tag: None, pixels: None };
             self.moving = Some((key, Moving { layer, settling: false }));
         }
         let Some(((_, page, _), m)) = self.moving.as_mut() else { return };
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 5b261f28e2..0e02dadd6c 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -2718,3 +2718,62 @@ fn a_moved_comment_is_drawn_where_it_goes_before_release() {
         assert!(red(px(&pixels, goes)), "and shown where it went");
     }
 }
+
+/// A comment kept upright on a turned page (NoRotate on a /Rotate 90 page) is drawn where it goes
+/// while it is dragged too: its layer is cut from the box it is drawn in, not from its /Rect.
+#[test]
+fn an_upright_comment_on_a_turned_page_is_drawn_where_it_goes_before_release() {
+    let _gpu = crate::gpu();
+    let pdf = String::from_utf8_lossy(TEXT_FIXTURE)
+        .replace("/Contents 5 0 R /Resources", "/Contents 5 0 R /Rotate 90 /Annots [8 0 R] /Resources")
+        .replace(
+            "trailer",
+            "8 0 obj << /Type /Annot /Subtype /Square /Rect [40 60 160 90] /F 20 /C [1 0 0] /IC [1 0 0] /BS << /W 2 >> >> endobj\ntrailer",
+        )
+        .into_bytes();
+    let mut h = harness_with_bytes(pdf, |_| {});
+    crate::support::settle(&mut h);
+    let id = h.state().views[0].id;
+    let drawn = {
+        let app = h.state();
+        let v = &app.views[0];
+        let info = &app.session.get(v.id).unwrap().info;
+        let a = info.annotations.iter().find(|a| a.subtype == "Square").expect("the square");
+        assert!(a.no_rotate, "kept upright");
+        let page = &info.pages[0];
+        let xf =
+            pdfcraft_ui_egui::canvas::PageXform { rect: v.page_screen_rect(0).expect("on screen"), rot: v.rotation, pw: page.width, ph: page.height };
+        xf.user_rect(info, 0, a.shown_rect(page.rotation))
+    };
+    let red = |v: [u8; 4]| v[0] > 200 && v[1] < 80 && v[2] < 80;
+    let px = |pixels: &image::RgbaImage, p: Pos2| pixels.get_pixel(p.x.round() as u32, p.y.round() as u32).0;
+    // Beside the pointer, which is drawn over the page.
+    let (from, delta) = (drawn.center(), egui::vec2(160.0, 120.0));
+    let was = pos2(drawn.left() + 6.0, drawn.center().y);
+    let goes = was + delta;
+    assert!(red(px(&h.render().unwrap(), was)), "drawn in its upright box");
+    let generation = h.state().session.get(id).unwrap().edit_generation();
+    h.hover_at(from);
+    h.run_steps(1);
+    h.drag_at(from);
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.hover_at(from + delta * (k as f32 / 4.0));
+        h.run_steps(1);
+    }
+    let mut shown = false;
+    for _ in 0..100 {
+        h.run_steps(2);
+        let pixels = h.render().unwrap();
+        if red(px(&pixels, goes)) {
+            shown = true;
+            assert!(red(px(&pixels, was)), "the page still shows it where it was");
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    assert!(shown, "the upright comment is drawn under the pointer before release");
+    assert_eq!(h.state().session.get(id).unwrap().edit_generation(), generation, "pointer frames never edit the document");
+    h.drop_at(from + delta);
+    h.run_steps(3);
+}

From a793400ff5702f8795d9a789618ae580933f541e Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Sun, 25 Oct 2026 08:00:56 +0100
Subject: [PATCH 106/270] Rebase: the move preview follows PagePointer's
 position

main now gives page modules one pointer per frame (#2685); the comment drawn where it goes
follows `cx.ptr.pos`, as its frame does, instead of egui's hover position.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas/signature_drag.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/canvas/signature_drag.rs b/crates/ui-egui/src/canvas/signature_drag.rs
index d05be0eaa2..ed126d86c6 100644
--- a/crates/ui-egui/src/canvas/signature_drag.rs
+++ b/crates/ui-egui/src/canvas/signature_drag.rs
@@ -261,10 +261,10 @@ impl SignatureDrag {
             return;
         }
         let Some(a) = cx.get(*index) else { return };
-        let (pointer, shift) = painter.ctx().input(|i| (i.pointer.hover_pos(), i.modifiers.shift));
+        let shift = painter.ctx().input(|i| i.modifiers.shift);
         // As far as its frame has gone from where the move started (once applied, its box is
         // already where it went).
-        let rect = cx.adjusted_rect(a, cv.gesture.as_ref(), pointer, shift, pending);
+        let rect = cx.adjusted_rect(a, cv.gesture.as_ref(), cx.ptr.pos, shift, pending);
         let from = cx.xf.user_rect(cx.info, *page, m.layer.from);
         let painter = painter.with_clip_rect(painter.clip_rect().intersect(cx.xf.rect));
         m.layer.paint(&painter, cx, *page, from.translate(rect.min - from.min));

From b4f13fd8ba6afd57e58493f4a8106722143c2a82 Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Mon, 26 Oct 2026 07:20:09 +0100
Subject: [PATCH 107/270] Review: a moved comment's layer that can't be made is
 asked for once per drag

When Document::comment_layer gave nothing (a comment with nothing to draw, or
a document that can't be read), prepare_move asked again on every pointer
frame of the drag, and each time it copies and writes out the whole
document. The failure is now remembered for that drag (edit generation, page,
index); the next drag asks again.

A render that fails no longer drops the layer either: only its pixels go, so
the frame alone follows the pointer as before, the failed scale isn't waited
for, and another scale renders the same layer again without making it anew.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas/signature_drag.rs | 98 ++++++++++++++++++---
 1 file changed, 88 insertions(+), 10 deletions(-)

diff --git a/crates/ui-egui/src/canvas/signature_drag.rs b/crates/ui-egui/src/canvas/signature_drag.rs
index ed126d86c6..c706b8a113 100644
--- a/crates/ui-egui/src/canvas/signature_drag.rs
+++ b/crates/ui-egui/src/canvas/signature_drag.rs
@@ -20,6 +20,10 @@ pub(crate) struct SignatureDrag {
     /// The comment being moved that has no stamp layers: (edit generation, page, index), and
     /// the comment alone, drawn over the page where it goes.
     moving: Option<((u64, usize, usize), Moving)>,
+    /// The comment being moved whose layer couldn't be made (nothing to draw, or a document that
+    /// can't be read): only its frame follows the pointer, and the layer isn't made again on
+    /// every frame of the drag.
+    no_layer: Option<(u64, usize, usize)>,
 }
 
 struct Moving {
@@ -60,6 +64,8 @@ struct StampLayer {
     tag: Option<u64>,
     /// The rendered stamp: its tag, and the view-space box its pixels cover.
     pixels: Option<(u64, TextureHandle, [f32; 4])>,
+    /// The tag whose render failed: not waited for, and asked for again only at another scale.
+    failed: Option<u64>,
 }
 
 impl SignatureDrag {
@@ -86,7 +92,7 @@ impl SignatureDrag {
                     let front = Front::Image { texture, opacity: preview.opacity, turn: preview.turn };
                     self.layers = Some(Layers::new(front, preview.renderer()));
                 } else if let Ok(Some(preview)) = doc.stamp_preview(page, index) {
-                    let stamp = StampLayer { renderer: preview.stamp_renderer(), from: a.rect, tag: None, pixels: None };
+                    let stamp = StampLayer { renderer: preview.stamp_renderer(), from: a.rect, tag: None, pixels: None, failed: None };
                     self.layers = Some(Layers::new(Front::Stamp(Box::new(stamp)), preview.background_renderer()));
                 }
             }
@@ -230,16 +236,25 @@ impl SignatureDrag {
         if self.moving.as_ref().is_some_and(|(key, m)| !keep(*key, m)) {
             self.moving = None;
         }
+        if self.no_layer != dragged {
+            self.no_layer = None;
+        }
         if self.moving.is_none()
+            && self.no_layer.is_none()
             && let Some(key @ (_, page, index)) = dragged
             && let Some(a) = doc.info.annotations.iter().find(|a| a.page == page && a.index == index && !a.locked)
-            && let Ok(Some(alone)) = doc.comment_layer(page, &[index])
         {
-            // The box it is drawn in: a comment kept upright on a turned page (NoRotate) isn't
-            // drawn in its /Rect, and the frame it follows is that box too.
-            let rotation = doc.info.pages.get(page).map_or(0, |p| p.rotation);
-            let layer = StampLayer { renderer: alone.renderer(), from: a.shown_rect(rotation), tag: None, pixels: None };
-            self.moving = Some((key, Moving { layer, settling: false }));
+            // Made once per drag: it copies and writes out the whole document.
+            match doc.comment_layer(page, &[index]) {
+                Ok(Some(alone)) => {
+                    // The box it is drawn in: a comment kept upright on a turned page (NoRotate)
+                    // isn't drawn in its /Rect, and the frame it follows is that box too.
+                    let rotation = doc.info.pages.get(page).map_or(0, |p| p.rotation);
+                    let layer = StampLayer { renderer: alone.renderer(), from: a.shown_rect(rotation), tag: None, pixels: None, failed: None };
+                    self.moving = Some((key, Moving { layer, settling: false }));
+                }
+                _ => self.no_layer = Some(key),
+            }
         }
         let Some(((_, page, _), m)) = self.moving.as_mut() else { return };
         let Some(p) = doc.info.pages.get(*page) else { return };
@@ -249,8 +264,10 @@ impl SignatureDrag {
                     ctx.request_repaint_after(std::time::Duration::from_millis(16));
                 }
             }
-            // Nothing to lay over the page: the frame alone follows the pointer, as before.
-            None => self.moving = None,
+            // Nothing to lay over the page at this scale (no box, or the render failed): the
+            // frame alone follows the pointer, as before. The layer stays, so another scale
+            // renders it again without making it anew.
+            None => m.layer.pixels = None,
         }
     }
 
@@ -282,10 +299,16 @@ impl StampLayer {
             self.renderer.set_queue(vec![RenderRequest { page, scale, tag, tile: Some(tile), ..Default::default() }]);
             self.tag = Some(tag);
         }
+        if self.failed == Some(tag) {
+            return None;
+        }
         if let Some(out) = self.renderer.try_recv()
             && out.request.tag == tag
         {
-            let (Some(t), None) = (out.request.tile, &out.error) else { return None };
+            let (Some(t), None) = (out.request.tile, &out.error) else {
+                self.failed = Some(tag);
+                return None;
+            };
             let s = out.request.scale;
             let area = [t.x as f32 / s, t.y as f32 / s, t.x.saturating_add(t.w) as f32 / s, t.y.saturating_add(t.h) as f32 / s];
             let image = crate::canvas::texture_image([out.width as usize, out.height as usize], out.rgba);
@@ -338,3 +361,58 @@ fn stamp_tile(p: &PageInfo, rect: [f32; 4], scale: f32) -> Option<(f32, Tile)> {
     let (right, bottom) = (((x1 * scale).ceil() + 1.0).min(width).max(left + 1.0), ((y1 * scale).ceil() + 1.0).min(height).max(top + 1.0));
     Some((scale, Tile { x: left as u32, y: top as u32, w: (right - left) as u32, h: (bottom - top) as u32 }))
 }
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+
+    use super::*;
+
+    /// One page with one comment that has nothing to draw: a sound annotation without an
+    /// appearance, for which none is built.
+    fn silent() -> Vec<u8> {
+        let objs = [
+            "<< /Type /Catalog /Pages 2 0 R >>",
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [4 0 R] >>",
+            "<< /Type /Annot /Subtype /Sound /Rect [50 50 70 70] /Contents (hush) >>",
+        ];
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objs.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = out.len();
+        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+        for o in offsets {
+            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+        out
+    }
+
+    /// A moved comment whose own layer can't be made is asked for once per drag, not on every
+    /// pointer frame (making it copies and writes out the whole document); only its frame follows
+    /// the pointer. Once the drag ends, the next one asks again.
+    #[test]
+    fn a_comment_with_nothing_to_draw_is_prepared_once_per_drag() {
+        let mut session = pdfcraft_engine::Session::new();
+        let id = session.open("silent.pdf", None, Arc::new(silent()), None).expect("opens");
+        let doc = session.get(id).expect("open");
+        let index = doc.info.annotations.iter().find(|a| a.subtype == "Sound").expect("listed").index;
+        let ctx = egui::Context::default();
+        let mut cv = CommentView::default();
+        cv.gesture = Some(Gesture::Move { page: 0, index, from: pos2(0.0, 0.0) });
+        let mut drag = SignatureDrag::default();
+        let key = Some((doc.edit_generation(), 0, index));
+        drag.prepare_move(&ctx, doc, &cv, None, false, 1.0);
+        assert!(drag.moving.is_none(), "nothing to draw");
+        assert_eq!(drag.no_layer, key, "remembered for this drag");
+        drag.prepare_move(&ctx, doc, &cv, None, false, 1.0);
+        assert!(drag.moving.is_none() && drag.no_layer == key, "and not made again");
+        cv.gesture = None;
+        drag.prepare_move(&ctx, doc, &cv, None, false, 1.0);
+        assert_eq!(drag.no_layer, None, "forgotten when the drag ends");
+    }
+}

From b68362bdc246b1cf2f149358ac402437df494634 Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Wed, 28 Oct 2026 17:27:17 +0100
Subject: [PATCH 108/270] Rebase: isolate_annotations is exported from main's
 lookup module

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/annot/src/lib.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index e9e0359ce0..e43fb80291 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -33,7 +33,9 @@ pub use info::{Props, Summary, is_comment_subtype, props, set_info, summaries};
 #[cfg(test)]
 use lookup::{ANNOTS_ENTRIES_COPIED, PageWalk, annot_dict, annot_ref};
 use lookup::{annots, page_ref};
-pub use lookup::{has_visible_fill_sign, is_fill_sign, isolate_annotation, page_refs, picture_rotation, set_annots, signature_image};
+pub use lookup::{
+    has_visible_fill_sign, is_fill_sign, isolate_annotation, isolate_annotations, page_refs, picture_rotation, set_annots, signature_image,
+};
 pub(crate) use modify::n;
 pub use modify::{
     add_reply, add_text_replacement, delete_annotation, erase_ink, fillable, goes_with, move_annotation, set_contents, set_fill, set_font_size,

From 22c08fb65bb2f6632af2611e411e3a933dba375c Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Wed, 28 Oct 2026 19:17:50 +0100
Subject: [PATCH 109/270] A test that Fill & Sign's typed text is drawn where
 it goes while it is dragged (#4619)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/tests/it/comments.rs | 49 +++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 0e02dadd6c..22cb7601d3 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -2719,6 +2719,55 @@ fn a_moved_comment_is_drawn_where_it_goes_before_release() {
     }
 }
 
+/// Fill & Sign's typed text (a Typewriter FreeText) is drawn where it goes while it is dragged
+/// too, not only its frame (#4619).
+#[test]
+fn moved_fill_and_sign_text_is_drawn_where_it_goes_before_release() {
+    let _gpu = crate::gpu();
+    let mut h = harness(|_| {});
+    h.state_mut().execute("sign.fill.text");
+    click_pt(&mut h, (40.0, 150.0));
+    h.event(egui::Event::Text("WWWWWW".into()));
+    h.run_steps(1);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    let a = comments(&h).into_iter().find(|a| a.contents.as_deref() == Some("WWWWWW")).expect("the typed text");
+    assert!(a.fill_sign && a.subtype == "FreeText", "{a:?}");
+    h.state_mut().quick_tool = QuickTool::Select;
+    h.state_mut().views[0].comments.selected = None;
+    crate::support::settle(&mut h);
+    let (x, y) = ((a.rect[0] + a.rect[2]) / 2.0, (a.rect[1] + a.rect[3]) / 2.0);
+    let (dx, dy) = (120.0, -60.0);
+    let (from, to) = (at(&h, x, y), at(&h, x + dx, y + dy));
+    // Ink in the left of the box where it goes, inside its frame and away from the pointer, which
+    // is drawn over the page.
+    let goes = egui::Rect::from_two_pos(at(&h, a.rect[0] + dx, a.rect[1] + dy), at(&h, a.rect[2] + dx, a.rect[3] + dy)).shrink(3.0);
+    let inked = |pixels: &image::RgbaImage| {
+        (goes.left() as u32..(to.x - 12.0) as u32)
+            .any(|px| (goes.top() as u32..goes.bottom() as u32).any(|py| pixels.get_pixel(px, py).0[..3].iter().all(|c| *c < 100)))
+    };
+    h.hover_at(from);
+    h.run_steps(1);
+    h.drag_at(from);
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.hover_at(from + (to - from) * (k as f32 / 4.0));
+        h.run_steps(1);
+    }
+    let mut shown = false;
+    for _ in 0..100 {
+        h.run_steps(2);
+        if inked(&h.render().unwrap()) {
+            shown = true;
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    assert!(shown, "the typed text is drawn under the pointer before release");
+    h.drop_at(to);
+    h.run_steps(3);
+}
+
 /// A comment kept upright on a turned page (NoRotate on a /Rotate 90 page) is drawn where it goes
 /// while it is dragged too: its layer is cut from the box it is drawn in, not from its /Rect.
 #[test]

From f0cd96e90bf696099b02201ac68f9ccb8a00c7d2 Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Thu, 29 Oct 2026 05:54:15 +0100
Subject: [PATCH 110/270] Review: isolate_annotations says that an index off
 the page's list is an error

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/annot/src/lookup.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crates/annot/src/lookup.rs b/crates/annot/src/lookup.rs
index 50097a5e9f..c7a0fd9831 100644
--- a/crates/annot/src/lookup.rs
+++ b/crates/annot/src/lookup.rs
@@ -231,6 +231,8 @@ pub fn isolate_annotation(doc: &mut Document, page: usize, index: usize) -> Resu
 
 /// [`isolate_annotation`] for several annotations of one page: those of them with a normal
 /// appearance stay, in their order on the page. `false`, with `doc` unchanged, when none has one.
+/// An index that isn't one of the page's annotations is an error even when the others are, and
+/// leaves `doc` unchanged too.
 pub fn isolate_annotations(doc: &mut Document, page: usize, indices: &[usize]) -> Result<bool, AnnotError> {
     let p = page_ref(doc, page)?;
     let list = annots(doc, p);

From b9940d7d8104763d5e7106543dc6b41acce942cd Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Thu, 29 Oct 2026 18:38:05 +1100
Subject: [PATCH 111/270] fix(edit): a lone row aligns in its own column, not a
 closer page-wide heading

alignment_frame measured a one-row paragraph's alignment in the frame
of the nearest overlapping block. A full-width heading closer to the
title than the title's own body column gave it a page-wide frame, so
centring or right-aligning the title moved it out of its column. It now
considers every overlapping block whose column holds the row and takes
the narrowest, the nearest on a tie, so a page-wide heading gives the
title no frame while a narrower column that holds it does. When no
column holds the row it is still measured in its own box.

The comment about page-wide headers named an exclusion the filter
never made; the doc comment now says what is chosen and why.
---
 crates/edit/src/tests.rs                 | 27 +++++++++++++++++
 crates/edit/src/text_regions/grouping.rs | 37 ++++++++++++++----------
 2 files changed, 48 insertions(+), 16 deletions(-)

diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index be82ae144d..48df3e4395 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -7255,6 +7255,33 @@ fn a_justified_paragraph_from_the_editor_fills_its_rows() {
     assert!(row("end")[2] < right - 20.0, "the last row isn't");
 }
 
+/// A heading across the whole page sits closer to the title than the title's own column does: the
+/// title is still aligned in its own column, not across the heading's page-wide frame (FredApps's
+/// review of 43f848d5). Centre and right both go by the column.
+#[test]
+fn a_lone_row_aligns_in_its_own_column_not_a_closer_full_width_heading() {
+    let page = "BT /F1 12 Tf 1 0 0 1 50 700 Tm (A heading that runs across both columns of the page, well past the first column, to the far margin.) Tj ET                 BT /F1 18 Tf 1 0 0 1 120 672 Tm (Title) Tj ET                 BT /F1 10 Tf 12 TL 50 610 Td (The first column runs to here.) Tj T* (A second row of it.) Tj ET                 BT /F1 10 Tf 12 TL 320 610 Td (The second column has more rows.) Tj T* (One.) Tj T* (Two.) Tj T* (Three.) Tj ET";
+    let blocks = text::text_blocks(&text_page(page), 0).unwrap();
+    let column = blocks.iter().find(|b| b.text.starts_with("The first")).unwrap().rect;
+    let heading = blocks.iter().find(|b| b.text.starts_with("A heading")).unwrap().rect;
+    let title_block = blocks.iter().find(|b| b.text == "Title").expect("the title is a block of its own").rect;
+    let gap = |other: [f64; 4]| (other[1] - title_block[3]).max(title_block[1] - other[3]).max(0.0);
+    assert!(gap(heading) < gap(column), "the heading is the nearer block: {} vs {}", gap(heading), gap(column));
+    assert!(heading[2] - heading[0] > 2.0 * (column[2] - column[0]), "the heading is page-wide: {heading:?} vs {column:?}");
+    let title_after = |align: added::Align| {
+        let mut doc = text_page(page);
+        let blocks = text::text_blocks(&doc, 0).unwrap();
+        let index = blocks.iter().position(|b| b.text == "Title").unwrap();
+        let style = text::BlockStyle { aligns: vec![Some(align)], ..Default::default() };
+        text::rewrite_block(&mut doc, 0, index, Some("Title"), &style).unwrap();
+        text::text_lines(&doc, 0).unwrap().into_iter().find(|l| l.text == "Title").unwrap().rect
+    };
+    let centred = title_after(added::Align::Center);
+    assert!(((centred[0] + centred[2]) / 2.0 - (column[0] + column[2]) / 2.0).abs() < 1.0, "centred in its own column: {centred:?} vs {column:?}");
+    let right = title_after(added::Align::Right);
+    assert!((right[2] - column[2]).abs() < 1.0, "right: on its own column's right edge, {right:?} vs {column:?}");
+}
+
 /// The same on a page of two columns, where the other column has more rows: a title over the
 /// first column is aligned across the first column, not its own box.
 #[test]
diff --git a/crates/edit/src/text_regions/grouping.rs b/crates/edit/src/text_regions/grouping.rs
index 357f1f7244..2e44290117 100644
--- a/crates/edit/src/text_regions/grouping.rs
+++ b/crates/edit/src/text_regions/grouping.rs
@@ -43,8 +43,10 @@ fn neighbour_left(lines: &[TextLine], block: &TextBlock) -> Option<f64> {
 }
 
 /// Where an alignment picked for a one-row paragraph is measured, as `[left, right]`: the column of
-/// text it sits in (the nearest overlapping paragraph's left edge, to the furthest right
-/// its rows reach) when that column holds it, otherwise its own box. A lone row's own box is no frame
+/// text it sits in (an overlapping paragraph's left edge, to the furthest right its rows reach)
+/// when that column holds it, otherwise its own box. Of the columns that hold it, the narrowest is
+/// its own, the nearest on a tie: a heading across the whole page, even one closer than the body,
+/// is wider than the column the title sits in, and gives it no frame while a narrower one does. A lone row's own box is no frame
 /// to align in: left-aligning a title centred on the page left it where it was, and since a single
 /// row grows to the page's margin, centring it again moved it right each time. `None` when no
 /// alignment is asked for, or when the paragraph is several rows, turned, or given a width or a
@@ -57,22 +59,25 @@ pub(crate) fn alignment_frame(lines: &[TextLine], blocks: &[TextBlock], block: &
     let own = [block.rect[0], block.rect[2]];
     let tolerance = block.size.max(1.0) * 0.5;
     let gap = |other: &TextBlock| (other.rect[1] - block.rect[3]).max(block.rect[1] - other.rect[3]).max(0.0);
-    // Page-wide headers and footers sharing this margin aren't part of the local column.
-    let neighbour = blocks
+    // The column an overlapping paragraph makes, when it holds the row.
+    let column = |other: &TextBlock| -> Option<[f64; 2]> {
+        let left = other.rect[0];
+        let right = other
+            .lines
+            .iter()
+            .filter_map(|i| lines.get(*i))
+            .filter(|line| (line.rect[0] - left).abs() < tolerance)
+            .map(|line| line.rect[2])
+            .fold(f64::NEG_INFINITY, f64::max);
+        (right.is_finite() && right - left > own[1] - own[0] && own[0] >= left - tolerance && own[1] <= right + tolerance).then_some([left, right])
+    };
+    let frame = blocks
         .iter()
         .filter(|other| other.lines.iter().all(|i| !block.lines.contains(i)) && other.rect[2] > own[0] && other.rect[0] < own[1])
-        .min_by(|a, b| gap(a).total_cmp(&gap(b)));
-    let Some(neighbour) = neighbour else { return Some(own) };
-    let left = neighbour.rect[0];
-    let right = neighbour
-        .lines
-        .iter()
-        .filter_map(|i| lines.get(*i))
-        .filter(|line| (line.rect[0] - left).abs() < tolerance)
-        .map(|line| line.rect[2])
-        .fold(f64::NEG_INFINITY, f64::max);
-    let holds = right.is_finite() && right - left > own[1] - own[0] && own[0] >= left - tolerance && own[1] <= right + tolerance;
-    Some(if holds { [left, right] } else { own })
+        .filter_map(|other| column(other).map(|frame| (frame, gap(other))))
+        .min_by(|(a, near_a), (b, near_b)| (a[1] - a[0]).total_cmp(&(b[1] - b[0])).then(near_a.total_cmp(near_b)))
+        .map(|(frame, _)| frame);
+    Some(frame.unwrap_or(own))
 }
 
 /// Whether a block reads as centred, and so must keep its centre when it grows or wraps.

From 648dd42810e4858aa313950c63abc5bf26252d44 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Thu, 29 Oct 2026 19:12:11 +1100
Subject: [PATCH 112/270] fix(edit): a column is measured by its whole rows; an
 isolated row keeps its width

Two holes in alignment_frame:

- A column's right edge came from the runs that start at its left
  edge, so a row of several styles ended at its first run, and the
  column could fail to hold a title wider than that run. It now takes
  the right edge of each complete row (row_rect).
- A row with no column to align in was framed by its own box, which
  the rewrite also used as the width its text wraps at: changing an
  isolated row's text together with an alignment wrapped it at its old
  width, word by word. When the text changes and no column holds the
  row, alignment_frame now returns None, so the row keeps the width it
  has without the alignment. With the text unchanged the own box is
  still the frame, so aligning twice is still a no-op.
---
 crates/edit/src/tests.rs                 | 35 ++++++++++++++++++++++++
 crates/edit/src/text/rewrite.rs          |  2 +-
 crates/edit/src/text_regions/grouping.rs | 29 ++++++++++++++------
 3 files changed, 57 insertions(+), 9 deletions(-)

diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 48df3e4395..7691039f24 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -7255,6 +7255,41 @@ fn a_justified_paragraph_from_the_editor_fills_its_rows() {
     assert!(row("end")[2] < right - 20.0, "the last row isn't");
 }
 
+/// A column whose rows are several runs (a second style on the same baseline) reaches the right
+/// edge of its whole rows, not of the run at the left edge: a title wider than that first run is
+/// still held by the column and aligns to it (CodeRabbit on b9940d7d).
+#[test]
+fn a_column_is_measured_by_its_whole_rows_not_its_first_runs() {
+    let page = "BT /F1 18 Tf 1 0 0 1 100 672 Tm (A longer title) Tj ET                 BT /F1 10 Tf 12 TL 50 610 Td (The first column runs to here.) Tj ET                 BT /F1 11 Tf 1 0 0 rg 1 0 0 1 185 610 Tm (and keeps going on.) Tj ET                 BT /F1 10 Tf 12 TL 50 598 Td (A second row of it.) Tj ET";
+    let blocks = text::text_blocks(&text_page(page), 0).unwrap();
+    let body = blocks.iter().find(|b| b.text.starts_with("The first")).expect("the body is a block");
+    assert!(body.rows.first().is_some_and(|row| row.len() >= 2), "the body's first row is several runs: {:?}", body.rows);
+    let lines = text::text_lines(&text_page(page), 0).unwrap();
+    let column_right =
+        body.rows.iter().filter_map(|row| row.iter().filter_map(|i| lines.get(*i)).map(|l| l.rect[2]).reduce(f64::max)).fold(f64::MIN, f64::max);
+    let mut doc = text_page(page);
+    let index = blocks.iter().position(|b| b.text == "A longer title").expect("the title is a block of its own");
+    let style = text::BlockStyle { aligns: vec![Some(added::Align::Right)], ..Default::default() };
+    text::rewrite_block(&mut doc, 0, index, Some("A longer title"), &style).unwrap();
+    let title = text::text_lines(&doc, 0).unwrap().into_iter().find(|l| l.text == "A longer title").unwrap().rect;
+    assert!((title[2] - column_right).abs() < 1.0, "right: on the whole row's right edge, {title:?} vs {column_right}");
+}
+
+/// A row with no column of its own is aligned in its own box, but that box is not the width its new
+/// text wraps at: changing the text together with an alignment keeps a single row on one row, as
+/// it does without the alignment (CodeRabbit on b9940d7d).
+#[test]
+fn an_isolated_row_edited_with_an_alignment_does_not_wrap_at_its_old_width() {
+    for align in [added::Align::Center, added::Align::Right] {
+        let mut doc = text_page("BT /F1 18 Tf 1 0 0 1 100 700 Tm (Title) Tj ET");
+        let longer = "A much longer title for the page";
+        let style = text::BlockStyle { aligns: vec![Some(align)], ..Default::default() };
+        text::rewrite_block(&mut doc, 0, 0, Some(longer), &style).unwrap();
+        let lines = text::text_lines(&doc, 0).unwrap();
+        assert_eq!(lines.iter().map(|l| l.text.as_str()).collect::<Vec<_>>(), [longer], "{align:?}: the title stays on one row");
+    }
+}
+
 /// A heading across the whole page sits closer to the title than the title's own column does: the
 /// title is still aligned in its own column, not across the heading's page-wide frame (FredApps's
 /// review of 43f848d5). Centre and right both go by the column.
diff --git a/crates/edit/src/text/rewrite.rs b/crates/edit/src/text/rewrite.rs
index 4d4e16d669..3f436d7b24 100644
--- a/crates/edit/src/text/rewrite.rs
+++ b/crates/edit/src/text/rewrite.rs
@@ -766,7 +766,7 @@ pub(crate) fn rewrite_block_from(
     // An alignment for a one-row paragraph is laid out across the column it sits in, as a
     // paragraph of that width moved to its left edge.
     let framed;
-    let style = match alignment_frame(&lines, &blocks, &b, style) {
+    let style = match alignment_frame(&lines, &blocks, &b, style, text.is_some_and(|t| t != b.editor_text)) {
         Some([left, right]) => {
             framed = BlockStyle { width: Some(right - left), offset: Some([left - b.rect[0], 0.0]), ..style.clone() };
             &framed
diff --git a/crates/edit/src/text_regions/grouping.rs b/crates/edit/src/text_regions/grouping.rs
index 2e44290117..3a16e4f7c0 100644
--- a/crates/edit/src/text_regions/grouping.rs
+++ b/crates/edit/src/text_regions/grouping.rs
@@ -49,9 +49,15 @@ fn neighbour_left(lines: &[TextLine], block: &TextBlock) -> Option<f64> {
 /// is wider than the column the title sits in, and gives it no frame while a narrower one does. A lone row's own box is no frame
 /// to align in: left-aligning a title centred on the page left it where it was, and since a single
 /// row grows to the page's margin, centring it again moved it right each time. `None` when no
-/// alignment is asked for, or when the paragraph is several rows, turned, or given a width or a
-/// move of its own.
-pub(crate) fn alignment_frame(lines: &[TextLine], blocks: &[TextBlock], block: &TextBlock, style: &BlockStyle) -> Option<[f64; 2]> {
+/// alignment is asked for, when the paragraph is several rows, turned, or given a width or a move of
+/// its own, or when its text changes and no column holds it (`text_changed`).
+pub(crate) fn alignment_frame(
+    lines: &[TextLine],
+    blocks: &[TextBlock],
+    block: &TextBlock,
+    style: &BlockStyle,
+    text_changed: bool,
+) -> Option<[f64; 2]> {
     let asked = style.align.is_some() || style.aligns.iter().any(Option::is_some);
     if !asked || style.width.is_some() || style.offset.is_some() || block.rows.len() != 1 || block.rotation.abs() > 0.01 {
         return None;
@@ -62,12 +68,13 @@ pub(crate) fn alignment_frame(lines: &[TextLine], blocks: &[TextBlock], block: &
     // The column an overlapping paragraph makes, when it holds the row.
     let column = |other: &TextBlock| -> Option<[f64; 2]> {
         let left = other.rect[0];
+        // Whole rows, not their runs: a row of several styles reaches its last run's right edge.
         let right = other
-            .lines
+            .rows
             .iter()
-            .filter_map(|i| lines.get(*i))
-            .filter(|line| (line.rect[0] - left).abs() < tolerance)
-            .map(|line| line.rect[2])
+            .filter_map(|row| row_rect(row, lines))
+            .filter(|row| (row[0] - left).abs() < tolerance)
+            .map(|row| row[2])
             .fold(f64::NEG_INFINITY, f64::max);
         (right.is_finite() && right - left > own[1] - own[0] && own[0] >= left - tolerance && own[1] <= right + tolerance).then_some([left, right])
     };
@@ -77,7 +84,13 @@ pub(crate) fn alignment_frame(lines: &[TextLine], blocks: &[TextBlock], block: &
         .filter_map(|other| column(other).map(|frame| (frame, gap(other))))
         .min_by(|(a, near_a), (b, near_b)| (a[1] - a[0]).total_cmp(&(b[1] - b[0])).then(near_a.total_cmp(near_b)))
         .map(|(frame, _)| frame);
-    Some(frame.unwrap_or(own))
+    // The row's own box, with no column to align in, is no width for new text to wrap at: edited,
+    // the row keeps the width it would have had without the alignment.
+    match frame {
+        Some(frame) => Some(frame),
+        None if text_changed => None,
+        None => Some(own),
+    }
 }
 
 /// Whether a block reads as centred, and so must keep its centre when it grows or wraps.

From e228e0edfc0d14c8f9bf60fbe94d001ac41c6c56 Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Thu, 15 Oct 2026 14:58:15 +0200
Subject: [PATCH 113/270] M7: keep a blank line as a paragraph break (#2517)

A gap of 2.4 times the font size was still under the 2.5 times join limit, so two paragraphs became one and editing the first deleted the second. Once a paragraph has two rows, a wider gap than its own leading stays the next paragraph.
---
 ROADMAP.md                               |  1 +
 crates/automation/tests/it/automation.rs | 30 ++++++++++++++++++++++++
 crates/edit/src/tests.rs                 | 28 ++++++++++++++++++++++
 crates/edit/src/text_regions/grouping.rs | 18 +++++++++++++-
 docs/gaps.md                             |  5 +++-
 docs/roadmap.md                          |  3 ++-
 parity/acrobat-features.toml             |  4 ++--
 7 files changed, 84 insertions(+), 5 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index f5de8044e1..19bad63491 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -223,6 +223,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-22 (M4, #3916 partial):** Document edits and Undo/Redo cancel an Organize page drag. Pointer-release regressions check exact page order and save/reopen.
 - **2026-10-22 (M10, #3752 paper):** CUPS jobs ask for the chosen paper in every size. The 13 sizes the Print dialog sent no paper for (A6, A0–A2, ARCH, ANSI C–E) use PWG 5101.1 names, checked against a synthetic PPD with `cupsfilter`, and `doc_print` to a printer sends the paper too. The macOS tray half (Auto Select instead of the PPD's default tray) is a craft-print change that needs a pin bump here. Estimates unchanged.
 - **2026-10-22 (M14, macOS association recovery candidate):** Successful desktop open/save/sign can queue recovery of an existing per-file binding to the running PDFCraft bundle through NSWorkspace. Metadata-only watcher changes retain undo and avoid false overwrite prompts; real same-length/same-mtime edits remain protected. Rebased on 0.12.0 and reuses #3042's shared atomic metadata preservation; the bounded recovery parser does not narrow save limits. Prior native Preview TEST-signature and Finder workflows passed on macOS 27.0.1; other versions remain unqualified. Estimates unchanged.
+- **2026-10-15 (M7, #2517):** A blank line between paragraphs stays a paragraph break. Rows join while the gap is within the paragraph's own leading, or within about twice the font size when the paragraph has only one row. Editing the first paragraph leaves the next one in place, including after the first paragraph grows by a row. Estimates unchanged.
 - **2026-10-13 (M7, free image rotation):** A selected page image has a rotate knob (Shift: 15 degree steps) and `image_edit` a `rotate_by` action; the angle is written as one undoable `cm`. Snapping to page edges while moving is in #1740; resize snapping is not done. Estimates unchanged.
 
 - **2026-10-20 (M4, initial view):** Window and interface options read indirect boolean ViewerPreferences values. Synthetic regressions cover true/false, direct/indirect preference dictionaries and save/reopen; malformed entries retain false defaults. Estimates unchanged.
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 01d0d1eb24..202f204628 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -9457,3 +9457,33 @@ fn clearing_a_kids_default_through_tools_does_not_bring_back_its_parents() {
     let city = fields["fields"].as_array().unwrap().iter().find(|f| f["name"] == "address.city").unwrap().clone();
     assert!(city["value"].is_null() || city["value"] == "", "reset clears it rather than restoring the parent's Main St: {}", city["value"]);
 }
+
+/// #2517, through the same tools as the report: one blank line is two paragraphs, and editing
+/// the first leaves the second. Growing the first by a row does not absorb a neighbour that
+/// started three sizes below.
+#[test]
+fn a_blank_line_stays_a_separate_paragraph_through_tools() {
+    let dir = workdir("blank-line");
+    let body = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (First paragraph, first row.) Tj T* (First paragraph, second row.) Tj ET \
+                BT /F1 12 Tf 14.4 TL 1 0 0 1 72 656.8 Tm (Second paragraph, first row.) Tj T* (Second paragraph, second row.) Tj ET";
+    std::fs::write(dir.join("a.pdf"), helvetica_page(body)).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    let before = ok(&mut a, "text_paragraphs", json!({ "doc": doc, "page": 1 }));
+    assert_eq!(before["count"], 2, "{before}");
+    ok(&mut a, "text_edit", json!({ "doc": doc, "page": 1, "paragraph": 1, "text": "First paragraph, edited row.\nFirst paragraph, second row." }));
+    let after = ok(&mut a, "text_paragraphs", json!({ "doc": doc, "page": 1 }));
+    assert_eq!(after["count"], 2, "{after}");
+    let second = after["paragraphs"][1]["text"].as_str().unwrap();
+    assert!(second.contains("Second paragraph"), "{second}");
+
+    let grown = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (One) Tj T* (Two) Tj ET \
+                 BT /F1 12 Tf 1 0 0 1 72 649.6 Tm (Neighbour) Tj ET";
+    std::fs::write(dir.join("grown.pdf"), helvetica_page(grown)).unwrap();
+    let grown_doc = ok(&mut a, "doc_open", json!({ "path": "grown.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "text_paragraphs", json!({ "doc": grown_doc, "page": 1 }))["count"], 2);
+    ok(&mut a, "text_edit", json!({ "doc": grown_doc, "page": 1, "paragraph": 1, "text": "One\nTwo\nThree" }));
+    let after = ok(&mut a, "text_paragraphs", json!({ "doc": grown_doc, "page": 1 }));
+    assert_eq!(after["count"], 2, "{after}");
+    assert!(after["paragraphs"][1]["text"].as_str().unwrap().contains("Neighbour"), "{after}");
+}
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 359155015f..bb752149d4 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -2790,6 +2790,34 @@ fn a_bold_stand_in_font_leaves_an_earlier_regular_one_alone() {
     assert_eq!(font_of("TENSÃO").as_deref(), Some("Times-Bold"), "{lines:?}");
 }
 
+/// #2517: one blank line at ordinary leading (2 × 1.2 × the font size) is a paragraph break.
+/// Editing the first paragraph must leave the second one in place.
+#[test]
+fn a_blank_line_keeps_the_next_paragraph() {
+    let src = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (First paragraph, first row.) Tj T* (First paragraph, second row.) Tj ET \
+               BT /F1 12 Tf 14.4 TL 1 0 0 1 72 656.8 Tm (Second paragraph, first row.) Tj T* (Second paragraph, second row.) Tj ET";
+    let mut doc = text_page(src);
+    let before = text::text_blocks(&doc, 0).unwrap();
+    assert_eq!(before.len(), 2, "{:?}", before.iter().map(|b| b.text.as_str()).collect::<Vec<_>>());
+    text::replace_block(&mut doc, 0, 0, "First paragraph, edited row.\nFirst paragraph, second row.").unwrap();
+    let after = text::text_blocks(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2, "{:?}", after.iter().map(|b| b.text.as_str()).collect::<Vec<_>>());
+    assert!(after[1].text.contains("Second paragraph"), "{:?}", after[1].text);
+}
+
+/// #2517: adding a row must not pull in a paragraph that was 3 × the font size below.
+#[test]
+fn a_grown_paragraph_does_not_swallow_the_next_one() {
+    let src = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (One) Tj T* (Two) Tj ET \
+               BT /F1 12 Tf 1 0 0 1 72 649.6 Tm (Neighbour) Tj ET";
+    let mut doc = text_page(src);
+    assert_eq!(text::text_blocks(&doc, 0).unwrap().len(), 2);
+    text::replace_block(&mut doc, 0, 0, "One\nTwo\nThree").unwrap();
+    let after = text::text_blocks(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2, "{:?}", after.iter().map(|b| b.text.as_str()).collect::<Vec<_>>());
+    assert!(after[1].text.contains("Neighbour"), "{:?}", after[1].text);
+}
+
 #[test]
 fn paragraphs_are_found_and_rewrapped() {
     let mut doc = text_page(
diff --git a/crates/edit/src/text_regions/grouping.rs b/crates/edit/src/text_regions/grouping.rs
index b8a5abca1e..9d3e5eaa9d 100644
--- a/crates/edit/src/text_regions/grouping.rs
+++ b/crates/edit/src/text_regions/grouping.rs
@@ -253,6 +253,22 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
                 || ((pr[0] + pr[2] - frame[0] - frame[2]) / 2.0).abs() < tol
                 || (pr[2] - frame[2]).abs() < tol
                 || hanging;
+            // Once a paragraph has two rows, its own leading is known. A blank line is about
+            // twice that, so a wider gap is the next paragraph (#2517). A single row has no
+            // leading yet: ordinary leading (about 1.2 × the size) and double spacing (2 × the
+            // size) still join, and a blank line (2.4 × the size) does not. The old cap of
+            // 2.5 × the size joined the blank line too.
+            let own_leading = block.rows.len().checked_sub(2).and_then(|i| {
+                let above = block.rows.get(i)?.first().and_then(|n| lines.get(*n));
+                let below = prev_row.first().and_then(|n| lines.get(*n));
+                match (above, below) {
+                    (Some(above), Some(below)) => Some((above.frame_origin().1 - below.frame_origin().1).abs()),
+                    _ => None,
+                }
+            });
+            // 2.05 keeps a double-spaced row (gap == 2 × size) in the paragraph and still
+            // rejects a blank line, which is 2.4 × the size.
+            let max_gap = own_leading.filter(|lead| *lead > tol * 0.4).map_or(tol * 2.05, |lead| lead * 1.5);
             // OCR lines stay apart: the scan fixes where each one is, so they never rewrap together.
             (!mixed || !(invisible(prev) || invisible(first)))
                 && (mixed || same_style(prev, first))
@@ -262,7 +278,7 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
                 && aligned
                 && first.size.min(prev.size) >= first.size.max(prev.size) * 0.4
                 && gap > first.size.min(prev.size) * 0.8
-                && gap < first.size.max(prev.size) * 2.5
+                && gap < max_gap
         });
         if !joins {
             blocks.push(TextBlock {
diff --git a/docs/gaps.md b/docs/gaps.md
index 56ec3ae748..e74daadbee 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -1,6 +1,7 @@
 # Where PdfCraft falls short of Acrobat Pro
 
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-25 · **Change:** minor (gaps 5 and 14 current state: native release Hans face via LXGW WenKai Lite; Arabic logical catalog, explicit RTL direction and mirrored stock chrome, with native/browser/IME workflows unqualified; no readiness re-estimate)
+> **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (gap 3: #2517 a blank line stays a paragraph break; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-19 · **Change:** minor (gap 2: composite fonts with `/ToUnicode /Identity-H` read as Unicode, hayro-interpret patch 44; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-17 · **Last updated:** 2026-10-17 · **Change:** minor (gap 6: #2662 redaction audit counts a cover over one word of a long line; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -100,7 +101,8 @@ update the numbers.
   Legacy non-SFNT previews, mixed-font/style contextual runs, structure-tree fidelity and reliable
   semantic grouping on every untagged PDF remain open. Replacing one line or paragraph no longer
   removes a distinct neighbour whose glyph box overlaps (#1316); a second drawing on the same
-  baseline is still replaced. Estimates are unchanged.
+  baseline is still replaced. A blank line at ordinary leading stays a paragraph break, so editing
+  the first paragraph leaves the next one in place (#2517). Estimates are unchanged.
 
 - **Missing:** robust in-place editing of text PdfCraft didn't write: subset fonts without the
   needed glyphs, CJK and right-to-left text, rotated text, lists, superscript/subscript, keeping
@@ -404,6 +406,7 @@ update the numbers.
 | Date | Change | Summary |
 |---|---|---|
 | 2026-10-25 | minor | Gaps 5 and 14 current state: native release builds embed LXGW WenKai Lite for Simplified Chinese, while the web build has no Hans face; Arabic catalogs stay logical with explicit RTL label direction and mirrored stock chrome, while native/browser RTL input, IME and complex workflows remain unqualified. Estimates unchanged. |
+| 2026-10-15 | minor | Gap 3: #2517 a blank line at ordinary leading stays a paragraph break. Estimates unchanged. |
 | 2026-10-19 | minor | Gap 2: a Type 0 font whose `/ToUnicode` is the name `/Identity-H` or `/Identity-V` (WSCAD) reads its codes as Unicode, so such pages have text to select, find and edit (hayro-interpret patch 44, `view.render-cid-fonts`). Estimates unchanged. |
 | 2026-10-15 | minor | Gap 21: the side-by-side view had already shipped; the Compare panel filters text changes and visual differences. Estimate 10–20 h → 8–16 h |
 | 2026-10-20 | minor | Gap 6 #3673: Character encoding accepts Identity-H/V with Adobe CJK collections, or a predefined non-Identity CMap; negative and indirect-reference regressions and a read-only automation test passed after failing before the fix. Per-glyph validation and embedded-font extraction remain separate. Scores and estimates unchanged. |
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 25205e92c1..d90c65a67c 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -9,7 +9,7 @@
 > **Last reviewed:** 2026-10-23 | **Last updated:** 2026-10-23 | **Change:** minor (M10: table spans retain text from covered slots in Office exports; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M10: image export preserves soft-mask Decode opacity ranges; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M10: vector printing preserves existing page XObjects when adding annotation appearances; estimates unchanged)
-> **Last reviewed:** 2026-10-20 · **Last updated:** 2026-10-20 · **Change:** minor (M12 #3673: Character encoding accepts Identity-H/V with Adobe CJK collections; estimates unchanged)
+> **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (M7 #2517: a blank line stays a paragraph break; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 > **Last reviewed:** 2026-10-20 | **Last updated:** 2026-10-20 | **Change:** minor (M10, #3532 partial: vector printing retains existing appearances with absent Subtype; estimates unchanged)
 
@@ -265,6 +265,7 @@ Estimates unchanged.
 | 2026-10-21 | minor | M3: on GNOME/Wayland, a second resize by an edge or move by the tab strip works without a click in between (the compositor kept the button's release from egui). Estimates unchanged. |
 | 2026-10-22 | minor | M4, #3916 partial: edits and Undo/Redo cancel Organize page drags. Pointer-release and save/reopen regressions check page order. Estimates unchanged. |
 | 2026-10-22 | minor | M14 #3558: rebased macOS association recovery; reuse #3042 shared metadata preservation instead of a duplicate save wrapper. Estimates unchanged. |
+| 2026-10-15 | minor | M7 #2517: a blank line between paragraphs stays a paragraph break, and growing the first paragraph does not absorb the next one. Estimates unchanged. |
 | 2026-10-20 | minor | M4: initial-view window and interface options resolve indirect boolean ViewerPreferences values; synthetic true/false and save/reopen regressions retain defaults for malformed entries. Estimates unchanged. |
 | 2026-10-21 | minor | M3, #3808: the Pages inspector has an independent 50–150% thumbnail size slider and buttons; selection and current-page following are retained, with headless ui.set coverage. Estimates unchanged. |
 | 2026-10-20 | minor | M11 #3507: image merging preserves comments and state across content streams. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 3b8dba920c..3bed5a6db3 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1914,8 +1914,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["text_paragraphs"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
-notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; hyphenated line ends are joined; a row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it"
+evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
+notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; a blank line (about twice the paragraph's own leading) stays a separate paragraph, and editing the first one leaves the next in place (#2517); hyphenated line ends are joined; a row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it"
 
 [[feature]]
 id = "edit.font-reuse-substitution"

From 53e6d832af37732b87c6b2650152344d53c32f6f Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Fri, 16 Oct 2026 20:43:49 +0200
Subject: [PATCH 114/270] M7: keep an explicit leading, and a grown paragraph's
 neighbour (#2517)

The join limit follows the text object's TL when it has one, checked against the measured baseline gap. A rewrite of every row is marked so a new row one leading above the next paragraph does not absorb it.
---
 ROADMAP.md                               |  2 +-
 crates/automation/tests/it/automation.rs | 22 +++++--
 crates/edit/src/tests.rs                 | 81 ++++++++++++++++++++++++
 crates/edit/src/text_regions/grouping.rs | 16 ++---
 crates/edit/src/text_regions/styled.rs   | 11 ++++
 docs/gaps.md                             |  7 +-
 parity/acrobat-features.toml             |  2 +-
 7 files changed, 124 insertions(+), 17 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 19bad63491..f96de024f2 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -204,6 +204,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M10, #4158 partial):** Word, HTML, RTF and PowerPoint export keep a block that continues another on its line (an italic case name, a link, a superscript) as a run in its own style inside that paragraph, with the source's word space, instead of a paragraph of its own. Style changes that wrap onto the next line still split paragraphs (the reading blocks keep style boundaries). Estimates unchanged.
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
+- **2026-10-15 (M7, #2517):** A blank line between paragraphs stays a paragraph break. An explicit `TL` is checked against the measured baseline gap: rows at that gap stay one paragraph, and a gap of twice the `TL` does not. Growing the paragraph so the new row is one leading above the next paragraph does not absorb it on a later edit. Estimates unchanged.
 
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
@@ -223,7 +224,6 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-22 (M4, #3916 partial):** Document edits and Undo/Redo cancel an Organize page drag. Pointer-release regressions check exact page order and save/reopen.
 - **2026-10-22 (M10, #3752 paper):** CUPS jobs ask for the chosen paper in every size. The 13 sizes the Print dialog sent no paper for (A6, A0–A2, ARCH, ANSI C–E) use PWG 5101.1 names, checked against a synthetic PPD with `cupsfilter`, and `doc_print` to a printer sends the paper too. The macOS tray half (Auto Select instead of the PPD's default tray) is a craft-print change that needs a pin bump here. Estimates unchanged.
 - **2026-10-22 (M14, macOS association recovery candidate):** Successful desktop open/save/sign can queue recovery of an existing per-file binding to the running PDFCraft bundle through NSWorkspace. Metadata-only watcher changes retain undo and avoid false overwrite prompts; real same-length/same-mtime edits remain protected. Rebased on 0.12.0 and reuses #3042's shared atomic metadata preservation; the bounded recovery parser does not narrow save limits. Prior native Preview TEST-signature and Finder workflows passed on macOS 27.0.1; other versions remain unqualified. Estimates unchanged.
-- **2026-10-15 (M7, #2517):** A blank line between paragraphs stays a paragraph break. Rows join while the gap is within the paragraph's own leading, or within about twice the font size when the paragraph has only one row. Editing the first paragraph leaves the next one in place, including after the first paragraph grows by a row. Estimates unchanged.
 - **2026-10-13 (M7, free image rotation):** A selected page image has a rotate knob (Shift: 15 degree steps) and `image_edit` a `rotate_by` action; the angle is written as one undoable `cm`. Snapping to page edges while moving is in #1740; resize snapping is not done. Estimates unchanged.
 
 - **2026-10-20 (M4, initial view):** Window and interface options read indirect boolean ViewerPreferences values. Synthetic regressions cover true/false, direct/indirect preference dictionaries and save/reopen; malformed entries retain false defaults. Estimates unchanged.
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 202f204628..61d9a4deb3 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -9458,9 +9458,10 @@ fn clearing_a_kids_default_through_tools_does_not_bring_back_its_parents() {
     assert!(city["value"].is_null() || city["value"] == "", "reset clears it rather than restoring the parent's Main St: {}", city["value"]);
 }
 
-/// #2517, through the same tools as the report: one blank line is two paragraphs, and editing
-/// the first leaves the second. Growing the first by a row does not absorb a neighbour that
-/// started three sizes below.
+/// #2517, through the same tools as the report. One blank line is two paragraphs, and editing
+/// the first leaves the second. The neighbour at y=656.8 is one blank line below (two 14.4 pt
+/// leadings under the second row). Growing the first paragraph, saving, reopening and editing
+/// again leaves that neighbour in place. An explicit TL of 27.6 pt stays one paragraph.
 #[test]
 fn a_blank_line_stays_a_separate_paragraph_through_tools() {
     let dir = workdir("blank-line");
@@ -9478,12 +9479,23 @@ fn a_blank_line_stays_a_separate_paragraph_through_tools() {
     assert!(second.contains("Second paragraph"), "{second}");
 
     let grown = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (One) Tj T* (Two) Tj ET \
-                 BT /F1 12 Tf 1 0 0 1 72 649.6 Tm (Neighbour) Tj ET";
+                 BT /F1 12 Tf 14.4 TL 1 0 0 1 72 656.8 Tm (Neighbour) Tj ET";
     std::fs::write(dir.join("grown.pdf"), helvetica_page(grown)).unwrap();
     let grown_doc = ok(&mut a, "doc_open", json!({ "path": "grown.pdf" }))["doc"].as_u64().unwrap();
     assert_eq!(ok(&mut a, "text_paragraphs", json!({ "doc": grown_doc, "page": 1 }))["count"], 2);
     ok(&mut a, "text_edit", json!({ "doc": grown_doc, "page": 1, "paragraph": 1, "text": "One\nTwo\nThree" }));
-    let after = ok(&mut a, "text_paragraphs", json!({ "doc": grown_doc, "page": 1 }));
+    ok(&mut a, "doc_save", json!({ "doc": grown_doc, "path": "grown-out.pdf" }));
+    let saved = ok(&mut a, "doc_open", json!({ "path": "grown-out.pdf" }))["doc"].as_u64().unwrap();
+    let after = ok(&mut a, "text_paragraphs", json!({ "doc": saved, "page": 1 }));
     assert_eq!(after["count"], 2, "{after}");
     assert!(after["paragraphs"][1]["text"].as_str().unwrap().contains("Neighbour"), "{after}");
+    ok(&mut a, "text_edit", json!({ "doc": saved, "page": 1, "paragraph": 1, "text": "One\nTwo\nFour" }));
+    let after = ok(&mut a, "text_paragraphs", json!({ "doc": saved, "page": 1 }));
+    assert_eq!(after["count"], 2, "{after}");
+    assert!(after["paragraphs"][1]["text"].as_str().unwrap().contains("Neighbour"), "{after}");
+
+    let spaced = "BT /F1 12 Tf 27.6 TL 1 0 0 1 72 700 Tm (One) Tj T* (Two) Tj T* (Three) Tj ET";
+    std::fs::write(dir.join("spaced.pdf"), helvetica_page(spaced)).unwrap();
+    let spaced_doc = ok(&mut a, "doc_open", json!({ "path": "spaced.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "text_paragraphs", json!({ "doc": spaced_doc, "page": 1 }))["count"], 1);
 }
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index bb752149d4..12f8eebe6d 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -2802,7 +2802,17 @@ fn a_blank_line_keeps_the_next_paragraph() {
     text::replace_block(&mut doc, 0, 0, "First paragraph, edited row.\nFirst paragraph, second row.").unwrap();
     let after = text::text_blocks(&doc, 0).unwrap();
     assert_eq!(after.len(), 2, "{:?}", after.iter().map(|b| b.text.as_str()).collect::<Vec<_>>());
+    assert!(after[0].text.contains("edited row") && after[0].text.contains("second row"), "{:?}", after[0].text);
     assert!(after[1].text.contains("Second paragraph"), "{:?}", after[1].text);
+    // The second row is left in the source stream. A marker around only the rewritten row
+    // would split the paragraph; either there is no marker, or it covers both rows and not the next paragraph.
+    let content = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
+    if let Some(start) = content.find("/P BMC") {
+        let end = start + content[start..].find("EMC").unwrap_or(content.len() - start);
+        let marked = &content[start..end];
+        assert!(marked.contains("edited row") && marked.contains("second row"), "marker split the paragraph: {content}");
+        assert!(!marked.contains("Second paragraph"), "marker swallowed the next paragraph: {content}");
+    }
 }
 
 /// #2517: adding a row must not pull in a paragraph that was 3 × the font size below.
@@ -2818,6 +2828,77 @@ fn a_grown_paragraph_does_not_swallow_the_next_one() {
     assert!(after[1].text.contains("Neighbour"), "{:?}", after[1].text);
 }
 
+/// An explicit `TL` is the leading `T*` moves by. Rows at that gap are one paragraph, including
+/// when the gap is larger than twice the font size. A following paragraph that starts two
+/// leadings lower stays separate. The numbers are the gaps under test, not a claim about how a
+/// word processor derives them: this repo's Helvetica box is 0.925 em (ascent 0.718, descent
+/// 0.207), so twice that box at 12 pt is 22.2 pt, while 27.6 pt is 12 × 2.3.
+#[test]
+fn explicit_leading_is_the_measured_baseline_gap() {
+    for tl in [14.4_f64, 18.0, 22.2, 24.0, 27.6, 28.8] {
+        let src = format!("BT /F1 12 Tf {tl} TL 1 0 0 1 72 700 Tm (One) Tj T* (Two) Tj T* (Three) Tj ET");
+        let doc = text_page(&src);
+        let lines = text::text_lines(&doc, 0).unwrap();
+        let gaps: Vec<f64> = lines.windows(2).map(|w| w[0].origin_baseline() - w[1].origin_baseline()).collect();
+        assert!(gaps.iter().all(|gap| (gap - tl).abs() < 0.05), "TL {tl} did not move the baselines: {gaps:?}");
+        let blocks = text::text_blocks(&doc, 0).unwrap();
+        assert_eq!(blocks.len(), 1, "TL {tl}, measured gaps {gaps:?}: {:?}", blocks.iter().map(|b| b.text.as_str()).collect::<Vec<_>>());
+    }
+    // Two rows at the TL, then a paragraph whose first baseline is two TLs below the second row.
+    let tl = 14.4_f64;
+    let next = 700.0 - tl - 2.0 * tl;
+    let blank = format!(
+        "BT /F1 12 Tf {tl} TL 1 0 0 1 72 700 Tm (One) Tj T* (Two) Tj ET \
+         BT /F1 12 Tf {tl} TL 1 0 0 1 72 {next} Tm (Neighbour) Tj ET"
+    );
+    let doc = text_page(&blank);
+    let lines = text::text_lines(&doc, 0).unwrap();
+    let between = lines[1].origin_baseline() - lines[2].origin_baseline();
+    assert!((between - 2.0 * tl).abs() < 0.05, "the blank line measured {between}, not {}", 2.0 * tl);
+    let blocks = text::text_blocks(&doc, 0).unwrap();
+    assert_eq!(blocks.len(), 2, "{:?}", blocks.iter().map(|b| b.text.as_str()).collect::<Vec<_>>());
+}
+
+/// The neighbour starts one blank line below (two leadings under the second row). Adding a row
+/// puts the new baseline one leading above that neighbour, inside the join window. The neighbour
+/// still has to survive the edit, both saves, and a second edit.
+#[test]
+fn growing_into_a_blank_line_keeps_the_neighbour_after_save() {
+    let tl = 14.4_f64;
+    let src = format!(
+        "BT /F1 12 Tf {tl} TL 1 0 0 1 72 700 Tm (One) Tj T* (Two) Tj ET \
+         BT /F1 12 Tf {tl} TL 1 0 0 1 72 {} Tm (Neighbour) Tj ET",
+        700.0 - 3.0 * tl
+    );
+    let mut doc = text_page(&src);
+    let before = text::text_lines(&doc, 0).unwrap();
+    let opening = before[1].origin_baseline() - before[2].origin_baseline();
+    assert!((opening - 2.0 * tl).abs() < 0.05, "fixture gap {opening} is not a blank line");
+    assert_eq!(text::text_blocks(&doc, 0).unwrap().len(), 2);
+    text::replace_block(&mut doc, 0, 0, "One\nTwo\nThree").unwrap();
+    let lines = text::text_lines(&doc, 0).unwrap();
+    let bases: Vec<f64> = lines.iter().map(|l| l.origin_baseline()).collect();
+    assert_eq!(bases.len(), 4, "{bases:?}");
+    let grown = bases[2] - bases[3];
+    assert!((grown - tl).abs() < 0.05, "the new row is {grown} pt above the neighbour, not one leading");
+    assert!(grown < tl * 1.5, "this gap is outside the join window, so the test would pass without the marker");
+    let texts = |doc: &Document| text::text_blocks(doc, 0).unwrap().into_iter().map(|b| b.text).collect::<Vec<_>>();
+    assert_eq!(texts(&doc), ["One Two Three", "Neighbour"]);
+    let content = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
+    let marked = content.find("/P BMC").and_then(|start| content[start..].find("EMC").map(|end| content[start..start + end].to_owned()));
+    let marked = marked.unwrap_or_else(|| panic!("a full rewrite did not mark its rows: {content}"));
+    for row in ["(One)", "(Two)", "(Three)"] {
+        assert!(marked.contains(row), "{row} is outside the marker: {content}");
+    }
+    assert!(!marked.contains("Neighbour"), "the neighbour was pulled into the marker: {content}");
+    for saved in [reopen(&doc), Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap()] {
+        assert_eq!(texts(&saved), ["One Two Three", "Neighbour"]);
+        let mut again = saved;
+        text::replace_block(&mut again, 0, 0, "One\nTwo\nFour").unwrap();
+        assert_eq!(texts(&reopen(&again)), ["One Two Four", "Neighbour"]);
+    }
+}
+
 #[test]
 fn paragraphs_are_found_and_rewrapped() {
     let mut doc = text_page(
diff --git a/crates/edit/src/text_regions/grouping.rs b/crates/edit/src/text_regions/grouping.rs
index 9d3e5eaa9d..0f2eb7989b 100644
--- a/crates/edit/src/text_regions/grouping.rs
+++ b/crates/edit/src/text_regions/grouping.rs
@@ -253,11 +253,12 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
                 || ((pr[0] + pr[2] - frame[0] - frame[2]) / 2.0).abs() < tol
                 || (pr[2] - frame[2]).abs() < tol
                 || hanging;
-            // Once a paragraph has two rows, its own leading is known. A blank line is about
-            // twice that, so a wider gap is the next paragraph (#2517). A single row has no
-            // leading yet: ordinary leading (about 1.2 × the size) and double spacing (2 × the
-            // size) still join, and a blank line (2.4 × the size) does not. The old cap of
-            // 2.5 × the size joined the blank line too.
+            // Once a paragraph has two rows, its own leading is the measured baseline gap. A
+            // blank line is about twice that, so a wider gap is the next paragraph (#2517). A
+            // single row uses the text object's TL when it has one: a gap equal to that TL
+            // joins, and a gap of twice the TL does not. Without a TL, ordinary leading still
+            // joins and a gap of 2.4 × the size does not. The old cap of 2.5 × the size joined
+            // the blank line too.
             let own_leading = block.rows.len().checked_sub(2).and_then(|i| {
                 let above = block.rows.get(i)?.first().and_then(|n| lines.get(*n));
                 let below = prev_row.first().and_then(|n| lines.get(*n));
@@ -266,9 +267,8 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
                     _ => None,
                 }
             });
-            // 2.05 keeps a double-spaced row (gap == 2 × size) in the paragraph and still
-            // rejects a blank line, which is 2.4 × the size.
-            let max_gap = own_leading.filter(|lead| *lead > tol * 0.4).map_or(tol * 2.05, |lead| lead * 1.5);
+            let stated = (prev.origin.state.leading > 0.0).then(|| prev.wrap_leading()).filter(|lead| lead.is_finite() && *lead > tol * 0.4);
+            let max_gap = own_leading.filter(|lead| *lead > tol * 0.4).or(stated).map_or(tol * 2.05, |lead| lead * 1.5);
             // OCR lines stay apart: the scan fixes where each one is, so they never rewrap together.
             (!mixed || !(invisible(prev) || invisible(first)))
                 && (mixed || same_style(prev, first))
diff --git a/crates/edit/src/text_regions/styled.rs b/crates/edit/src/text_regions/styled.rs
index e8b3b683d0..121adc171f 100644
--- a/crates/edit/src/text_regions/styled.rs
+++ b/crates/edit/src/text_regions/styled.rs
@@ -796,6 +796,14 @@ pub(crate) fn rewrite_styled_block(
         .ok_or_else(|| EditError::Invalid("the paragraph is drawn in a space it cannot be edited in".into()))?;
     let (tx, ty) = back.apply(dx, dy);
     block_ops.push(Op::new("cm", vec![n(1.0), n(0.0), n(0.0), n(1.0), n(tx), n(ty)]));
+    // A new row can land one leading above the next paragraph and look like the same
+    // paragraph. When every row is in this rewrite, a paragraph marker keeps them in one
+    // scope so the neighbour stays out (#2517). A row left in the source stream cannot share
+    // that marker, so it is omitted and geometry groups those rows as before.
+    let marked = kept.iter().all(|row| !*row);
+    if marked {
+        block_ops.push(Op::new("BMC", vec![Object::name("P")]));
+    }
     let crop = p.crop(doc);
     let centered = is_centred(block, lines, (crop[0] + crop[2]) / 2.0, first.size);
     let source_leading = block
@@ -966,6 +974,9 @@ pub(crate) fn rewrite_styled_block(
             style.line_spacing.unwrap_or(1.5).clamp(0.5, 5.0) * style.size.unwrap_or(anchor.size)
         };
     }
+    if marked {
+        block_ops.push(Op::new("EMC", vec![]));
+    }
     block_ops.push(Op::new("Q", vec![]));
     block_ops.extend(after.ops());
     if split {
diff --git a/docs/gaps.md b/docs/gaps.md
index e74daadbee..75b0007e27 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -101,8 +101,11 @@ update the numbers.
   Legacy non-SFNT previews, mixed-font/style contextual runs, structure-tree fidelity and reliable
   semantic grouping on every untagged PDF remain open. Replacing one line or paragraph no longer
   removes a distinct neighbour whose glyph box overlaps (#1316); a second drawing on the same
-  baseline is still replaced. A blank line at ordinary leading stays a paragraph break, so editing
-  the first paragraph leaves the next one in place (#2517). Estimates are unchanged.
+  baseline is still replaced. A blank line stays a paragraph break. An explicit `TL` is the
+  measured baseline gap, and growing a paragraph so its new row is one leading above the next
+  one does not absorb that paragraph (#2517). A heading and smaller body lines (#1756), a
+  hanging-indent continuation (#2564), and cells in different columns (#1680, #2478) are still
+  grouped by the same geometry. Estimates are unchanged.
 
 - **Missing:** robust in-place editing of text PdfCraft didn't write: subset fonts without the
   needed glyphs, CJK and right-to-left text, rotated text, lists, superscript/subscript, keeping
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 3bed5a6db3..f14ce86754 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1915,7 +1915,7 @@ status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["text_paragraphs"]
 evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
-notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; a blank line (about twice the paragraph's own leading) stays a separate paragraph, and editing the first one leaves the next in place (#2517); hyphenated line ends are joined; a row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it"
+notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; a blank line (about twice the paragraph's own leading) stays a separate paragraph, and editing the first one leaves the next in place (#2517). An explicit TL is that leading: the measured baseline gap equals it, a gap of that size stays one paragraph even above twice the font size, and a gap of twice the TL is the next paragraph. A rewrite of every row is marked, so a new row one leading above the next paragraph does not absorb it on a later edit. Hyphenated line ends are joined. A row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it. Still open: a larger heading joined to smaller body lines (#1756) and cells in different columns (#1680, #2478)"
 
 [[feature]]
 id = "edit.font-reuse-substitution"

From 4ebb575a886c37390afbf7c3bc1446a4abe5f033 Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Sun, 18 Oct 2026 13:16:43 +0200
Subject: [PATCH 115/270] M7: keep a repeated step without TL, and a partial
 rewrite's neighbour (#2517)

Three or more rows at one repeated step stay one paragraph when the file has no TL, which is how LibreOffice writes each line. A rewrite that leaves a source row still marks the whole paragraph, so the neighbour survives a second edit. Dragging the box width keeps the line breaks.
---
 ROADMAP.md                                    |   2 +-
 crates/automation/tests/it/automation.rs      |  80 ++++
 crates/edit/src/tests.rs                      | 170 ++++++++
 crates/edit/src/text_regions/grouping.rs      |  31 +-
 crates/edit/src/text_regions/styled.rs        |  37 +-
 crates/ui-egui/src/tools/edit_text_ui.rs      |   4 +-
 crates/ui-egui/tests/it/editing.rs            | 222 +++++++++++
 crates/ui-egui/tests/play.rs                  | 374 ++++++++++++++++++
 .../ui-egui/tests/play/blank-line-edit.json   |  17 +
 .../play/partial-rewrite-keeps-neighbor.json  |  18 +
 .../play/repeated-step-opens-as-one.json      |  11 +
 .../play/repeated-step-td-inside-one-bt.json  |   9 +
 .../ui-egui/tests/play/repeated-step-tm.json  |   9 +
 .../tests/play/resize-grown-neighbor.json     |  19 +
 .../ui-egui/tests/play/widen-example-one.json |  19 +
 parity/acrobat-features.toml                  |   4 +-
 16 files changed, 1013 insertions(+), 13 deletions(-)
 create mode 100644 crates/ui-egui/tests/play.rs
 create mode 100644 crates/ui-egui/tests/play/blank-line-edit.json
 create mode 100644 crates/ui-egui/tests/play/partial-rewrite-keeps-neighbor.json
 create mode 100644 crates/ui-egui/tests/play/repeated-step-opens-as-one.json
 create mode 100644 crates/ui-egui/tests/play/repeated-step-td-inside-one-bt.json
 create mode 100644 crates/ui-egui/tests/play/repeated-step-tm.json
 create mode 100644 crates/ui-egui/tests/play/resize-grown-neighbor.json
 create mode 100644 crates/ui-egui/tests/play/widen-example-one.json

diff --git a/ROADMAP.md b/ROADMAP.md
index f96de024f2..de6d8e9692 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -204,7 +204,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M10, #4158 partial):** Word, HTML, RTF and PowerPoint export keep a block that continues another on its line (an italic case name, a link, a superscript) as a run in its own style inside that paragraph, with the source's word space, instead of a paragraph of its own. Style changes that wrap onto the next line still split paragraphs (the reading blocks keep style boundaries). Estimates unchanged.
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
-- **2026-10-15 (M7, #2517):** A blank line between paragraphs stays a paragraph break. An explicit `TL` is checked against the measured baseline gap: rows at that gap stay one paragraph, and a gap of twice the `TL` does not. Growing the paragraph so the new row is one leading above the next paragraph does not absorb it on a later edit. Estimates unchanged.
+- **2026-10-15 (M7, #2517):** A blank line between paragraphs stays a paragraph break. An explicit `TL` is the measured baseline gap. Without one, three or more rows at a repeated step stay one paragraph, and a single wider gap stays a break. Adding a row, even when an earlier row is left in the source, does not absorb the next paragraph on a later edit. Estimates unchanged.
 
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 61d9a4deb3..2f000fb0c6 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -9499,3 +9499,83 @@ fn a_blank_line_stays_a_separate_paragraph_through_tools() {
     let spaced_doc = ok(&mut a, "doc_open", json!({ "path": "spaced.pdf" }))["doc"].as_u64().unwrap();
     assert_eq!(ok(&mut a, "text_paragraphs", json!({ "doc": spaced_doc, "page": 1 }))["count"], 1);
 }
+
+fn paragraph_texts(a: &mut Automation, doc: u64) -> Vec<String> {
+    ok(a, "text_paragraphs", json!({ "doc": doc, "page": 1 }))["paragraphs"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|p| p["text"].as_str().unwrap().to_string())
+        .collect()
+}
+
+/// The reported edits, through open / text_paragraphs / text_edit / save / reopen / text_extract.
+/// Covers an explicit TL, the three ways a file moves rows without TL, a blank line written with
+/// Td, a two-row file that must stay split, and a partial rewrite that adds a row.
+#[test]
+fn paragraph_grouping_survives_save_and_reopen_through_tools() {
+    let dir = workdir("paragraph-grouping");
+    let mut a = auto(&dir);
+    for step in [27.6_f64, 28.8] {
+        let y2 = 700.0 - step;
+        let y3 = 700.0 - 2.0 * step;
+        let bodies = [
+            format!("BT /F1 12 Tf 1 0 0 1 72 700 Tm (One) Tj 0 -{step} Td (Two) Tj 0 -{step} Td (Three) Tj ET"),
+            format!(
+                "BT /F1 12 Tf 1 0 0 1 72 700 Tm (One) Tj ET BT /F1 12 Tf 1 0 0 1 72 {y2} Tm (Two) Tj ET BT /F1 12 Tf 1 0 0 1 72 {y3} Tm (Three) Tj ET"
+            ),
+            format!("BT /F1 12 Tf 72 700 Td (One) Tj ET BT /F1 12 Tf 72 {y2} Td (Two) Tj ET BT /F1 12 Tf 72 {y3} Td (Three) Tj ET"),
+        ];
+        for (i, body) in bodies.iter().enumerate() {
+            let path = format!("step-{step}-{i}.pdf");
+            std::fs::write(dir.join(&path), helvetica_page(body)).unwrap();
+            let doc = ok(&mut a, "doc_open", json!({ "path": path }))["doc"].as_u64().unwrap();
+            let paras = paragraph_texts(&mut a, doc);
+            assert_eq!(paras.len(), 1, "{path}: {paras:?}");
+            assert!(paras[0].contains("One") && paras[0].contains("Two") && paras[0].contains("Three"), "{path}: {paras:?}");
+            let extracted = page_text(&mut a, doc);
+            assert!(extracted[0].contains("One") && extracted[0].contains("Three"), "{path}: {extracted:?}");
+        }
+    }
+
+    // One gap and no third row: still two paragraphs.
+    let pair = format!("BT /F1 12 Tf 72 700 Td (One) Tj ET BT /F1 12 Tf 72 {} Td (Two) Tj ET", 700.0 - 27.6);
+    std::fs::write(dir.join("pair.pdf"), helvetica_page(&pair)).unwrap();
+    let pair_doc = ok(&mut a, "doc_open", json!({ "path": "pair.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(paragraph_texts(&mut a, pair_doc).len(), 2);
+
+    // Blank line written with Td, not TL. The inner step repeats; the break does not.
+    let inner = 14.4_f64;
+    let blank = format!(
+        "BT /F1 12 Tf 72 700 Td (One) Tj ET BT /F1 12 Tf 72 {} Td (Two) Tj ET \
+         BT /F1 12 Tf 72 {} Td (Neighbour) Tj ET BT /F1 12 Tf 72 {} Td (Line) Tj ET",
+        700.0 - inner,
+        700.0 - 3.0 * inner,
+        700.0 - 4.0 * inner
+    );
+    std::fs::write(dir.join("blank.pdf"), helvetica_page(&blank)).unwrap();
+    let blank_doc = ok(&mut a, "doc_open", json!({ "path": "blank.pdf" }))["doc"].as_u64().unwrap();
+    let blank_paras = paragraph_texts(&mut a, blank_doc);
+    assert_eq!(blank_paras.len(), 2, "{blank_paras:?}");
+    assert!(blank_paras[0].contains("One") && blank_paras[0].contains("Two"), "{blank_paras:?}");
+    assert!(blank_paras[1].contains("Neighbour") && blank_paras[1].contains("Line"), "{blank_paras:?}");
+
+    // The first row is unchanged. Save incremental, reopen, edit again, save in full, reopen.
+    let partial = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET \
+                   BT /F1 12 Tf 14.4 TL 1 0 0 1 72 656.8 Tm (Neighbor stays.) Tj ET";
+    std::fs::write(dir.join("partial.pdf"), helvetica_page(partial)).unwrap();
+    let doc = ok(&mut a, "doc_open", json!({ "path": "partial.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(paragraph_texts(&mut a, doc).len(), 2);
+    ok(&mut a, "text_edit", json!({ "doc": doc, "page": 1, "paragraph": 1, "text": "Alpha first row.\nTwo\nThree" }));
+    let incremental = ok(&mut a, "doc_save", json!({ "doc": doc, "path": "partial.pdf" }));
+    assert_eq!(incremental["incremental"], true, "{incremental}");
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "partial.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(paragraph_texts(&mut a, reopened), ["Alpha first row. Two Three", "Neighbor stays."]);
+    ok(&mut a, "text_edit", json!({ "doc": reopened, "page": 1, "paragraph": 1, "text": "Alpha first row.\nTwo\nFour" }));
+    let full = ok(&mut a, "doc_save", json!({ "doc": reopened, "path": "partial-full.pdf", "full": true }));
+    assert_eq!(full["incremental"], false, "{full}");
+    let again = ok(&mut a, "doc_open", json!({ "path": "partial-full.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(paragraph_texts(&mut a, again), ["Alpha first row. Two Four", "Neighbor stays."]);
+    let extracted = page_text(&mut a, again);
+    assert!(extracted[0].contains("Neighbor stays.") && extracted[0].contains("Four"), "{extracted:?}");
+}
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 12f8eebe6d..2d17252bc5 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -2899,6 +2899,176 @@ fn growing_into_a_blank_line_keeps_the_neighbour_after_save() {
     }
 }
 
+/// No `TL`: `Td` does not set the leading (`TD` does). Three rows at one repeated step are one
+/// paragraph. A single large gap, with no third row at that step, stays a break.
+#[test]
+fn a_repeated_step_without_tl_is_the_paragraph_leading() {
+    let step = 27.6_f64;
+    let bodies = [
+        format!("BT /F1 12 Tf 1 0 0 1 72 700 Tm (One) Tj 0 -{step} Td (Two) Tj 0 -{step} Td (Three) Tj ET"),
+        format!(
+            "BT /F1 12 Tf 1 0 0 1 72 700 Tm (One) Tj ET BT /F1 12 Tf 1 0 0 1 72 {} Tm (Two) Tj ET BT /F1 12 Tf 1 0 0 1 72 {} Tm (Three) Tj ET",
+            700.0 - step,
+            700.0 - 2.0 * step
+        ),
+        format!(
+            "BT /F1 12 Tf 72 700 Td (One) Tj ET BT /F1 12 Tf 72 {} Td (Two) Tj ET BT /F1 12 Tf 72 {} Td (Three) Tj ET",
+            700.0 - step,
+            700.0 - 2.0 * step
+        ),
+    ];
+    for body in bodies {
+        let doc = text_page(&body);
+        let lines = text::text_lines(&doc, 0).unwrap();
+        let gaps: Vec<f64> = lines.windows(2).map(|w| w[0].origin_baseline() - w[1].origin_baseline()).collect();
+        assert!(gaps.iter().all(|gap| (gap - step).abs() < 0.05), "step {step} measured {gaps:?} in {body}");
+        let blocks = text::text_blocks(&doc, 0).unwrap();
+        assert_eq!(blocks.len(), 1, "{body} -> {:?}", blocks.iter().map(|b| b.text.as_str()).collect::<Vec<_>>());
+    }
+    // Two rows and nothing after them: one gap cannot be told from a paragraph break.
+    let pair = format!("BT /F1 12 Tf 72 700 Td (One) Tj ET BT /F1 12 Tf 72 {} Td (Two) Tj ET", 700.0 - step);
+    assert_eq!(text::text_blocks(&text_page(&pair), 0).unwrap().len(), 2);
+    // The original blank line, written with Td instead of TL: the inner step repeats, the break does not.
+    let inner = 14.4_f64;
+    let blank = format!(
+        "BT /F1 12 Tf 72 700 Td (One) Tj ET BT /F1 12 Tf 72 {} Td (Two) Tj ET \
+         BT /F1 12 Tf 72 {} Td (Neighbour) Tj ET BT /F1 12 Tf 72 {} Td (Line) Tj ET",
+        700.0 - inner,
+        700.0 - 3.0 * inner,
+        700.0 - 4.0 * inner
+    );
+    let doc = text_page(&blank);
+    let lines = text::text_lines(&doc, 0).unwrap();
+    let break_gap = lines[1].origin_baseline() - lines[2].origin_baseline();
+    assert!((break_gap - 2.0 * inner).abs() < 0.05, "blank line measured {break_gap}");
+    let blocks = text::text_blocks(&doc, 0).unwrap();
+    assert_eq!(blocks.len(), 2, "{:?}", blocks.iter().map(|b| b.text.as_str()).collect::<Vec<_>>());
+}
+
+/// The first row is unchanged, so the rewrite leaves it in the source stream and skips the
+/// paragraph marker. The added row then sits one leading above the neighbour.
+#[test]
+fn a_partial_rewrite_that_adds_a_row_keeps_the_neighbour() {
+    let src = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET \
+               BT /F1 12 Tf 14.4 TL 1 0 0 1 72 656.8 Tm (Neighbor stays.) Tj ET";
+    let mut doc = text_page(src);
+    assert_eq!(text::text_blocks(&doc, 0).unwrap().len(), 2);
+    text::replace_block(&mut doc, 0, 0, "Alpha first row.\nTwo\nThree").unwrap();
+    let texts = |doc: &Document| text::text_blocks(doc, 0).unwrap().into_iter().map(|b| b.text).collect::<Vec<_>>();
+    let content = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
+    assert_eq!(texts(&doc), ["Alpha first row. Two Three", "Neighbor stays."], "{content}");
+    for saved in [reopen(&doc), Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap()] {
+        assert_eq!(texts(&saved), ["Alpha first row. Two Three", "Neighbor stays."]);
+        let mut again = saved;
+        text::replace_block(&mut again, 0, 0, "Alpha first row.\nTwo\nFour").unwrap();
+        assert_eq!(texts(&reopen(&again)), ["Alpha first row. Two Four", "Neighbor stays."]);
+    }
+}
+
+/// #2516's published steps: adding a row must not make the next edit-by-number rewrite Charlie.
+/// The issue also asks for a stable paragraph id. That is #2508, and this test does not add one.
+#[test]
+fn adding_a_row_does_not_make_the_next_paragraph_number_mean_charlie() {
+    let src = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha paragraph, first row of text.) Tj T* (Alpha paragraph, second row.) Tj ET \
+               BT /F1 12 Tf 14.4 TL 1 0 0 1 72 650 Tm (Bravo paragraph, a single row.) Tj ET \
+               BT /F1 12 Tf 14.4 TL 1 0 0 1 72 600 Tm (Charlie paragraph, first row of text.) Tj T* (Charlie paragraph, second row.) Tj ET";
+    let mut doc = text_page(src);
+    let names = |doc: &Document| text::text_blocks(doc, 0).unwrap().into_iter().map(|b| b.text).collect::<Vec<_>>();
+    assert_eq!(names(&doc).len(), 3, "{:?}", names(&doc));
+    text::replace_block(&mut doc, 0, 0, "Alpha paragraph, first row of text.\nAlpha paragraph, second row.\nAlpha paragraph, a third row.").unwrap();
+    let after = names(&doc);
+    assert!(after.iter().any(|t| t.contains("Bravo") && !t.contains("Alpha")), "Bravo was absorbed: {after:?}");
+    assert!(after.iter().any(|t| t.contains("Charlie")), "Charlie is gone: {after:?}");
+    let bravo = after.iter().position(|t| t.contains("Bravo")).unwrap();
+    text::replace_block(&mut doc, 0, bravo, "Bravo paragraph, edited.").unwrap();
+    let done = names(&doc);
+    assert!(done.iter().any(|t| t.contains("Charlie")), "editing Bravo removed Charlie: {done:?}");
+    assert!(done.iter().any(|t| t.contains("Bravo paragraph, edited.")), "{done:?}");
+}
+
+/// A blank line is one extra leading, so the fourth row of a grown paragraph sits on the
+/// neighbour's baseline. Changing the box width must not treat that neighbour as a duplicate
+/// drawing and delete it.
+#[test]
+fn resizing_a_grown_paragraph_keeps_the_neighbour() {
+    let src = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 410 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET \
+               BT /F1 12 Tf 14.4 TL 1 0 0 1 72 366.8 Tm (Neighbor stays.) Tj ET";
+    let mut doc = text_page(src);
+    let text = "Alpha first row.\nthis is another\nalpha test\nAlpha next row.";
+    text::replace_block(&mut doc, 0, 0, text).unwrap();
+    let lines = text::text_lines(&doc, 0).unwrap();
+    let added = lines.iter().find(|l| l.text.contains("Alpha next row.")).unwrap();
+    let neighbour = lines.iter().find(|l| l.text.contains("Neighbor")).unwrap();
+    assert!((added.origin_baseline() - neighbour.origin_baseline()).abs() < 0.5, "the new row is not on the neighbour");
+    let width = text::text_blocks(&doc, 0).unwrap()[0].rect[2] - text::text_blocks(&doc, 0).unwrap()[0].rect[0];
+    for factor in [0.6_f64, 1.6] {
+        let mut copy = doc.clone();
+        text::rewrite_block(&mut copy, 0, 0, Some(text), &text::BlockStyle { width: Some((width * factor).max(40.0)), ..Default::default() })
+            .unwrap();
+        let texts = text::text_blocks(&copy, 0).unwrap().into_iter().map(|b| b.text).collect::<Vec<_>>();
+        assert!(texts.iter().any(|t| t.contains("Neighbor stays.")), "width ×{factor} removed the neighbour: {texts:?}");
+    }
+}
+
+/// The letter the screenshots edit. Widening example 1, or adding a row there, must leave the
+/// heading above it and both paragraphs under example 2 as they were.
+fn letter_page() -> &'static str {
+    "BT /F1 14 Tf 72 740 Td (1. Repeated step, no TL. Click Two.) Tj ET \
+     BT /F1 12 Tf 72 700 Td (One) Tj ET \
+     BT /F1 12 Tf 72 672.4 Td (Two) Tj ET \
+     BT /F1 12 Tf 72 644.8 Td (Three) Tj ET \
+     BT /F1 14 Tf 72 590 Td (2. Blank line. Edit the first paragraph.) Tj ET \
+     BT /F1 12 Tf 14.4 TL 1 0 0 1 72 550 Tm (First paragraph, first row.) Tj T* (First paragraph, second row.) Tj ET \
+     BT /F1 12 Tf 14.4 TL 1 0 0 1 72 506.8 Tm (Second paragraph, first row.) Tj T* (Second paragraph, second row.) Tj ET \
+     BT /F1 14 Tf 72 450 Td (3. Add a row under Alpha. Neighbor stays.) Tj ET \
+     BT /F1 12 Tf 14.4 TL 1 0 0 1 72 410 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET \
+     BT /F1 12 Tf 14.4 TL 1 0 0 1 72 366.8 Tm (Neighbor stays.) Tj ET"
+}
+
+fn block_texts(doc: &Document) -> Vec<String> {
+    text::text_blocks(doc, 0).unwrap().into_iter().map(|b| b.text).collect()
+}
+
+#[test]
+fn widening_example_one_does_not_swallow_the_heading_or_split_the_next_paragraph() {
+    let mut doc = text_page(letter_page());
+    let before = block_texts(&doc);
+    assert!(before.iter().any(|t| t == "1. Repeated step, no TL. Click Two."), "{before:?}");
+    assert!(before.iter().any(|t| t.contains("One") && t.contains("Three") && !t.contains("Repeated")), "{before:?}");
+    assert!(before.iter().any(|t| t.contains("First paragraph, first row") && t.contains("second row")), "{before:?}");
+    let blocks = text::text_blocks(&doc, 0).unwrap();
+    let idx = blocks.iter().position(|b| b.text.contains("One") && b.text.contains("Three")).unwrap();
+    // What the editor committed, including the line breaks. A later width change must keep them.
+    text::replace_block(&mut doc, 0, idx, "One\nTwo\nThree\nfour").unwrap();
+    let blocks = text::text_blocks(&doc, 0).unwrap();
+    let idx = blocks.iter().position(|b| b.text.contains("four") || b.editor_text.contains("four")).unwrap();
+    let shown = blocks[idx].editor_text.clone();
+    let width = blocks[idx].rect[2] - blocks[idx].rect[0];
+    text::rewrite_block(&mut doc, 0, idx, Some(&shown), &text::BlockStyle { width: Some((width * 6.0).max(180.0)), ..Default::default() }).unwrap();
+    let doc = reopen(&doc);
+    let after = block_texts(&doc);
+    let kept = text::text_blocks(&doc, 0).unwrap().into_iter().find(|b| b.editor_text.contains("four")).unwrap();
+    assert_eq!(kept.editor_text, "One\nTwo\nThree\nfour", "a wider box flattened the line breaks: {:?}", kept.editor_text);
+    assert!(after.iter().any(|t| t == "1. Repeated step, no TL. Click Two."), "the heading joined the resized box: {after:?}");
+    assert!(
+        after.iter().any(|t| t.contains("First paragraph, first row") && t.contains("First paragraph, second row")),
+        "widening example 1 split the next paragraph: {after:?}"
+    );
+    assert!(after.iter().any(|t| t.contains("Second paragraph, first row") && t.contains("second row")), "{after:?}");
+    assert!(after.iter().any(|t| t.contains("Neighbor stays.") && !t.contains("Alpha")), "{after:?}");
+}
+
+#[test]
+fn a_row_added_one_leading_above_the_neighbour_does_not_absorb_it() {
+    let mut doc = text_page(letter_page());
+    let blocks = text::text_blocks(&doc, 0).unwrap();
+    let idx = blocks.iter().position(|b| b.text.contains("Alpha first row")).unwrap();
+    text::replace_block(&mut doc, 0, idx, "Alpha first row.\ntest\nAlpha next row.").unwrap();
+    let doc = reopen(&doc);
+    let after = block_texts(&doc);
+    assert!(after.iter().any(|t| t.contains("Neighbor stays.") && !t.contains("Alpha")), "the added row absorbed the neighbour: {after:?}");
+}
+
 #[test]
 fn paragraphs_are_found_and_rewrapped() {
     let mut doc = text_page(
diff --git a/crates/edit/src/text_regions/grouping.rs b/crates/edit/src/text_regions/grouping.rs
index 0f2eb7989b..68a83569a5 100644
--- a/crates/edit/src/text_regions/grouping.rs
+++ b/crates/edit/src/text_regions/grouping.rs
@@ -227,9 +227,10 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
         }
     }
     let mut blocks: Vec<TextBlock> = Vec::new();
-    for row in rows {
+    for row_at in 0..rows.len() {
+        let Some(row) = rows.get(row_at) else { continue };
         let Some(first) = row.first().and_then(|i| lines.get(*i)) else { continue };
-        let (Some(rect), Some(frame)) = (row_rect(&row, lines), frame_row_rect(&row, lines)) else { continue };
+        let (Some(rect), Some(frame)) = (row_rect(row, lines), frame_row_rect(row, lines)) else { continue };
         let joins = blocks.last().is_some_and(|block| {
             // A bullet of its own opens a list item (#2564): such a row is a new paragraph, and
             // letting it join is what made an edit of the row above delete this item and the ones
@@ -256,9 +257,10 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
             // Once a paragraph has two rows, its own leading is the measured baseline gap. A
             // blank line is about twice that, so a wider gap is the next paragraph (#2517). A
             // single row uses the text object's TL when it has one: a gap equal to that TL
-            // joins, and a gap of twice the TL does not. Without a TL, ordinary leading still
-            // joins and a gap of 2.4 × the size does not. The old cap of 2.5 × the size joined
-            // the blank line too.
+            // joins, and a gap of twice the TL does not. `Td` does not set TL (`TD` does). A
+            // step that repeats on the following row is that leading; one large gap, with no
+            // second step to compare, stays a break. The old cap of 2.5 × the size joined the
+            // blank line too.
             let own_leading = block.rows.len().checked_sub(2).and_then(|i| {
                 let above = block.rows.get(i)?.first().and_then(|n| lines.get(*n));
                 let below = prev_row.first().and_then(|n| lines.get(*n));
@@ -268,7 +270,20 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
                 }
             });
             let stated = (prev.origin.state.leading > 0.0).then(|| prev.wrap_leading()).filter(|lead| lead.is_finite() && *lead > tol * 0.4);
-            let max_gap = own_leading.filter(|lead| *lead > tol * 0.4).or(stated).map_or(tol * 2.05, |lead| lead * 1.5);
+            // The next row is not in this block yet. Its gap is only a leading when it matches
+            // this one: a blank line is a single wider gap and has no matching step after it.
+            let repeated = rows.get(row_at.saturating_add(1)).and_then(|next| {
+                let nfirst = next.first().and_then(|i| lines.get(*i))?;
+                let nframe = frame_row_rect(next, lines)?;
+                let ngap = first.frame_origin().1 - nfirst.frame_origin().1;
+                let same = same_plane(first, nfirst)
+                    && (mixed || same_style(first, nfirst))
+                    && first.size.min(nfirst.size) >= first.size.max(nfirst.size) * 0.4
+                    && (nframe[0] - frame[0]).abs() < tol;
+                let scale = gap.abs().max(ngap.abs());
+                if same && ngap > tol * 0.8 && scale < tol * 4.0 && (ngap - gap).abs() <= scale * 0.08 + 0.5 { Some(gap) } else { None }
+            });
+            let max_gap = own_leading.filter(|lead| *lead > tol * 0.4).or(stated).or(repeated).map_or(tol * 2.05, |lead| lead * 1.5);
             // OCR lines stay apart: the scan fixes where each one is, so they never rewrap together.
             (!mixed || !(invisible(prev) || invisible(first)))
                 && (mixed || same_style(prev, first))
@@ -302,7 +317,7 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
         if !block.rows.is_empty() {
             block.editor_text.push('\n');
         }
-        for &index in &row {
+        for &index in row {
             let Some(line) = lines.get(index) else { continue };
             // Some producers position separate words without encoding a space.
             if let Some(prev) = block.lines.last().filter(|i| row.contains(i)).and_then(|i| lines.get(*i))
@@ -329,7 +344,7 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
         }
         block.text.push_str(row_text.trim_matches(paragraph_separator));
         block.rect = union(block.rect, rect);
-        block.rows.push(row);
+        block.rows.push(row.clone());
     }
     blocks
 }
diff --git a/crates/edit/src/text_regions/styled.rs b/crates/edit/src/text_regions/styled.rs
index 121adc171f..a9f3711072 100644
--- a/crates/edit/src/text_regions/styled.rs
+++ b/crates/edit/src/text_regions/styled.rs
@@ -609,6 +609,22 @@ fn untouched_rows(block: &TextBlock, draft: &str, rows: &[std::ops::Range<usize>
         .collect()
 }
 
+/// Operator index of the paragraph's first text object, and of the next line's text object
+/// when one follows. The next index is where a closing marker belongs.
+fn paragraph_span(block: &TextBlock, lines: &[TextLine]) -> Option<(usize, Option<usize>)> {
+    let belongs: std::collections::HashSet<usize> = block.lines.iter().copied().collect();
+    let start = block.lines.iter().filter_map(|i| lines.get(*i)).map(|line| line.origin.bt_op).min()?;
+    let end =
+        block.lines.iter().filter_map(|i| lines.get(*i)).flat_map(|line| line.ops.iter().copied().chain(std::iter::once(line.origin.bt_op))).max()?;
+    let next = lines
+        .iter()
+        .enumerate()
+        .filter(|(index, _)| !belongs.contains(index))
+        .filter_map(|(_, line)| (line.origin.bt_op > end).then_some(line.origin.bt_op))
+        .min();
+    Some((start, next))
+}
+
 struct RewriteAnchor<'a> {
     lead: &'a TextLine,
     drop: std::collections::HashSet<usize>,
@@ -985,7 +1001,26 @@ pub(crate) fn rewrite_styled_block(
         block_ops.push(Op::new("Tm", o.tlm.iter().map(|v| n(*v)).collect()));
     }
     let at = if split { start } else { o.bt_op };
-    let data = splice(&pieces, &ops, |i| (if i == at { std::mem::take(&mut block_ops) } else { Vec::new() }, !drop.contains(&i)));
+    // A kept source row sits outside `block_ops`, so a marker only around the rewrite splits
+    // the paragraph or leaves the added row to join the neighbour. Bound the whole paragraph:
+    // from its first text object up to, but not including, the next line.
+    let marker = if marked { None } else { paragraph_span(block, lines) };
+    if marker.is_some_and(|(_, next)| next.is_none()) {
+        block_ops.push(Op::new("EMC", vec![]));
+    }
+    let data = splice(&pieces, &ops, |i| {
+        let mut insert = Vec::new();
+        if marker.is_some_and(|(start_at, _)| i == start_at) {
+            insert.push(Op::new("BMC", vec![Object::name("P")]));
+        }
+        if i == at {
+            insert.append(&mut block_ops);
+        }
+        if marker.is_some_and(|(_, next)| next == Some(i)) {
+            insert.push(Op::new("EMC", vec![]));
+        }
+        (insert, !drop.contains(&i))
+    });
     let contents = rewritten_contents(doc, &streams, data);
     res.set(b"Font".to_vec(), Object::Dict(fonts));
     doc.update_dict(p.obj, |d| {
diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
index 224bc3f545..c932ed3608 100644
--- a/crates/ui-egui/src/tools/edit_text_ui.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -399,7 +399,9 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, lines: &[pdfcraft_engine::Text
                 let width = (l.rect[2] - l.rect[0]) + (to[2] - to[0]) - (from[2] - from[0]);
                 let shift = to[0] - from[0];
                 let style = pdfcraft_engine::BlockStyle { width: Some(width), offset: (shift != 0.0).then_some([shift, 0.0]), ..Default::default() };
-                Edit::EditTextBlock { page, block: d.block, text: l.text.clone(), style }
+                // `text` joins rows with spaces. The editor text is what the paragraph actually
+                // is, line breaks included; a width change must not throw those breaks away.
+                Edit::EditTextBlock { page, block: d.block, text: l.editor_text.clone(), style }
             } else {
                 // Translation must keep the selected source operators. Rewriting unchanged text
                 // would also remove unrelated paragraphs that now overlap this one (#594).
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 0d44f91067..5a124aa390 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -3668,6 +3668,228 @@ fn a_paragraph_editor_opens_at_full_opacity() {
     }
 }
 
+/// One US Letter page of Helvetica, for driving the live editor on a known baseline.
+fn letter_text(body: &str) -> Vec<u8> {
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >>".to_string(),
+        format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_string(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for offset in offsets {
+        out.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+fn open_letter(name: &'static str, bytes: Vec<u8>) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1100.0, 1400.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes(name, None, bytes).unwrap();
+        app
+    });
+    h.run_steps(4);
+    h
+}
+
+fn click_page(h: &mut Harness<'static, PdfCraftApp>, x: f32, y: f32) {
+    let page = h.state().views[0].page_screen_rect(0).expect("the page is on screen");
+    let at = egui::pos2(page.left() + x / 612.0 * page.width(), page.top() + (792.0 - y) / 792.0 * page.height());
+    h.hover_at(at);
+    h.run_steps(1);
+    h.drag_at(at);
+    h.run_steps(1);
+    h.drop_at(at);
+    h.run_steps(4);
+}
+
+fn save_live_shot(h: &mut Harness<'static, PdfCraftApp>, name: &str) {
+    for _ in 0..40 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+    }
+    let dir = std::path::Path::new("/tmp/pdfcraft-visual");
+    let _ = std::fs::create_dir_all(dir);
+    if let Ok(image) = h.render() {
+        let _ = image.save(dir.join(name));
+    }
+}
+
+/// Live editor: a repeated step with no TL opens as one paragraph, and adding a row
+/// beside a kept first row leaves the neighbour as its own paragraph on screen.
+#[test]
+fn the_live_editor_groups_a_repeated_step_and_keeps_the_neighbour() {
+    let step = 27.6_f32;
+    let repeated = format!(
+        "BT /F1 12 Tf 72 700 Td (One) Tj ET BT /F1 12 Tf 72 {} Td (Two) Tj ET BT /F1 12 Tf 72 {} Td (Three) Tj ET",
+        700.0 - step,
+        700.0 - 2.0 * step
+    );
+    let mut h = open_letter("repeated.pdf", letter_text(&repeated));
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    click_page(&mut h, 90.0, 700.0 - step + 4.0);
+    let editor = h.state().views[0].line_editor.clone().expect("the middle row opens");
+    assert!(editor.text.contains("One") && editor.text.contains("Two") && editor.text.contains("Three"), "{}", editor.text);
+    save_live_shot(&mut h, "live-repeated-step.png");
+
+    let partial = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET \
+                   BT /F1 12 Tf 14.4 TL 1 0 0 1 72 656.8 Tm (Neighbor stays.) Tj ET";
+    let mut h = open_letter("partial.pdf", letter_text(partial));
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    click_page(&mut h, 120.0, 704.0);
+    let editor = h.state().views[0].line_editor.clone().expect("the first paragraph opens");
+    assert!(editor.text.contains("Alpha first row.") && editor.text.contains("Alpha next row."), "{}", editor.text);
+    assert!(!editor.text.contains("Neighbor"), "{}", editor.text);
+    h.state_mut().views[0].line_editor.as_mut().unwrap().text = "Alpha first row.\nTwo\nThree".into();
+    h.run_steps(1);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Enter);
+    h.run_steps(6);
+    let blocks = {
+        let s = h.state();
+        let doc = s.session.get(s.views[0].id).unwrap();
+        doc.text_blocks(0).iter().map(|b| b.text.clone()).collect::<Vec<_>>()
+    };
+    assert_eq!(blocks, ["Alpha first row. Two Three", "Neighbor stays."]);
+    save_live_shot(&mut h, "live-after-adding-a-row.png");
+    click_page(&mut h, 120.0, 660.0);
+    let neighbour = h.state().views[0].line_editor.clone().expect("the neighbour opens on its own");
+    assert_eq!(neighbour.text, "Neighbor stays.");
+    save_live_shot(&mut h, "live-neighbour-open.png");
+}
+
+/// Widening example 1 must not pull the heading into that box or split the paragraph under example 2.
+#[test]
+fn widening_example_one_keeps_the_heading_and_the_next_paragraph() {
+    let body = "BT /F1 14 Tf 72 740 Td (1. Repeated step, no TL. Click Two.) Tj ET \
+                BT /F1 12 Tf 72 700 Td (One) Tj ET \
+                BT /F1 12 Tf 72 672.4 Td (Two) Tj ET \
+                BT /F1 12 Tf 72 644.8 Td (Three) Tj ET \
+                BT /F1 14 Tf 72 590 Td (2. Blank line. Edit the first paragraph.) Tj ET \
+                BT /F1 12 Tf 14.4 TL 1 0 0 1 72 550 Tm (First paragraph, first row.) Tj T* (First paragraph, second row.) Tj ET \
+                BT /F1 12 Tf 14.4 TL 1 0 0 1 72 506.8 Tm (Second paragraph, first row.) Tj T* (Second paragraph, second row.) Tj ET \
+                BT /F1 14 Tf 72 450 Td (3. Add a row under Alpha. Neighbor stays.) Tj ET \
+                BT /F1 12 Tf 14.4 TL 1 0 0 1 72 410 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET \
+                BT /F1 12 Tf 14.4 TL 1 0 0 1 72 366.8 Tm (Neighbor stays.) Tj ET";
+    let mut h = open_letter("letter.pdf", letter_text(&body));
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    click_page(&mut h, 90.0, 690.0);
+    h.state_mut().views[0].line_editor.as_mut().unwrap().text = "One\nTwo\nThree\nfour".into();
+    h.run_steps(1);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Enter);
+    h.run_steps(8);
+    let (edge, page_id) = {
+        let s = h.state();
+        let id = s.views[0].id;
+        let blocks = s.session.get(id).unwrap().text_blocks(0);
+        let texts: Vec<_> = blocks.iter().map(|b| b.text.clone()).collect();
+        assert!(texts.iter().any(|t| t == "1. Repeated step, no TL. Click Two."), "commit already joined the heading: {texts:?}");
+        assert!(
+            texts.iter().any(|t| t.contains("First paragraph, first row") && t.contains("second row")),
+            "commit already split the next paragraph: {texts:?}"
+        );
+        let block = blocks.iter().find(|b| b.text.contains("four")).expect("the edited paragraph");
+        let page = s.views[0].page_screen_rect(0).unwrap();
+        let edge = egui::pos2(
+            page.left() + block.rect[2] as f32 / 612.0 * page.width(),
+            page.top() + (792.0 - (block.rect[1] + block.rect[3]) as f32 / 2.0) / 792.0 * page.height(),
+        );
+        (edge, id)
+    };
+    let to = edge + egui::vec2(280.0, 0.0);
+    h.hover_at(edge);
+    h.run_steps(1);
+    h.drag_at(edge);
+    h.run_steps(1);
+    for k in 1..=6 {
+        h.hover_at(edge + (to - edge) * (k as f32 / 6.0));
+        h.run_steps(1);
+    }
+    h.drop_at(to);
+    h.run_steps(8);
+    let texts: Vec<_> = {
+        let s = h.state();
+        s.session.get(page_id).unwrap().text_blocks(0).iter().map(|b| b.text.clone()).collect()
+    };
+    let edited = {
+        let s = h.state();
+        s.session
+            .get(page_id)
+            .unwrap()
+            .text_blocks(0)
+            .iter()
+            .find(|b| b.editor_text.contains("four"))
+            .expect("the widened paragraph")
+            .editor_text
+            .clone()
+    };
+    assert_eq!(edited, "One\nTwo\nThree\nfour", "the width handle flattened the line breaks: {edited:?}");
+    assert!(texts.iter().any(|t| t == "1. Repeated step, no TL. Click Two."), "the width handle joined the heading: {texts:?}");
+    assert!(
+        texts.iter().any(|t| t.contains("First paragraph, first row") && t.contains("First paragraph, second row")),
+        "the width handle split the next paragraph: {texts:?}"
+    );
+    save_live_shot(&mut h, "live-example-one-widened.png");
+}
+
+/// The live width handle, after a row was added on top of the neighbour.
+#[test]
+fn resizing_the_live_box_keeps_the_neighbour() {
+    let partial = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 410 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET \
+                   BT /F1 12 Tf 14.4 TL 1 0 0 1 72 366.8 Tm (Neighbor stays.) Tj ET";
+    let mut h = open_letter("partial.pdf", letter_text(partial));
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    click_page(&mut h, 120.0, 414.0);
+    h.state_mut().views[0].line_editor.as_mut().unwrap().text = "Alpha first row.\nthis is another\nalpha test\nAlpha next row.".into();
+    h.run_steps(1);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Enter);
+    h.run_steps(6);
+    let before = {
+        let s = h.state();
+        s.session.get(s.views[0].id).unwrap().text_blocks(0).iter().map(|b| b.text.clone()).collect::<Vec<_>>()
+    };
+    assert!(before.iter().any(|t| t.contains("Neighbor stays.")), "the edit already dropped it: {before:?}");
+    let page = h.state().views[0].page_screen_rect(0).unwrap();
+    let rect = h.state().session.get(h.state().views[0].id).unwrap().text_blocks(0)[0].rect;
+    let edge = egui::pos2(
+        page.left() + rect[2] as f32 / 612.0 * page.width(),
+        page.top() + (792.0 - (rect[1] + rect[3]) as f32 / 2.0) / 792.0 * page.height(),
+    );
+    let to = edge + egui::vec2(80.0, 0.0);
+    h.hover_at(edge);
+    h.run_steps(1);
+    h.drag_at(edge);
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.hover_at(edge + (to - edge) * (k as f32 / 4.0));
+        h.run_steps(1);
+    }
+    h.drop_at(to);
+    h.run_steps(6);
+    let after = {
+        let s = h.state();
+        s.session.get(s.views[0].id).unwrap().text_blocks(0).iter().map(|b| b.text.clone()).collect::<Vec<_>>()
+    };
+    assert!(after.iter().any(|t| t.contains("Neighbor stays.")), "resize removed the neighbour: {after:?}");
+    save_live_shot(&mut h, "live-after-resize.png");
+}
+
 #[test]
 fn editing_existing_text_in_place() {
     let mut h = harness(1, |_| {});
diff --git a/crates/ui-egui/tests/play.rs b/crates/ui-egui/tests/play.rs
new file mode 100644
index 0000000000..0cacc447a2
--- /dev/null
+++ b/crates/ui-egui/tests/play.rs
@@ -0,0 +1,374 @@
+//! Human sessions for the editor.
+//!
+//! Each file in `tests/play/*.json` is one session a person can do: open a page, click a
+//! paragraph, type, confirm, drag a box edge, then click the paragraph that must still be
+//! separate and read it back. Every session is repeated on several desks (window size and
+//! zoom), because that is what changes where a click lands.
+//!
+//! A miss writes a screenshot and the paragraph list to `/tmp/pdfcraft-play/` and fails this
+//! test with that report. `cargo test --workspace` runs it on the Linux and Windows CI
+//! machines. The paragraph rules themselves live in `pdfcraft-edit` and run on every OS that
+//! job tests. A pass covers these sessions and these desks, not every PDF a person might open.
+//!
+//! Page coordinates are PDF points. The default page is US Letter (612 by 792).
+//!
+//! ```text
+//! cargo test -p pdfcraft-ui-egui --test play -- --nocapture
+//! ```
+
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use egui::{Key, Modifiers};
+use egui_kittest::Harness;
+use pdfcraft_ui_egui::PdfCraftApp;
+use serde::Deserialize;
+
+#[derive(Debug, Deserialize)]
+struct Session {
+    name: String,
+    content: String,
+    /// PDF page size in points. Omitted sessions use US Letter.
+    #[serde(default = "letter")]
+    page: [f32; 2],
+    /// Window sizes and zooms. Omitted sessions use the shared desks.
+    #[serde(default)]
+    desks: Vec<Desk>,
+    steps: Vec<Step>,
+}
+
+#[derive(Clone, Debug, Deserialize)]
+struct Desk {
+    width: f32,
+    height: f32,
+    /// Zoom percent, as `ui.set zoom` accepts it (`100` is 100%).
+    zoom: String,
+}
+
+fn desks() -> Vec<Desk> {
+    vec![
+        Desk { width: 1100.0, height: 1400.0, zoom: "100".into() },
+        Desk { width: 1280.0, height: 800.0, zoom: "60".into() },
+        Desk { width: 900.0, height: 700.0, zoom: "50".into() },
+    ]
+}
+
+fn letter() -> [f32; 2] {
+    [612.0, 792.0]
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "snake_case")]
+enum Step {
+    Command {
+        id: String,
+    },
+    ClickPage {
+        x: f32,
+        y: f32,
+    },
+    /// Select everything in the open paragraph and type, including line breaks.
+    Type {
+        text: String,
+    },
+    /// Replace the open paragraph's text without keystrokes. Prefer `type`.
+    Editor {
+        text: String,
+    },
+    Key {
+        key: String,
+        #[serde(default)]
+        modifiers: Vec<String>,
+    },
+    DragEdge {
+        contains: String,
+        dx: f32,
+        #[serde(default)]
+        dy: f32,
+    },
+    ExpectEditor {
+        contains: String,
+        text: String,
+    },
+    ExpectParagraph {
+        text: String,
+    },
+    ExpectTogether {
+        parts: Vec<String>,
+    },
+    ExpectApart {
+        text: String,
+        not: String,
+    },
+    Shot {
+        name: String,
+    },
+}
+
+#[test]
+fn play_sessions_fetch_paragraph_bugs() {
+    let dir = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/play");
+    let mut files: Vec<_> = fs::read_dir(&dir).unwrap_or_else(|e| panic!("{}: {e}", dir.display())).map(|e| e.unwrap().path()).collect();
+    files.retain(|p| p.extension().is_some_and(|x| x == "json"));
+    files.sort();
+    assert!(!files.is_empty(), "no sessions in {}", dir.display());
+    let mut bugs = Vec::new();
+    for path in &files {
+        if let Err(report) = play_file(path) {
+            bugs.push(report);
+        }
+    }
+    assert!(bugs.is_empty(), "\n\n{}", bugs.join("\n\n"));
+}
+
+fn play_file(path: &Path) -> Result<(), String> {
+    let raw = fs::read_to_string(path).map_err(|e| format!("{}: {e}", path.display()))?;
+    let session: Session = serde_json::from_str(&raw).map_err(|e| format!("{}: {e}", path.display()))?;
+    let desks = if session.desks.is_empty() { desks() } else { session.desks.clone() };
+    let mut bugs = Vec::new();
+    for desk in &desks {
+        if let Err(report) = play_desk(&session, desk) {
+            bugs.push(report);
+        }
+    }
+    if bugs.is_empty() { Ok(()) } else { Err(bugs.join("\n")) }
+}
+
+fn play_desk(session: &Session, desk: &Desk) -> Result<(), String> {
+    let mut h = open_letter(&session.name, &session.content, desk);
+    if let Err(e) = h.state_mut().set_option("zoom", &desk.zoom) {
+        return Err(format!("{name} at {desk:?}: zoom: {e}", name = session.name));
+    }
+    h.run_steps(4);
+    eprintln!("{name}: {width}×{height} at {zoom}%", name = session.name, width = desk.width, height = desk.height, zoom = desk.zoom);
+    for (n, step) in session.steps.iter().enumerate() {
+        if let Err(why) = step.run(&mut h, session) {
+            let shot = save_shot(&mut h, &format!("{}-{}x{}", session.name, desk.width, desk.height));
+            let paras = paragraphs(&h);
+            return Err(format!(
+                "{name} on a {width}×{height} window at {zoom}% zoom: step {step_no} {step:?}\n{why}\nparagraphs:\n{paras}\nscreenshot: {shot}",
+                name = session.name,
+                width = desk.width,
+                height = desk.height,
+                zoom = desk.zoom,
+                step_no = n + 1,
+                paras = paras.iter().map(|p| format!("- {p}")).collect::<Vec<_>>().join("\n"),
+            ));
+        }
+    }
+    Ok(())
+}
+
+impl Step {
+    fn run(&self, h: &mut Harness<'static, PdfCraftApp>, session: &Session) -> Result<(), String> {
+        match self {
+            Step::Command { id } => {
+                if !h.state_mut().execute(id) {
+                    return Err(format!("command {id:?} did not run"));
+                }
+                h.run_steps(2);
+            }
+            Step::ClickPage { x, y } => click_page(h, session, *x, *y)?,
+            Step::Type { text } => type_into_paragraph(h, text)?,
+            Step::Editor { text } => {
+                let Some(editor) = h.state_mut().views.first_mut().and_then(|v| v.line_editor.as_mut()) else {
+                    return Err("no paragraph is open for typing".into());
+                };
+                editor.text.clone_from(text);
+                h.run_steps(1);
+            }
+            Step::Key { key, modifiers } => {
+                let Some(key) = Key::from_name(key) else { return Err(format!("unknown key {key:?}")) };
+                h.key_press_modifiers(modifiers_of(modifiers)?, key);
+                h.run_steps(8);
+            }
+            Step::DragEdge { contains, dx, dy } => drag_edge(h, session, contains, *dx, *dy)?,
+            Step::ExpectEditor { contains, text } => {
+                // The open editor is what a click just showed. Otherwise take the shortest
+                // paragraph that contains the words, so a heading that merely mentions them
+                // does not win.
+                let actual = if let Some(open) = h.state().views.first().and_then(|v| v.line_editor.as_ref()) {
+                    open.text.clone()
+                } else {
+                    let mut matches: Vec<_> =
+                        paragraphs_full(h).into_iter().map(|p| p.editor_text).filter(|p| p.contains(contains.as_str())).collect();
+                    matches.sort_by_key(|p| p.len());
+                    let Some(found) = matches.into_iter().next() else { return Err(format!("no paragraph contains {contains:?}")) };
+                    found
+                };
+                if !actual.contains(contains.as_str()) {
+                    return Err(format!("the open paragraph is {actual:?}, which does not contain {contains:?}"));
+                }
+                if actual != *text {
+                    return Err(format!("editor text\n  actual: {actual:?}\n  expect: {text:?}"));
+                }
+            }
+            Step::ExpectParagraph { text } => {
+                if !paragraphs(h).iter().any(|p| p.contains(text)) {
+                    return Err(format!("no paragraph contains {text:?}"));
+                }
+            }
+            Step::ExpectTogether { parts } => {
+                if parts.is_empty() {
+                    return Err("expect_together needs at least one part".into());
+                }
+                if !paragraphs(h).iter().any(|p| parts.iter().all(|part| p.contains(part))) {
+                    return Err(format!("these are not in the same paragraph: {parts:?}"));
+                }
+            }
+            Step::ExpectApart { text, not } => {
+                let paras = paragraphs(h);
+                if !paras.iter().any(|p| p.contains(text)) {
+                    return Err(format!("no paragraph contains {text:?}"));
+                }
+                // A heading can mention both strings. The paragraph itself is one that has
+                // `text` and does not also have `not`.
+                if !paras.iter().any(|p| p.contains(text) && !p.contains(not)) {
+                    return Err(format!("{text:?} was absorbed into a paragraph that also has {not:?}"));
+                }
+            }
+            Step::Shot { name } => {
+                let _ = save_named(&mut *h, name);
+            }
+        }
+        Ok(())
+    }
+}
+
+fn type_into_paragraph(h: &mut Harness<'static, PdfCraftApp>, text: &str) -> Result<(), String> {
+    if h.state().views.first().and_then(|v| v.line_editor.as_ref()).is_none() {
+        return Err("no paragraph is open for typing".into());
+    }
+    h.key_press_modifiers(Modifiers::COMMAND, Key::A);
+    h.run_steps(1);
+    // One text event keeps the line breaks. The multiline editor inserts them.
+    h.event(egui::Event::Text(text.into()));
+    h.run_steps(2);
+    Ok(())
+}
+
+fn drag_edge(h: &mut Harness<'static, PdfCraftApp>, session: &Session, contains: &str, dx: f32, dy: f32) -> Result<(), String> {
+    let edge = {
+        let s = h.state();
+        let Some(view) = s.views.first() else { return Err("no document is open".into()) };
+        let Some(page) = view.page_screen_rect(0) else { return Err("the page is not on screen".into()) };
+        let Some(doc) = s.session.get(view.id) else { return Err("the document is gone".into()) };
+        let blocks = doc.text_blocks(0);
+        let Some(block) = blocks.iter().find(|b| b.editor_text.contains(contains) || b.text.contains(contains)) else {
+            return Err(format!("no paragraph contains {contains:?}"));
+        };
+        let rect = block.rect;
+        let [pw, ph] = session.page;
+        egui::pos2(page.left() + rect[2] as f32 / pw * page.width(), page.top() + (ph - (rect[1] + rect[3]) as f32 / 2.0) / ph * page.height())
+    };
+    let to = edge + egui::vec2(dx, dy);
+    h.hover_at(edge);
+    h.run_steps(1);
+    h.drag_at(edge);
+    h.run_steps(1);
+    for k in 1..=6 {
+        h.hover_at(edge + (to - edge) * (k as f32 / 6.0));
+        h.run_steps(1);
+    }
+    h.drop_at(to);
+    h.run_steps(8);
+    Ok(())
+}
+
+fn click_page(h: &mut Harness<'static, PdfCraftApp>, session: &Session, x: f32, y: f32) -> Result<(), String> {
+    let page = h.state().views.first().and_then(|v| v.page_screen_rect(0)).ok_or("the page is not on screen")?;
+    let [pw, ph] = session.page;
+    let at = egui::pos2(page.left() + x / pw * page.width(), page.top() + (ph - y) / ph * page.height());
+    h.hover_at(at);
+    h.run_steps(1);
+    h.drag_at(at);
+    h.run_steps(1);
+    h.drop_at(at);
+    h.run_steps(4);
+    Ok(())
+}
+
+fn modifiers_of(names: &[String]) -> Result<Modifiers, String> {
+    let mut m = Modifiers::NONE;
+    for name in names {
+        match name.as_str() {
+            "command" | "cmd" => m.command = true,
+            "shift" => m.shift = true,
+            "alt" | "option" => m.alt = true,
+            "ctrl" | "control" => m.ctrl = true,
+            other => return Err(format!("unknown modifier {other:?}")),
+        }
+    }
+    if m.command {
+        m.mac_cmd = cfg!(target_os = "macos");
+        m.ctrl |= !cfg!(target_os = "macos");
+    }
+    Ok(m)
+}
+
+fn paragraphs(h: &Harness<'static, PdfCraftApp>) -> Vec<String> {
+    paragraphs_full(h).into_iter().map(|b| b.text).collect()
+}
+
+fn paragraphs_full(h: &Harness<'static, PdfCraftApp>) -> Vec<pdfcraft_engine::TextBlock> {
+    let s = h.state();
+    let Some(view) = s.views.first() else { return Vec::new() };
+    s.session.get(view.id).map(|d| d.text_blocks(0)).unwrap_or_default()
+}
+
+fn save_shot(h: &mut Harness<'static, PdfCraftApp>, name: &str) -> String {
+    let safe: String = name.chars().map(|c| if c.is_ascii_alphanumeric() { c } else { '-' }).collect();
+    save_named(h, &safe)
+}
+
+fn save_named(h: &mut Harness<'static, PdfCraftApp>, name: &str) -> String {
+    for _ in 0..20 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+    }
+    let dir = PathBuf::from("/tmp/pdfcraft-play");
+    let _ = fs::create_dir_all(&dir);
+    let path = dir.join(format!("{name}.png"));
+    if let Ok(image) = h.render() {
+        let _ = image.save(&path);
+    }
+    path.display().to_string()
+}
+
+fn open_letter(name: &str, content: &str, desk: &Desk) -> Harness<'static, PdfCraftApp> {
+    let bytes = letter_pdf(content);
+    let title = name.to_string();
+    let mut h = Harness::builder().with_size(egui::vec2(desk.width, desk.height)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        let _ = app.set_option("language", "en");
+        let _ = app.open_bytes(&title, None, bytes);
+        app
+    });
+    h.run_steps(4);
+    h
+}
+
+fn letter_pdf(content: &str) -> Vec<u8> {
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >>".to_string(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_string(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for offset in offsets {
+        out.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
diff --git a/crates/ui-egui/tests/play/blank-line-edit.json b/crates/ui-egui/tests/play/blank-line-edit.json
new file mode 100644
index 0000000000..2f7f2602c7
--- /dev/null
+++ b/crates/ui-egui/tests/play/blank-line-edit.json
@@ -0,0 +1,17 @@
+{
+  "name": "blank line edit",
+  "content": "BT /F1 14 Tf 72 740 Td (1. Repeated step, no TL. Click Two.) Tj ET BT /F1 12 Tf 72 700 Td (One) Tj ET BT /F1 12 Tf 72 672.4 Td (Two) Tj ET BT /F1 12 Tf 72 644.8 Td (Three) Tj ET BT /F1 14 Tf 72 590 Td (2. Blank line. Edit the first paragraph.) Tj ET BT /F1 12 Tf 14.4 TL 1 0 0 1 72 550 Tm (First paragraph, first row.) Tj T* (First paragraph, second row.) Tj ET BT /F1 12 Tf 14.4 TL 1 0 0 1 72 506.8 Tm (Second paragraph, first row.) Tj T* (Second paragraph, second row.) Tj ET BT /F1 14 Tf 72 450 Td (3. Add a row under Alpha. Neighbor stays.) Tj ET BT /F1 12 Tf 14.4 TL 1 0 0 1 72 410 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET BT /F1 12 Tf 14.4 TL 1 0 0 1 72 366.8 Tm (Neighbor stays.) Tj ET",
+  "steps": [
+    {"command": {"id": "edit.edit_text"}},
+    {"click_page": {"x": 140, "y": 554}},
+    {"expect_editor": {"contains": "First paragraph, first row", "text": "First paragraph, first row.\nFirst paragraph, second row."}},
+    {"type": {"text": "First paragraph, first row.\nChanged."}},
+    {"key": {"key": "Enter", "modifiers": ["command"]}},
+    {"expect_together": {"parts": ["First paragraph, first row", "Changed"]}},
+    {"expect_together": {"parts": ["Second paragraph, first row", "Second paragraph, second row"]}},
+    {"expect_apart": {"text": "Second paragraph, first row", "not": "Changed"}},
+    {"click_page": {"x": 140, "y": 510}},
+    {"expect_editor": {"contains": "Second paragraph, first row", "text": "Second paragraph, first row.\nSecond paragraph, second row."}},
+    {"shot": {"name": "blank-line-edit"}}
+  ]
+}
diff --git a/crates/ui-egui/tests/play/partial-rewrite-keeps-neighbor.json b/crates/ui-egui/tests/play/partial-rewrite-keeps-neighbor.json
new file mode 100644
index 0000000000..5f96c33683
--- /dev/null
+++ b/crates/ui-egui/tests/play/partial-rewrite-keeps-neighbor.json
@@ -0,0 +1,18 @@
+{
+  "name": "partial rewrite keeps neighbor",
+  "content": "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET BT /F1 12 Tf 14.4 TL 1 0 0 1 72 656.8 Tm (Neighbor stays.) Tj ET",
+  "steps": [
+    {"command": {"id": "edit.edit_text"}},
+    {"click_page": {"x": 120, "y": 704}},
+    {"type": {"text": "Alpha first row.\nTwo\nThree"}},
+    {"key": {"key": "Enter", "modifiers": ["command"]}},
+    {"click_page": {"x": 120, "y": 660}},
+    {"expect_editor": {"contains": "Neighbor stays.", "text": "Neighbor stays."}},
+    {"click_page": {"x": 120, "y": 704}},
+    {"type": {"text": "Alpha first row.\nTwo\nFour"}},
+    {"key": {"key": "Enter", "modifiers": ["command"]}},
+    {"click_page": {"x": 120, "y": 660}},
+    {"expect_editor": {"contains": "Neighbor stays.", "text": "Neighbor stays."}},
+    {"shot": {"name": "partial-rewrite-keeps-neighbor"}}
+  ]
+}
diff --git a/crates/ui-egui/tests/play/repeated-step-opens-as-one.json b/crates/ui-egui/tests/play/repeated-step-opens-as-one.json
new file mode 100644
index 0000000000..d9deb3858b
--- /dev/null
+++ b/crates/ui-egui/tests/play/repeated-step-opens-as-one.json
@@ -0,0 +1,11 @@
+{
+  "name": "repeated step opens as one",
+  "content": "BT /F1 12 Tf 72 700 Td (One) Tj ET BT /F1 12 Tf 72 672.4 Td (Two) Tj ET BT /F1 12 Tf 72 644.8 Td (Three) Tj ET BT /F1 12 Tf 14.4 TL 1 0 0 1 72 500 Tm (Kept.) Tj ET",
+  "steps": [
+    {"command": {"id": "edit.edit_text"}},
+    {"click_page": {"x": 90, "y": 676}},
+    {"expect_editor": {"contains": "Two", "text": "One\nTwo\nThree"}},
+    {"click_page": {"x": 90, "y": 504}},
+    {"expect_editor": {"contains": "Kept", "text": "Kept."}}
+  ]
+}
diff --git a/crates/ui-egui/tests/play/repeated-step-td-inside-one-bt.json b/crates/ui-egui/tests/play/repeated-step-td-inside-one-bt.json
new file mode 100644
index 0000000000..3953f413d1
--- /dev/null
+++ b/crates/ui-egui/tests/play/repeated-step-td-inside-one-bt.json
@@ -0,0 +1,9 @@
+{
+  "name": "repeated step Td inside one BT",
+  "content": "BT /F1 12 Tf 1 0 0 1 72 700 Tm (One) Tj 0 -27.6 Td (Two) Tj 0 -27.6 Td (Three) Tj ET",
+  "steps": [
+    {"command": {"id": "edit.edit_text"}},
+    {"click_page": {"x": 90, "y": 676}},
+    {"expect_editor": {"contains": "Two", "text": "One\nTwo\nThree"}}
+  ]
+}
diff --git a/crates/ui-egui/tests/play/repeated-step-tm.json b/crates/ui-egui/tests/play/repeated-step-tm.json
new file mode 100644
index 0000000000..90c8d3c4fe
--- /dev/null
+++ b/crates/ui-egui/tests/play/repeated-step-tm.json
@@ -0,0 +1,9 @@
+{
+  "name": "repeated step one Tm per row",
+  "content": "BT /F1 12 Tf 1 0 0 1 72 700 Tm (One) Tj ET BT /F1 12 Tf 1 0 0 1 72 672.4 Tm (Two) Tj ET BT /F1 12 Tf 1 0 0 1 72 644.8 Tm (Three) Tj ET",
+  "steps": [
+    {"command": {"id": "edit.edit_text"}},
+    {"click_page": {"x": 90, "y": 676}},
+    {"expect_editor": {"contains": "Two", "text": "One\nTwo\nThree"}}
+  ]
+}
diff --git a/crates/ui-egui/tests/play/resize-grown-neighbor.json b/crates/ui-egui/tests/play/resize-grown-neighbor.json
new file mode 100644
index 0000000000..fbd208e828
--- /dev/null
+++ b/crates/ui-egui/tests/play/resize-grown-neighbor.json
@@ -0,0 +1,19 @@
+{
+  "name": "resize grown neighbor",
+  "content": "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 410 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET BT /F1 12 Tf 14.4 TL 1 0 0 1 72 366.8 Tm (Neighbor stays.) Tj ET",
+  "steps": [
+    {"command": {"id": "edit.edit_text"}},
+    {"click_page": {"x": 120, "y": 414}},
+    {"type": {"text": "Alpha first row.\nthis is another\nalpha test\nAlpha next row."}},
+    {"key": {"key": "Enter", "modifiers": ["command"]}},
+    {"expect_apart": {"text": "Neighbor stays.", "not": "Alpha"}},
+    {"drag_edge": {"contains": "Alpha next row", "dx": 160}},
+    {"expect_together": {"parts": ["Alpha first row.", "this is another", "alpha test", "Alpha next row."]}},
+    {"drag_edge": {"contains": "Alpha next row", "dx": -80}},
+    {"expect_together": {"parts": ["Alpha first row.", "this is another", "alpha test", "Alpha next row."]}},
+    {"expect_apart": {"text": "Neighbor stays.", "not": "Alpha"}},
+    {"click_page": {"x": 110, "y": 370}},
+    {"expect_editor": {"contains": "Neighbor stays.", "text": "Neighbor stays."}},
+    {"shot": {"name": "resize-grown-neighbor"}}
+  ]
+}
diff --git a/crates/ui-egui/tests/play/widen-example-one.json b/crates/ui-egui/tests/play/widen-example-one.json
new file mode 100644
index 0000000000..615ef6668a
--- /dev/null
+++ b/crates/ui-egui/tests/play/widen-example-one.json
@@ -0,0 +1,19 @@
+{
+  "name": "widen example 1",
+  "content": "BT /F1 14 Tf 72 740 Td (1. Repeated step, no TL. Click Two.) Tj ET BT /F1 12 Tf 72 700 Td (One) Tj ET BT /F1 12 Tf 72 672.4 Td (Two) Tj ET BT /F1 12 Tf 72 644.8 Td (Three) Tj ET BT /F1 14 Tf 72 590 Td (2. Blank line. Edit the first paragraph.) Tj ET BT /F1 12 Tf 14.4 TL 1 0 0 1 72 550 Tm (First paragraph, first row.) Tj T* (First paragraph, second row.) Tj ET BT /F1 12 Tf 14.4 TL 1 0 0 1 72 506.8 Tm (Second paragraph, first row.) Tj T* (Second paragraph, second row.) Tj ET BT /F1 14 Tf 72 450 Td (3. Add a row under Alpha. Neighbor stays.) Tj ET BT /F1 12 Tf 14.4 TL 1 0 0 1 72 410 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET BT /F1 12 Tf 14.4 TL 1 0 0 1 72 366.8 Tm (Neighbor stays.) Tj ET",
+  "steps": [
+    {"command": {"id": "edit.edit_text"}},
+    {"click_page": {"x": 90, "y": 690}},
+    {"type": {"text": "One\nTwo\nThree\nfour"}},
+    {"key": {"key": "Enter", "modifiers": ["command"]}},
+    {"drag_edge": {"contains": "four", "dx": 280}},
+    {"expect_editor": {"contains": "four", "text": "One\nTwo\nThree\nfour"}},
+    {"expect_paragraph": {"text": "1. Repeated step, no TL. Click Two."}},
+    {"expect_together": {"parts": ["First paragraph, first row", "First paragraph, second row"]}},
+    {"expect_together": {"parts": ["Second paragraph, first row", "Second paragraph, second row"]}},
+    {"expect_apart": {"text": "Neighbor stays.", "not": "Alpha"}},
+    {"click_page": {"x": 110, "y": 370}},
+    {"expect_editor": {"contains": "Neighbor stays.", "text": "Neighbor stays."}},
+    {"shot": {"name": "widen-example-one"}}
+  ]
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index f14ce86754..39d105bd24 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1914,8 +1914,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["text_paragraphs"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
-notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; a blank line (about twice the paragraph's own leading) stays a separate paragraph, and editing the first one leaves the next in place (#2517). An explicit TL is that leading: the measured baseline gap equals it, a gap of that size stays one paragraph even above twice the font size, and a gap of twice the TL is the next paragraph. A rewrite of every row is marked, so a new row one leading above the next paragraph does not absorb it on a later edit. Hyphenated line ends are joined. A row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it. Still open: a larger heading joined to smaller body lines (#1756) and cells in different columns (#1680, #2478)"
+evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/automation/tests/it/automation.rs::paragraph_grouping_survives_save_and_reopen_through_tools", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
+notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; a blank line (about twice the paragraph's own leading) stays a separate paragraph, and editing the first one leaves the next in place (#2517). An explicit TL is that leading. Without one, Td does not set it: three or more rows at one repeated step stay one paragraph, and a single wider gap stays a break. A rewrite marks the whole paragraph, including a row it leaves in the source, so adding a row does not absorb the next paragraph on a later edit. Hyphenated line ends are joined. A row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it. Still open: a larger heading joined to smaller body lines (#1756) and cells in different columns (#1680, #2478). Two rows and no third step still cannot be told from a paragraph break when there is no TL."
 
 [[feature]]
 id = "edit.font-reuse-substitution"

From a84ae042d1acf911a74dca03c04afc641571eadc Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Sun, 18 Oct 2026 19:26:30 +0200
Subject: [PATCH 116/270] M7: close a partial rewrite's marker after the
 paragraph (#2517)

A row left in the source stays in the last paragraph. An extra marker is not placed across two marked-content regions.
---
 ROADMAP.md                                    |   2 +
 crates/automation/tests/it/automation.rs      |  33 +++++
 crates/edit/src/tests.rs                      | 139 ++++++++++++++++++
 crates/edit/src/text_regions/styled.rs        |  85 +++++++++--
 .../play/last-paragraph-keeps-both-rows.json  |  14 ++
 .../play/marked-region-keeps-neighbor.json    |  15 ++
 docs/gaps.md                                  |   5 +-
 docs/roadmap.md                               |   2 +
 parity/acrobat-features.toml                  |   4 +-
 9 files changed, 283 insertions(+), 16 deletions(-)
 create mode 100644 crates/ui-egui/tests/play/last-paragraph-keeps-both-rows.json
 create mode 100644 crates/ui-egui/tests/play/marked-region-keeps-neighbor.json

diff --git a/ROADMAP.md b/ROADMAP.md
index de6d8e9692..83cfd66532 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -21,6 +21,7 @@
 > **Last reviewed:** 2026-10-20 | **Last updated:** 2026-10-20 | **Change:** minor (M2, #3574: named form properties retain page origin and own dictionary boundaries; estimates unchanged)
 > **Last reviewed:** 2026-10-20 · **Last updated:** 2026-10-20 · **Change:** minor (M4: initial-view options resolve indirect boolean preferences; estimates unchanged)
 > **Last reviewed:** 2026-10-16; **Last updated:** 2026-10-16; **Change:** minor (M5 #2669, item 5: reply groups and page root counts per frame; estimates unchanged)
+> **Last reviewed:** 2026-10-18 · **Last updated:** 2026-10-18 · **Change:** minor (M7 #2517: a partial rewrite keeps its marker around a kept row, and off the next marked region; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (M7: the Edit text caret is as tall as the row it is on; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (M6: CSV tab-containing headers; estimates unchanged)
 > **Last reviewed:** 2026-10-18 · **Last updated:** 2026-10-18 · **Change:** minor (M3, #3149: discard render demand after page geometry changes and check the GPU texture limit before upload; estimates unchanged)
@@ -204,6 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M10, #4158 partial):** Word, HTML, RTF and PowerPoint export keep a block that continues another on its line (an italic case name, a link, a superscript) as a run in its own style inside that paragraph, with the source's word space, instead of a paragraph of its own. Style changes that wrap onto the next line still split paragraphs (the reading blocks keep style boundaries). Estimates unchanged.
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
+- **2026-10-18 (M7, #2517):** A partial rewrite of the last paragraph closes its marker after that paragraph's last `ET`, so a row left in the source stays in the paragraph. The extra marker is not added across two marked-content regions. Estimates unchanged.
 - **2026-10-15 (M7, #2517):** A blank line between paragraphs stays a paragraph break. An explicit `TL` is the measured baseline gap. Without one, three or more rows at a repeated step stay one paragraph, and a single wider gap stays a break. Adding a row, even when an earlier row is left in the source, does not absorb the next paragraph on a later edit. Estimates unchanged.
 
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 2f000fb0c6..226796cfe4 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -9579,3 +9579,36 @@ fn paragraph_grouping_survives_save_and_reopen_through_tools() {
     let extracted = page_text(&mut a, again);
     assert!(extracted[0].contains("Neighbor stays.") && extracted[0].contains("Four"), "{extracted:?}");
 }
+
+/// Editing the only paragraph on the page, while leaving its second row in the source, stays
+/// one paragraph through save and reopen. A neighbour in a different marked region stays in
+/// its own paragraph.
+#[test]
+fn a_partial_rewrite_of_the_last_paragraph_stays_one_through_tools() {
+    let dir = workdir("paragraph-tail");
+    let mut a = auto(&dir);
+    let only = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET";
+    std::fs::write(dir.join("only.pdf"), helvetica_page(only)).unwrap();
+    let doc = ok(&mut a, "doc_open", json!({ "path": "only.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(paragraph_texts(&mut a, doc), ["Alpha first row. Alpha next row."]);
+    ok(&mut a, "text_edit", json!({ "doc": doc, "page": 1, "paragraph": 1, "text": "One.\nAlpha next row." }));
+    assert_eq!(paragraph_texts(&mut a, doc), ["One. Alpha next row."]);
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "only.pdf" }));
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "only.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(paragraph_texts(&mut a, reopened), ["One. Alpha next row."]);
+    ok(&mut a, "text_edit", json!({ "doc": reopened, "page": 1, "paragraph": 1, "text": "One.\nTwo." }));
+    assert_eq!(paragraph_texts(&mut a, reopened), ["One. Two."]);
+
+    let marked = "/H1 << /MCID 0 >> BDC BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET EMC \
+                  /P << /MCID 1 >> BDC BT /F1 12 Tf 14.4 TL 1 0 0 1 72 656.8 Tm (Neighbor stays.) Tj ET EMC";
+    std::fs::write(dir.join("marked.pdf"), helvetica_page(marked)).unwrap();
+    let doc = ok(&mut a, "doc_open", json!({ "path": "marked.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(paragraph_texts(&mut a, doc).len(), 2);
+    ok(&mut a, "text_edit", json!({ "doc": doc, "page": 1, "paragraph": 1, "text": "One.\nAlpha next row." }));
+    assert_eq!(paragraph_texts(&mut a, doc), ["One. Alpha next row.", "Neighbor stays."]);
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "marked.pdf" }));
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "marked.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(paragraph_texts(&mut a, reopened), ["One. Alpha next row.", "Neighbor stays."]);
+    ok(&mut a, "text_edit", json!({ "doc": reopened, "page": 1, "paragraph": 1, "text": "One.\nTwo." }));
+    assert_eq!(paragraph_texts(&mut a, reopened), ["One. Two.", "Neighbor stays."]);
+}
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 2d17252bc5..916872a861 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -2986,6 +2986,145 @@ fn adding_a_row_does_not_make_the_next_paragraph_number_mean_charlie() {
     assert!(done.iter().any(|t| t.contains("Bravo paragraph, edited.")), "{done:?}");
 }
 
+/// The paragraph is the last thing on the page. Editing the first row and leaving the second
+/// in the source must keep both rows inside one marker, including after a save.
+#[test]
+fn a_partial_rewrite_of_the_only_paragraph_stays_one_block() {
+    let src = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET";
+    let mut doc = text_page(src);
+    text::replace_block(&mut doc, 0, 0, "One.\nAlpha next row.").unwrap();
+    let texts: Vec<_> = text::text_blocks(&doc, 0).unwrap().into_iter().map(|b| b.text).collect();
+    assert_eq!(texts, ["One. Alpha next row."], "{texts:?}");
+    assert_marker_wraps(&page_content(&doc), "/P BMC", "(One.)", "(Alpha next row.)");
+    let doc = reopen(&doc);
+    let texts: Vec<_> = text::text_blocks(&doc, 0).unwrap().into_iter().map(|b| b.text).collect();
+    assert_eq!(texts, ["One. Alpha next row."], "{texts:?}");
+    assert_marker_wraps(&page_content(&doc), "/P BMC", "(One.)", "(Alpha next row.)");
+    let mut doc = doc;
+    text::replace_block(&mut doc, 0, 0, "One.\nTwo.").unwrap();
+    let texts: Vec<_> = text::text_blocks(&doc, 0).unwrap().into_iter().map(|b| b.text).collect();
+    assert_eq!(texts, ["One. Two."], "{texts:?}");
+    assert_marker_wraps(&page_content(&doc), "/P BMC", "(One.)", "(Two.)");
+}
+
+/// The same rewrite when an operator follows the paragraph's `ET`. The close belongs before
+/// that operator, and still after the kept row.
+#[test]
+fn a_partial_rewrite_closes_before_the_operator_that_follows_the_paragraph() {
+    let src = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET 0 0 0 RG";
+    let mut doc = text_page(src);
+    text::replace_block(&mut doc, 0, 0, "One.\nAlpha next row.").unwrap();
+    let doc = reopen(&doc);
+    let texts: Vec<_> = text::text_blocks(&doc, 0).unwrap().into_iter().map(|b| b.text).collect();
+    assert_eq!(texts, ["One. Alpha next row."], "{texts:?}");
+    let content = page_content(&doc);
+    assert_marker_wraps(&content, "/P BMC", "(One.)", "(Alpha next row.)");
+    let start = content.find("/P BMC").expect("marker");
+    let close = content[start..].find("EMC").map(|at| start + at).expect("close");
+    let after = content.find("0 0 0 RG").expect("the following operator is gone");
+    assert!(close < after, "the marker swallowed the operator after the paragraph: {content}");
+}
+
+/// The last paragraph on the page is already inside a marked region. A partial rewrite stays
+/// one paragraph, and that region's close still comes after both rows.
+#[test]
+fn a_partial_rewrite_of_the_last_marked_paragraph_stays_inside_its_region() {
+    let src = "/H1 << /MCID 0 >> BDC BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET EMC";
+    let mut doc = text_page(src);
+    assert_eq!(text::text_blocks(&doc, 0).unwrap().len(), 1);
+    text::replace_block(&mut doc, 0, 0, "One.\nAlpha next row.").unwrap();
+    let doc = reopen(&doc);
+    let texts: Vec<_> = text::text_blocks(&doc, 0).unwrap().into_iter().map(|b| b.text).collect();
+    assert_eq!(texts, ["One. Alpha next row."], "{texts:?}");
+    assert_marker_wraps(&page_content(&doc), "/MCID 0", "(One.)", "(Alpha next row.)");
+}
+
+/// A partial rewrite must not insert `/P BMC` across two existing marked-content regions.
+/// The neighbour's own marker has to keep wrapping its text.
+#[test]
+fn a_partial_rewrite_keeps_the_next_marked_region_closed() {
+    let src = "/H1 << /MCID 0 >> BDC BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET EMC \
+               /P << /MCID 1 >> BDC BT /F1 12 Tf 14.4 TL 1 0 0 1 72 656.8 Tm (Neighbor stays.) Tj ET EMC";
+    let mut doc = text_page(src);
+    assert_eq!(text::text_blocks(&doc, 0).unwrap().len(), 2);
+    text::replace_block(&mut doc, 0, 0, "One.\nAlpha next row.").unwrap();
+    let doc = reopen(&doc);
+    let texts: Vec<_> = text::text_blocks(&doc, 0).unwrap().into_iter().map(|b| b.text).collect();
+    assert_eq!(texts, ["One. Alpha next row.", "Neighbor stays."], "{texts:?}");
+    let content = page_content(&doc);
+    assert_marker_wraps(&content, "/MCID 0", "(One.)", "(Alpha next row.)");
+    assert_marker_wraps(&content, "/MCID 1", "(Neighbor stays.)", "(Neighbor stays.)");
+    let neighbour = content.find("/MCID 1").expect("neighbour region");
+    let close = content[neighbour..].find("EMC").map(|at| neighbour + at).expect("neighbour close");
+    assert!(!content[neighbour..close].contains("(One.)"), "the rewrite was pulled into the neighbour's marker: {content}");
+}
+
+/// Both paragraphs already share one marked region, separated by a blank line. The extra marker
+/// around the edit has to close itself, not the region, so the neighbour stays inside it.
+#[test]
+fn a_partial_rewrite_inside_one_marked_region_leaves_the_neighbour_inside_it() {
+    let src = "/P << /MCID 0 >> BDC BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET \
+               BT /F1 12 Tf 14.4 TL 1 0 0 1 72 656.8 Tm (Neighbor stays.) Tj ET EMC";
+    let mut doc = text_page(src);
+    assert_eq!(text::text_blocks(&doc, 0).unwrap().len(), 2);
+    text::replace_block(&mut doc, 0, 0, "One.\nAlpha next row.").unwrap();
+    let doc = reopen(&doc);
+    let texts: Vec<_> = text::text_blocks(&doc, 0).unwrap().into_iter().map(|b| b.text).collect();
+    assert_eq!(texts, ["One. Alpha next row.", "Neighbor stays."], "{texts:?}");
+    let content = page_content(&doc);
+    let region = region_through_matching_close(&content, "/MCID 0");
+    assert!(region.contains("(One.)") && region.contains("(Neighbor stays.)"), "the region closed before the neighbour: {content}");
+}
+
+/// Bytes from `open` through the `EMC` that balances the marked region it begins.
+fn region_through_matching_close<'a>(content: &'a str, open: &str) -> &'a str {
+    let start = content.find(open).unwrap_or_else(|| panic!("missing {open}: {content}"));
+    let bytes = content.as_bytes();
+    let mut index = start;
+    let mut depth = 0i32;
+    while index < bytes.len() {
+        let rest = &bytes[index..];
+        let boundary = index == 0 || !bytes[index - 1].is_ascii_alphanumeric();
+        if boundary && (rest.starts_with(b"BMC") || rest.starts_with(b"BDC")) && rest.get(3).is_none_or(|b| !b.is_ascii_alphanumeric()) {
+            depth += 1;
+            index += 3;
+            continue;
+        }
+        if boundary && rest.starts_with(b"EMC") && rest.get(3).is_none_or(|b| !b.is_ascii_alphanumeric()) {
+            depth -= 1;
+            if depth == 0 {
+                return &content[start..index];
+            }
+            index += 3;
+            continue;
+        }
+        index += 1;
+    }
+    panic!("unbalanced region {open}: {content}");
+}
+
+fn page_content(doc: &Document) -> String {
+    String::from_utf8_lossy(&page_content_bytes(doc, 0)).into_owned()
+}
+
+/// `open` through the next `EMC` contains both strings, and no `EMC` sits inside a text object.
+fn assert_marker_wraps(content: &str, open: &str, first: &str, second: &str) {
+    let start = content.find(open).unwrap_or_else(|| panic!("missing {open}: {content}"));
+    let end = content[start..].find("EMC").map(|at| start + at).unwrap_or_else(|| panic!("missing EMC after {open}: {content}"));
+    let marked = &content[start..end];
+    assert!(marked.contains(first) && marked.contains(second), "{open} closed too early: {content}");
+    let mut text_objects = 0i32;
+    for token in content.split_whitespace() {
+        match token {
+            "BT" => text_objects += 1,
+            "ET" => text_objects -= 1,
+            "EMC" => assert_eq!(text_objects, 0, "EMC inside a text object: {content}"),
+            _ => {}
+        }
+    }
+    assert_eq!(text_objects, 0, "a text object was left open: {content}");
+}
+
 /// A blank line is one extra leading, so the fourth row of a grown paragraph sits on the
 /// neighbour's baseline. Changing the box width must not treat that neighbour as a duplicate
 /// drawing and delete it.
diff --git a/crates/edit/src/text_regions/styled.rs b/crates/edit/src/text_regions/styled.rs
index a9f3711072..ccb75b3130 100644
--- a/crates/edit/src/text_regions/styled.rs
+++ b/crates/edit/src/text_regions/styled.rs
@@ -610,7 +610,7 @@ fn untouched_rows(block: &TextBlock, draft: &str, rows: &[std::ops::Range<usize>
 }
 
 /// Operator index of the paragraph's first text object, and of the next line's text object
-/// when one follows. The next index is where a closing marker belongs.
+/// when one follows.
 fn paragraph_span(block: &TextBlock, lines: &[TextLine]) -> Option<(usize, Option<usize>)> {
     let belongs: std::collections::HashSet<usize> = block.lines.iter().copied().collect();
     let start = block.lines.iter().filter_map(|i| lines.get(*i)).map(|line| line.origin.bt_op).min()?;
@@ -625,6 +625,50 @@ fn paragraph_span(block: &TextBlock, lines: &[TextLine]) -> Option<(usize, Optio
     Some((start, next))
 }
 
+/// The scope shared by every line of the paragraph, when each one is in the same marked region.
+fn shared_scope(block: &TextBlock, lines: &[TextLine]) -> Option<usize> {
+    let mut scopes = block.lines.iter().filter_map(|i| lines.get(*i)).map(|line| line.scope);
+    let first = scopes.next().flatten()?;
+    scopes.all(|scope| scope == Some(first)).then_some(first)
+}
+
+/// Where an extra `/P` marker belongs.
+///
+/// The marker is omitted when the paragraph is already one marked region and the next line is
+/// in a different one: an `EMC` at that line's `BT` lands after the other region has opened, so
+/// it would close the other region and leave its text outside. When nothing follows, `close` is
+/// the operator just after the paragraph's last `ET` (`ops.len()` means append it after the
+/// stream). Closing earlier, inside the rewritten operators, leaves a kept source row outside
+/// the marker and can put `EMC` inside a `BT`.
+fn paragraph_marker(block: &TextBlock, lines: &[TextLine], ops: &[Op]) -> Option<(usize, Option<usize>, usize)> {
+    let (start, next) = paragraph_span(block, lines)?;
+    if let Some(region) = shared_scope(block, lines)
+        && let Some(at) = next
+    {
+        let next_scope = lines.iter().find(|line| line.origin.bt_op == at).map(|line| line.scope);
+        if next_scope != Some(Some(region)) {
+            return None;
+        }
+    }
+    let close = if next.is_none() {
+        let end = block
+            .lines
+            .iter()
+            .filter_map(|i| lines.get(*i))
+            .flat_map(|line| line.ops.iter().copied().chain(std::iter::once(line.origin.bt_op)))
+            .max()?;
+        ops.iter()
+            .enumerate()
+            .skip(end.saturating_add(1))
+            .find(|(_, op)| op.op.as_slice() == b"ET")
+            .map(|(index, _)| index.saturating_add(1))
+            .unwrap_or(ops.len())
+    } else {
+        0
+    };
+    Some((start, next, close))
+}
+
 struct RewriteAnchor<'a> {
     lead: &'a TextLine,
     drop: std::collections::HashSet<usize>,
@@ -1001,26 +1045,41 @@ pub(crate) fn rewrite_styled_block(
         block_ops.push(Op::new("Tm", o.tlm.iter().map(|v| n(*v)).collect()));
     }
     let at = if split { start } else { o.bt_op };
-    // A kept source row sits outside `block_ops`, so a marker only around the rewrite splits
-    // the paragraph or leaves the added row to join the neighbour. Bound the whole paragraph:
-    // from its first text object up to, but not including, the next line.
-    let marker = if marked { None } else { paragraph_span(block, lines) };
-    if marker.is_some_and(|(_, next)| next.is_none()) {
-        block_ops.push(Op::new("EMC", vec![]));
-    }
+    // A kept source row sits outside `block_ops`. Bound the whole paragraph when a marker is
+    // safe. The close is not part of `block_ops`: that vector can end inside a text object
+    // when the rewrite splits one, and a kept row's operators come later in the stream.
+    let marker = if marked { None } else { paragraph_marker(block, lines, &ops) };
     let data = splice(&pieces, &ops, |i| {
         let mut insert = Vec::new();
-        if marker.is_some_and(|(start_at, _)| i == start_at) {
-            insert.push(Op::new("BMC", vec![Object::name("P")]));
+        if let Some((start_at, next, close)) = marker {
+            if i == start_at {
+                insert.push(Op::new("BMC", vec![Object::name("P")]));
+            }
+            if next.is_none() && i == close {
+                insert.push(Op::new("EMC", vec![]));
+            }
+            if next == Some(i) {
+                insert.push(Op::new("EMC", vec![]));
+            }
         }
         if i == at {
             insert.append(&mut block_ops);
         }
-        if marker.is_some_and(|(_, next)| next == Some(i)) {
-            insert.push(Op::new("EMC", vec![]));
-        }
         (insert, !drop.contains(&i))
     });
+    let data = if marker.is_some_and(|(_, next, close)| next.is_none() && close >= ops.len()) {
+        let mut data = data;
+        if let Some(last) = data.last_mut() {
+            if last.last().is_some_and(|byte| !byte.is_ascii_whitespace()) {
+                last.push(b'\n');
+            }
+            // `splice` never visits `ops.len()`, so a close after the final operator is appended.
+            last.extend_from_slice(&pdfcraft_content::serialize_ops(&[Op::new("EMC", vec![])]));
+        }
+        data
+    } else {
+        data
+    };
     let contents = rewritten_contents(doc, &streams, data);
     res.set(b"Font".to_vec(), Object::Dict(fonts));
     doc.update_dict(p.obj, |d| {
diff --git a/crates/ui-egui/tests/play/last-paragraph-keeps-both-rows.json b/crates/ui-egui/tests/play/last-paragraph-keeps-both-rows.json
new file mode 100644
index 0000000000..fdd6729db9
--- /dev/null
+++ b/crates/ui-egui/tests/play/last-paragraph-keeps-both-rows.json
@@ -0,0 +1,14 @@
+{
+  "name": "last paragraph keeps both rows",
+  "content": "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET",
+  "steps": [
+    {"command": {"id": "edit.edit_text"}},
+    {"click_page": {"x": 120, "y": 704}},
+    {"type": {"text": "One.\nAlpha next row."}},
+    {"key": {"key": "Enter", "modifiers": ["command"]}},
+    {"expect_together": {"parts": ["One.", "Alpha next row."]}},
+    {"click_page": {"x": 120, "y": 704}},
+    {"expect_editor": {"contains": "One.", "text": "One.\nAlpha next row."}},
+    {"shot": {"name": "last-paragraph-keeps-both-rows"}}
+  ]
+}
diff --git a/crates/ui-egui/tests/play/marked-region-keeps-neighbor.json b/crates/ui-egui/tests/play/marked-region-keeps-neighbor.json
new file mode 100644
index 0000000000..cd5da6d78e
--- /dev/null
+++ b/crates/ui-egui/tests/play/marked-region-keeps-neighbor.json
@@ -0,0 +1,15 @@
+{
+  "name": "marked region keeps neighbor",
+  "content": "/H1 << /MCID 0 >> BDC BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET EMC /P << /MCID 1 >> BDC BT /F1 12 Tf 14.4 TL 1 0 0 1 72 656.8 Tm (Neighbor stays.) Tj ET EMC",
+  "steps": [
+    {"command": {"id": "edit.edit_text"}},
+    {"click_page": {"x": 120, "y": 704}},
+    {"type": {"text": "One.\nAlpha next row."}},
+    {"key": {"key": "Enter", "modifiers": ["command"]}},
+    {"expect_together": {"parts": ["One.", "Alpha next row."]}},
+    {"expect_apart": {"text": "Neighbor stays.", "not": "One."}},
+    {"click_page": {"x": 140, "y": 660}},
+    {"expect_editor": {"contains": "Neighbor stays.", "text": "Neighbor stays."}},
+    {"shot": {"name": "marked-region-keeps-neighbor"}}
+  ]
+}
diff --git a/docs/gaps.md b/docs/gaps.md
index 75b0007e27..9457fd7595 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -5,6 +5,7 @@
 
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-19 · **Change:** minor (gap 2: composite fonts with `/ToUnicode /Identity-H` read as Unicode, hayro-interpret patch 44; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-17 · **Last updated:** 2026-10-17 · **Change:** minor (gap 6: #2662 redaction audit counts a cover over one word of a long line; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-18 · **Last updated:** 2026-10-18 · **Change:** minor (gap 3: #2517 a partial rewrite keeps a kept row inside the paragraph and leaves the next marked region closed; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (gap 12: reading order is scored, not just word F1) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M1: raw-deflate fallback preserves decoding-limit errors; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-13 · **Change:** minor (gap 14: Vietnamese catalog shipped; Hindi/Indonesian/Korean and Arabic RTL remain) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -103,7 +104,8 @@ update the numbers.
   removes a distinct neighbour whose glyph box overlaps (#1316); a second drawing on the same
   baseline is still replaced. A blank line stays a paragraph break. An explicit `TL` is the
   measured baseline gap, and growing a paragraph so its new row is one leading above the next
-  one does not absorb that paragraph (#2517). A heading and smaller body lines (#1756), a
+  one does not absorb that paragraph (#2517). A partial rewrite of the last paragraph keeps a
+  source row inside that paragraph, and does not close a following marked region early. A heading and smaller body lines (#1756), a
   hanging-indent continuation (#2564), and cells in different columns (#1680, #2478) are still
   grouped by the same geometry. Estimates are unchanged.
 
@@ -409,6 +411,7 @@ update the numbers.
 | Date | Change | Summary |
 |---|---|---|
 | 2026-10-25 | minor | Gaps 5 and 14 current state: native release builds embed LXGW WenKai Lite for Simplified Chinese, while the web build has no Hans face; Arabic catalogs stay logical with explicit RTL label direction and mirrored stock chrome, while native/browser RTL input, IME and complex workflows remain unqualified. Estimates unchanged. |
+| 2026-10-18 | minor | Gap 3: #2517 a partial rewrite keeps a kept source row in the paragraph and leaves the next marked region closed around its text. Estimates unchanged. |
 | 2026-10-15 | minor | Gap 3: #2517 a blank line at ordinary leading stays a paragraph break. Estimates unchanged. |
 | 2026-10-19 | minor | Gap 2: a Type 0 font whose `/ToUnicode` is the name `/Identity-H` or `/Identity-V` (WSCAD) reads its codes as Unicode, so such pages have text to select, find and edit (hayro-interpret patch 44, `view.render-cid-fonts`). Estimates unchanged. |
 | 2026-10-15 | minor | Gap 21: the side-by-side view had already shipped; the Compare panel filters text changes and visual differences. Estimate 10–20 h → 8–16 h |
diff --git a/docs/roadmap.md b/docs/roadmap.md
index d90c65a67c..184a1b7a37 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -9,6 +9,7 @@
 > **Last reviewed:** 2026-10-23 | **Last updated:** 2026-10-23 | **Change:** minor (M10: table spans retain text from covered slots in Office exports; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M10: image export preserves soft-mask Decode opacity ranges; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M10: vector printing preserves existing page XObjects when adding annotation appearances; estimates unchanged)
+> **Last reviewed:** 2026-10-18 · **Last updated:** 2026-10-18 · **Change:** minor (M7 #2517: a partial rewrite keeps its marker around a kept row, and off the next marked region; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (M7 #2517: a blank line stays a paragraph break; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 > **Last reviewed:** 2026-10-20 | **Last updated:** 2026-10-20 | **Change:** minor (M10, #3532 partial: vector printing retains existing appearances with absent Subtype; estimates unchanged)
@@ -265,6 +266,7 @@ Estimates unchanged.
 | 2026-10-21 | minor | M3: on GNOME/Wayland, a second resize by an edge or move by the tab strip works without a click in between (the compositor kept the button's release from egui). Estimates unchanged. |
 | 2026-10-22 | minor | M4, #3916 partial: edits and Undo/Redo cancel Organize page drags. Pointer-release and save/reopen regressions check page order. Estimates unchanged. |
 | 2026-10-22 | minor | M14 #3558: rebased macOS association recovery; reuse #3042 shared metadata preservation instead of a duplicate save wrapper. Estimates unchanged. |
+| 2026-10-18 | minor | M7 #2517: a partial rewrite of the last paragraph closes its marker after the last `ET`, and does not close a following marked region early. Estimates unchanged. |
 | 2026-10-15 | minor | M7 #2517: a blank line between paragraphs stays a paragraph break, and growing the first paragraph does not absorb the next one. Estimates unchanged. |
 | 2026-10-20 | minor | M4: initial-view window and interface options resolve indirect boolean ViewerPreferences values; synthetic true/false and save/reopen regressions retain defaults for malformed entries. Estimates unchanged. |
 | 2026-10-21 | minor | M3, #3808: the Pages inspector has an independent 50–150% thumbnail size slider and buttons; selection and current-page following are retained, with headless ui.set coverage. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 39d105bd24..c7069200ab 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1914,8 +1914,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["text_paragraphs"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/automation/tests/it/automation.rs::paragraph_grouping_survives_save_and_reopen_through_tools", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
-notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; a blank line (about twice the paragraph's own leading) stays a separate paragraph, and editing the first one leaves the next in place (#2517). An explicit TL is that leading. Without one, Td does not set it: three or more rows at one repeated step stay one paragraph, and a single wider gap stays a break. A rewrite marks the whole paragraph, including a row it leaves in the source, so adding a row does not absorb the next paragraph on a later edit. Hyphenated line ends are joined. A row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it. Still open: a larger heading joined to smaller body lines (#1756) and cells in different columns (#1680, #2478). Two rows and no third step still cannot be told from a paragraph break when there is no TL."
+evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/automation/tests/it/automation.rs::paragraph_grouping_survives_save_and_reopen_through_tools", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_only_paragraph_stays_one_block", "crates/edit/src/tests.rs::a_partial_rewrite_closes_before_the_operator_that_follows_the_paragraph", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_last_marked_paragraph_stays_inside_its_region", "crates/edit/src/tests.rs::a_partial_rewrite_keeps_the_next_marked_region_closed", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_marked_region_leaves_the_neighbour_inside_it", "crates/automation/tests/it/automation.rs::a_partial_rewrite_of_the_last_paragraph_stays_one_through_tools", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
+notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; a blank line (about twice the paragraph's own leading) stays a separate paragraph, and editing the first one leaves the next in place (#2517). An explicit TL is that leading. Without one, Td does not set it: three or more rows at one repeated step stay one paragraph, and a single wider gap stays a break. A rewrite marks the whole paragraph, including a row it leaves in the source, so adding a row does not absorb the next paragraph on a later edit. When the paragraph is the last text on the page, that marker closes after the paragraph's last ET, so a kept source row stays inside it. The extra marker is not added when the paragraph is already one marked region and the next line is in a different region. Hyphenated line ends are joined. A row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it. Still open: a larger heading joined to smaller body lines (#1756) and cells in different columns (#1680, #2478). Two rows and no third step still cannot be told from a paragraph break when there is no TL."
 
 [[feature]]
 id = "edit.font-reuse-substitution"

From 2bc2933988a00b0d9e445628c2a46d0d855fa426 Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Sun, 18 Oct 2026 20:16:47 +0200
Subject: [PATCH 117/270] M7: rejoin a wrapped line when the box is widened
 (#2517)

A newline that was typed stays. A wrap is marked so a later width change can reflow it, and a short unmarked line stays broken.
---
 .gitignore                               |  1 +
 crates/edit/src/tests.rs                 | 88 ++++++++++++++++++++----
 crates/edit/src/text.rs                  | 47 ++++++++-----
 crates/edit/src/text/blocks.rs           | 14 ++--
 crates/edit/src/text/interp.rs           | 38 +++++++++-
 crates/edit/src/text/lines.rs            |  4 ++
 crates/edit/src/text/rewrite.rs          | 27 ++++++--
 crates/edit/src/text_regions/grouping.rs | 49 +++++++++++++
 crates/edit/src/text_regions/styled.rs   | 22 +++++-
 crates/ui-egui/src/tools/edit_text_ui.rs |  7 +-
 crates/ui-egui/tests/it/editing.rs       |  4 +-
 parity/acrobat-features.toml             |  4 +-
 12 files changed, 255 insertions(+), 50 deletions(-)

diff --git a/.gitignore b/.gitignore
index 7834b668cb..f7922460c7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,4 @@ plan/
 /assets/models
 # A craft-fonts checkout used as the optional CRAFT_FONTS_DIR build input (CI and releases put it here).
 /craft-fonts
+.claude/
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 916872a861..800481d7d0 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -2807,9 +2807,8 @@ fn a_blank_line_keeps_the_next_paragraph() {
     // The second row is left in the source stream. A marker around only the rewritten row
     // would split the paragraph; either there is no marker, or it covers both rows and not the next paragraph.
     let content = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
-    if let Some(start) = content.find("/P BMC") {
-        let end = start + content[start..].find("EMC").unwrap_or(content.len() - start);
-        let marked = &content[start..end];
+    if content.contains("/P BMC") {
+        let marked = region_through_matching_close(&content, "/P BMC");
         assert!(marked.contains("edited row") && marked.contains("second row"), "marker split the paragraph: {content}");
         assert!(!marked.contains("Second paragraph"), "marker swallowed the next paragraph: {content}");
     }
@@ -2885,8 +2884,7 @@ fn growing_into_a_blank_line_keeps_the_neighbour_after_save() {
     let texts = |doc: &Document| text::text_blocks(doc, 0).unwrap().into_iter().map(|b| b.text).collect::<Vec<_>>();
     assert_eq!(texts(&doc), ["One Two Three", "Neighbour"]);
     let content = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
-    let marked = content.find("/P BMC").and_then(|start| content[start..].find("EMC").map(|end| content[start..start + end].to_owned()));
-    let marked = marked.unwrap_or_else(|| panic!("a full rewrite did not mark its rows: {content}"));
+    let marked = region_through_matching_close(&content, "/P BMC");
     for row in ["(One)", "(Two)", "(Three)"] {
         assert!(marked.contains(row), "{row} is outside the marker: {content}");
     }
@@ -3109,20 +3107,42 @@ fn page_content(doc: &Document) -> String {
 
 /// `open` through the next `EMC` contains both strings, and no `EMC` sits inside a text object.
 fn assert_marker_wraps(content: &str, open: &str, first: &str, second: &str) {
-    let start = content.find(open).unwrap_or_else(|| panic!("missing {open}: {content}"));
-    let end = content[start..].find("EMC").map(|at| start + at).unwrap_or_else(|| panic!("missing EMC after {open}: {content}"));
-    let marked = &content[start..end];
+    let marked = region_through_matching_close(content, open);
     assert!(marked.contains(first) && marked.contains(second), "{open} closed too early: {content}");
-    let mut text_objects = 0i32;
+    assert!(!marker_crosses_a_text_object(content), "a marker opened outside a text object and closed inside it: {content}");
+}
+
+/// A marker may sit inside one text object. It may not open outside one and close inside it.
+fn marker_crosses_a_text_object(content: &str) -> bool {
+    let mut text = 0i32;
+    let mut opened_outside = 0i32;
+    let mut opened_inside = 0i32;
     for token in content.split_whitespace() {
         match token {
-            "BT" => text_objects += 1,
-            "ET" => text_objects -= 1,
-            "EMC" => assert_eq!(text_objects, 0, "EMC inside a text object: {content}"),
+            "BT" => text += 1,
+            "ET" => text -= 1,
+            "BMC" | "BDC" => {
+                if text == 0 {
+                    opened_outside += 1;
+                } else {
+                    opened_inside += 1;
+                }
+            }
+            "EMC" => {
+                if text > 0 {
+                    if opened_inside > 0 {
+                        opened_inside -= 1;
+                    } else {
+                        return true;
+                    }
+                } else if opened_outside > 0 {
+                    opened_outside -= 1;
+                }
+            }
             _ => {}
         }
     }
-    assert_eq!(text_objects, 0, "a text object was left open: {content}");
+    text != 0 || opened_outside != 0 || opened_inside != 0
 }
 
 /// A blank line is one extra leading, so the fourth row of a grown paragraph sits on the
@@ -3149,6 +3169,45 @@ fn resizing_a_grown_paragraph_keeps_the_neighbour() {
     }
 }
 
+/// Narrowing wraps a line. Widening it again rejoins that wrap. A newline that was typed stays.
+#[test]
+fn a_wrapped_line_rejoins_when_widened_and_a_typed_break_stays() {
+    let mut doc = text_page("BT /F1 24 Tf 20 150 Td (Page 1) Tj ET");
+    text::rewrite_block(&mut doc, 0, 0, None, &text::BlockStyle { width: Some(45.0), ..Default::default() }).unwrap();
+    let block = text::text_blocks(&doc, 0).unwrap().into_iter().next().unwrap();
+    assert!(block.editor_text.contains('\n'), "the narrow box did not wrap: {}", block.editor_text);
+    assert_eq!(block.reflow_text, "Page 1", "a wrap was kept as a hard break: {}", block.reflow_text);
+    text::rewrite_block(&mut doc, 0, 0, Some(&block.reflow_text), &text::BlockStyle { width: Some(200.0), ..Default::default() }).unwrap();
+    let lines: Vec<_> = text::text_lines(&doc, 0).unwrap().into_iter().map(|l| l.text).collect();
+    assert_eq!(lines, ["Page 1"]);
+
+    let mut typed = text_page("BT /F1 12 Tf 72 700 Td (One) Tj ET");
+    text::replace_block(&mut typed, 0, 0, "One\nTwo\nThree\nfour").unwrap();
+    let block = text::text_blocks(&typed, 0).unwrap().into_iter().next().unwrap();
+    assert_eq!(block.reflow_text, "One\nTwo\nThree\nfour", "a typed break was rejoined: {}", block.reflow_text);
+    let width = (block.rect[2] - block.rect[0]) * 6.0;
+    text::rewrite_block(&mut typed, 0, 0, Some(&block.reflow_text), &text::BlockStyle { width: Some(width.max(180.0)), ..Default::default() })
+        .unwrap();
+    assert_eq!(text::text_blocks(&typed, 0).unwrap()[0].editor_text, "One\nTwo\nThree\nfour");
+}
+
+/// A file that did not mark its breaks still rejoins a line that fills the measure, and keeps a
+/// short line that had room.
+#[test]
+fn an_unmarked_full_line_rejoins_and_a_short_break_stays() {
+    let long = "BT /F1 12 Tf 1 0 0 1 72 700 Tm (This sentence is long enough to fill a measure.) Tj ET \
+                BT /F1 12 Tf 1 0 0 1 72 685.6 Tm (Tail) Tj ET";
+    let doc = text_page(long);
+    let block = text::text_blocks(&doc, 0).unwrap().into_iter().next().unwrap();
+    assert_eq!(block.rows.len(), 2, "{}", block.editor_text);
+    assert_eq!(block.reflow_text, "This sentence is long enough to fill a measure. Tail", "{}", block.reflow_text);
+
+    let short = "BT /F1 12 Tf 1 0 0 1 72 700 Tm (One) Tj ET BT /F1 12 Tf 1 0 0 1 72 685.6 Tm (Two) Tj ET";
+    let doc = text_page(short);
+    let block = text::text_blocks(&doc, 0).unwrap().into_iter().next().unwrap();
+    assert_eq!(block.reflow_text, "One\nTwo", "{}", block.reflow_text);
+}
+
 /// The letter the screenshots edit. Widening example 1, or adding a row there, must leave the
 /// heading above it and both paragraphs under example 2 as they were.
 fn letter_page() -> &'static str {
@@ -3181,7 +3240,8 @@ fn widening_example_one_does_not_swallow_the_heading_or_split_the_next_paragraph
     text::replace_block(&mut doc, 0, idx, "One\nTwo\nThree\nfour").unwrap();
     let blocks = text::text_blocks(&doc, 0).unwrap();
     let idx = blocks.iter().position(|b| b.text.contains("four") || b.editor_text.contains("four")).unwrap();
-    let shown = blocks[idx].editor_text.clone();
+    assert_eq!(blocks[idx].reflow_text, "One\nTwo\nThree\nfour", "a typed break was treated as a wrap: {}", blocks[idx].reflow_text);
+    let shown = blocks[idx].reflow_text.clone();
     let width = blocks[idx].rect[2] - blocks[idx].rect[0];
     text::rewrite_block(&mut doc, 0, idx, Some(&shown), &text::BlockStyle { width: Some((width * 6.0).max(180.0)), ..Default::default() }).unwrap();
     let doc = reopen(&doc);
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index eb45209353..7bcff773a8 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -118,6 +118,10 @@ pub struct TextLine {
     /// `ink`, and whether joining put a space before it. Empty when the line's text was put
     /// into another order (see [`TextLine::runs`]).
     runs: Vec<(String, usize, bool)>,
+    /// This line continues the previous one because a rewrite wrapped it (`/PCSoft`).
+    soft_break: bool,
+    /// This line starts after a break a rewrite kept on purpose (`/PCHard`).
+    hard_break: bool,
 }
 
 impl TextLine {
@@ -154,6 +158,7 @@ mod tests {
             lines: Vec::new(),
             rows: Vec::new(),
             editor_text: text.into(),
+            reflow_text: text.into(),
             spans: Vec::new(),
             invisible: false,
         }
@@ -204,40 +209,48 @@ mod tests {
         assert!(!same_base_font("Arial", ""));
     }
 
+    fn wrapped(text: &str, width: f64) -> Vec<String> {
+        wrap(text, width, |s| s.chars().count() as f64).into_iter().map(|(line, _)| line).collect()
+    }
+
     #[test]
     fn paragraph_wrapping_keeps_ideographic_spaces() {
+        assert_eq!(wrapped("A　　B C", 4.0), ["A　　B", "C"]);
+        assert_eq!(wrapped("A\u{a0}B C", 3.0), ["A B", "C"]);
+        assert_eq!(wrapped("A\u{2028}B C", 3.0), ["A B", "C"]);
+    }
+
+    #[test]
+    fn a_wrap_is_marked_soft_and_a_newline_is_not() {
         let width = |s: &str| s.chars().count() as f64;
-        assert_eq!(wrap("A　　B C", 4.0, width), ["A　　B", "C"]);
-        assert_eq!(wrap("A\u{a0}B C", 3.0, width), ["A B", "C"]);
-        assert_eq!(wrap("A\u{2028}B C", 3.0, width), ["A B", "C"]);
+        assert_eq!(wrap("Page 1", 5.0, width), [("Page".into(), false), ("1".into(), true)]);
+        assert_eq!(wrap("One\nTwo", 10.0, width), [("One".into(), false), ("Two".into(), false)]);
     }
 
     /// #4199: a run of spaces stays a run, before, between and after words; the spaces where a
     /// row wraps go, and each other white-space character is one space.
     #[test]
     fn paragraph_wrapping_keeps_every_space_typed() {
-        let width = |s: &str| s.chars().count() as f64;
-        assert_eq!(wrap("a  b   c", 20.0, width), ["a  b   c"]);
-        assert_eq!(wrap("  a b  ", 20.0, width), ["  a b  "]);
-        assert_eq!(wrap("a\t\tb", 20.0, width), ["a  b"]);
-        assert_eq!(wrap("aa  bb  cc", 6.0, width), ["aa  bb", "cc"]);
+        assert_eq!(wrapped("a  b   c", 20.0), ["a  b   c"]);
+        assert_eq!(wrapped("  a b  ", 20.0), ["  a b  "]);
+        assert_eq!(wrapped("a\t\tb", 20.0), ["a  b"]);
+        assert_eq!(wrapped("aa  bb  cc", 6.0), ["aa  bb", "cc"]);
         // An indent alone on a row doesn't wrap before its first word.
-        assert_eq!(wrap("    abc", 3.0, width), ["    abc"]);
+        assert_eq!(wrapped("    abc", 3.0), ["    abc"]);
         // The rewrite turns `\r\n` and `\r` into `\n` before wrapping.
-        assert_eq!(wrap(" \tA  B\nC ", 3.0, width), ["  A", "B", "C "]);
-        assert_eq!(wrap("   ", 3.0, width), ["   "]);
-        assert_eq!(wrap("", 3.0, width), [""]);
+        assert_eq!(wrapped(" \tA  B\nC ", 3.0), ["  A", "B", "C "]);
+        assert_eq!(wrapped("   ", 3.0), ["   "]);
+        assert_eq!(wrapped("", 3.0), [""]);
     }
 
     #[test]
     fn japanese_text_wraps_between_characters_but_not_before_closing_marks() {
-        let width = |s: &str| s.chars().count() as f64;
-        assert_eq!(wrap("日本語の文章です。", 3.0, width), ["日本語", "の文章", "です。"]);
+        assert_eq!(wrapped("日本語の文章です。", 3.0), ["日本語", "の文章", "です。"]);
         // The comma can't begin a row, so the character before it moves down with it.
-        assert_eq!(wrap("あいう、えお", 3.0, width), ["あい", "う、え", "お"]);
+        assert_eq!(wrapped("あいう、えお", 3.0), ["あい", "う、え", "お"]);
         // Pieces of one word join without a space; separate words keep theirs.
-        assert_eq!(wrap("Edit PDFを編集", 6.0, width), ["Edit", "PDFを編集"]);
-        assert_eq!(wrap("一行目　二行目", 4.0, width), ["一行目　", "二行目"]);
+        assert_eq!(wrapped("Edit PDFを編集", 6.0), ["Edit", "PDFを編集"]);
+        assert_eq!(wrapped("一行目　二行目", 4.0), ["一行目　", "二行目"]);
     }
 
     #[test]
diff --git a/crates/edit/src/text/blocks.rs b/crates/edit/src/text/blocks.rs
index 615e7699a2..2785f87676 100644
--- a/crates/edit/src/text/blocks.rs
+++ b/crates/edit/src/text/blocks.rs
@@ -25,6 +25,9 @@ pub struct TextBlock {
     pub rows: Vec<Vec<usize>>,
     /// Text for the inline editor, with a newline only between visual rows.
     pub editor_text: String,
+    /// What a width change reflows. A wrap rejoins with a space; a break that was typed, or a
+    /// short line that still had room for the next word, stays a newline.
+    pub reflow_text: String,
     /// Byte ranges in `editor_text` and their source line indexes.
     pub spans: Vec<(std::ops::Range<usize>, usize)>,
     /// Every line is invisible text (rendering mode 3): an OCR layer over a scanned image, whose
@@ -337,11 +340,13 @@ pub(crate) fn paragraph_separator(c: char) -> bool {
 /// new line. A row may also end inside a word of Chinese or Japanese text ([`crate::linebreak`]);
 /// those pieces join without a space. Every white-space character is written as one space, so
 /// a run of spaces typed between, before or after words stays (#4199); only the spaces where a
-/// row wraps are dropped.
-pub(super) fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec<String> {
+/// row wraps are dropped. The bool is true when the line continues the previous one because the
+/// next word did not fit, rather than because of a newline.
+pub(super) fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec<(String, bool)> {
     let mut out = Vec::new();
     for row in text.split('\n') {
         let mut line = String::new();
+        let mut soft = false;
         let start = out.len();
         // The separators read since the last word: each one boundary between `split` pieces.
         let mut gap = 0usize;
@@ -357,7 +362,8 @@ pub(super) fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec
                 let candidate = if i == 0 { format!("{line}{spaces}{piece}") } else { format!("{line}{piece}") };
                 // A row holding only the spaces that indent it doesn't wrap before its first word.
                 if line.chars().any(|c| c != ' ') && advance(&candidate) > width {
-                    out.push(std::mem::take(&mut line));
+                    out.push((std::mem::take(&mut line), soft));
+                    soft = true;
                     line = piece.to_string();
                 } else {
                     line = candidate;
@@ -366,7 +372,7 @@ pub(super) fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec
         }
         line.push_str(&" ".repeat(gap));
         if !line.is_empty() || out.len() == start {
-            out.push(line);
+            out.push((line, soft));
         }
     }
     out
diff --git a/crates/edit/src/text/interp.rs b/crates/edit/src/text/interp.rs
index 16b04b406f..e3e4bf26b3 100644
--- a/crates/edit/src/text/interp.rs
+++ b/crates/edit/src/text/interp.rs
@@ -301,6 +301,9 @@ pub(super) struct Shown {
     pub(super) paint: Paint,
     pub(super) logical_order: bool,
     pub(super) actual_text: bool,
+    /// Set when a `/PCSoft` or `/PCHard` marker was seen since the previous text line.
+    pub(super) soft_break: bool,
+    pub(super) hard_break: bool,
 }
 
 impl Shown {
@@ -549,6 +552,8 @@ struct TextRunState<'a> {
     marked: &'a MarkedContent,
     carry: &'a mut Carry,
     out: &'a mut Vec<Shown>,
+    soft_break: bool,
+    hard_break: bool,
 }
 
 fn show_text(op: &Op, i: usize, state: &mut TextRunState<'_>) -> Result<(), EditError> {
@@ -745,6 +750,8 @@ fn show_text(op: &Op, i: usize, state: &mut TextRunState<'_>) -> Result<(), Edit
         paint: Paint { layers: marked.layers.iter().flatten().cloned().collect(), gs: ts.gs.clone() },
         logical_order: false,
         actual_text: false,
+        soft_break: state.soft_break,
+        hard_break: state.hard_break,
     });
     Ok(())
 }
@@ -769,11 +776,22 @@ pub(super) fn interpret(
     let mut bt = 0usize;
     let mut marked =
         MarkedContent { regions: std::mem::take(&mut carry.marked), layers: std::mem::take(&mut carry.layers), ..MarkedContent::default() };
+    // A rewrite names a wrap (`/PCSoft`) or a break it kept (`/PCHard`) in an empty marker
+    // before the next line. Neither name is a paragraph region, so it does not change scope.
+    let mut soft_break = false;
+    let mut hard_break = false;
     for (i, op) in ops.iter().enumerate() {
         match op.op.as_slice() {
             // No depth cap: every `EMC` pops, so a capped push would pair it with the enclosing
             // sequence (#3573). Both stacks stay bounded by the number of operators.
             b"BMC" | b"BDC" => {
+                if op.name(0) == Some(b"PCSoft") {
+                    soft_break = true;
+                    hard_break = false;
+                } else if op.name(0) == Some(b"PCHard") {
+                    hard_break = true;
+                    soft_break = false;
+                }
                 marked.begin(doc, op, i, logical_text, out.len());
             }
             b"EMC" => {
@@ -878,8 +896,26 @@ pub(super) fn interpret(
                 tm = tlm;
             }
             b"Tj" | b"TJ" | b"'" | b"\"" => {
-                let mut state = TextRunState { ts: &mut ts, tm: &mut tm, tlm: &mut tlm, at_bt: &at_bt, bt, marked: &marked, carry, out: &mut out };
+                let before = out.len();
+                let mut state = TextRunState {
+                    ts: &mut ts,
+                    tm: &mut tm,
+                    tlm: &mut tlm,
+                    at_bt: &at_bt,
+                    bt,
+                    marked: &marked,
+                    carry,
+                    out: &mut out,
+                    soft_break,
+                    hard_break,
+                };
                 show_text(op, i, &mut state)?;
+                // A numeric-only TJ adjustment shows no glyphs and pushes nothing: the break
+                // belongs to whichever text-showing operator comes next.
+                if out.len() > before {
+                    soft_break = false;
+                    hard_break = false;
+                }
             }
             _ => {}
         }
diff --git a/crates/edit/src/text/lines.rs b/crates/edit/src/text/lines.rs
index c48522984d..78aec5090f 100644
--- a/crates/edit/src/text/lines.rs
+++ b/crates/edit/src/text/lines.rs
@@ -280,6 +280,8 @@ fn text_lines_in(doc: &Document, p: &pdfcraft_model::Page, actual_text: bool) ->
                 clips: s.state.render_mode >= 4,
                 unreadable_mode: s.state.unreadable.as_deref().map(str::to_owned),
                 runs: vec![(s.text.clone(), s.ink.len(), false)],
+                soft_break: s.soft_break,
+                hard_break: s.hard_break,
                 ops: std::iter::once(s.op).chain(s.extra_ops.iter().copied()).collect(),
                 origin: Origin {
                     tm: s.tm.0,
@@ -394,6 +396,8 @@ fn add_shown(lines: &mut Vec<TextLine>, last: &mut Option<Pen>, s: Shown, stream
             clips: s.state.render_mode >= 4,
             unreadable_mode: s.state.unreadable.as_deref().map(str::to_owned),
             runs: vec![(s.text.clone(), s.ink.len(), false)],
+            soft_break: s.soft_break,
+            hard_break: s.hard_break,
             ops: std::iter::once(s.op).chain(s.extra_ops.iter().copied()).collect(),
             origin: Origin {
                 tm: s.tm.0,
diff --git a/crates/edit/src/text/rewrite.rs b/crates/edit/src/text/rewrite.rs
index 513077a027..9589fad226 100644
--- a/crates/edit/src/text/rewrite.rs
+++ b/crates/edit/src/text/rewrite.rs
@@ -579,13 +579,28 @@ impl LineWriter<'_> {
     }
 
     /// Writes one wrapped line, returning its underline (x0, x1, y) in text space.
-    fn write_line(&self, index: usize, line: &str, last: bool, cursor: &mut LineCursor, ops: &mut Vec<Op>) -> Result<(f64, f64, f64), EditError> {
+    fn write_line(
+        &self,
+        index: usize,
+        line: &str,
+        soft: bool,
+        last: bool,
+        cursor: &mut LineCursor,
+        ops: &mut Vec<Op>,
+    ) -> Result<(f64, f64, f64), EditError> {
         let n = pdfcraft_content::num;
         let body = line.trim_matches(' ');
         let interior = body.matches(' ').count();
         let tw = self.stretch(body, last);
         let (shown, visible) = self.shown(line, body, tw);
         let dx = if tw > 0.0 { 0.0 } else { self.alignment.offset(visible) };
+        if index > 0 {
+            // Inside this text object, so the marker starts and ends here. `/PCSoft` rejoins
+            // when the box widens. `/PCHard` is a newline that was already in the text.
+            let name = if soft { "PCSoft" } else { "PCHard" };
+            ops.push(Op::new("BMC", vec![Object::name(name)]));
+            ops.push(Op::new("EMC", vec![]));
+        }
         if index > 0 || dx != 0.0 {
             ops.push(Op::new("Td", vec![n(dx - cursor.x), n(if index > 0 { -self.lead } else { 0.0 })]));
         }
@@ -633,8 +648,12 @@ impl LineWriter<'_> {
     }
 
     /// Writes every wrapped line, returning their underlines.
-    fn write_all(&self, wrapped: &[String], cursor: &mut LineCursor, ops: &mut Vec<Op>) -> Result<Vec<(f64, f64, f64)>, EditError> {
-        wrapped.iter().enumerate().map(|(i, line)| self.write_line(i, line, i + 1 == wrapped.len(), cursor, ops)).collect()
+    fn write_all(&self, wrapped: &[(String, bool)], cursor: &mut LineCursor, ops: &mut Vec<Op>) -> Result<Vec<(f64, f64, f64)>, EditError> {
+        wrapped
+            .iter()
+            .enumerate()
+            .map(|(i, (line, soft))| self.write_line(i, line, *soft, i + 1 == wrapped.len(), cursor, ops))
+            .collect()
     }
 }
 
@@ -653,7 +672,7 @@ struct BlockPlan<'a> {
     underline: bool,
 }
 
-fn block_ops(plan: &BlockPlan<'_>, writer: &LineWriter<'_>, wrapped: &[String], show_font: String) -> Result<Vec<Op>, EditError> {
+fn block_ops(plan: &BlockPlan<'_>, writer: &LineWriter<'_>, wrapped: &[(String, bool)], show_font: String) -> Result<Vec<Op>, EditError> {
     let n = pdfcraft_content::num;
     let mut ops = vec![Op::new("q", vec![])];
     ops.extend(reveal_ops(plan.block, plan.lines, plan.style, plan.emit.ctm)?);
diff --git a/crates/edit/src/text_regions/grouping.rs b/crates/edit/src/text_regions/grouping.rs
index 68a83569a5..f866daef5e 100644
--- a/crates/edit/src/text_regions/grouping.rs
+++ b/crates/edit/src/text_regions/grouping.rs
@@ -299,6 +299,7 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
             blocks.push(TextBlock {
                 text: String::new(),
                 editor_text: String::new(),
+                reflow_text: String::new(),
                 spans: Vec::new(),
                 rect,
                 base_font: first.base_font.clone(),
@@ -346,5 +347,53 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
         block.rect = union(block.rect, rect);
         block.rows.push(row.clone());
     }
+    for block in &mut blocks {
+        block.reflow_text = reflow_text(block, lines);
+    }
     blocks
 }
+
+/// The text a width change should reflow. A `/PCSoft` line is a wrap and rejoins. A `/PCHard`
+/// line, or a short line that is not marked, keeps its newline. An unmarked line that reaches
+/// the paragraph's right edge and is wide enough to be a measure rejoins too: that is how a
+/// file written elsewhere wraps a body line.
+fn reflow_text(block: &TextBlock, lines: &[TextLine]) -> String {
+    let parts: Vec<&str> = block.editor_text.split('\n').collect();
+    if parts.len() != block.rows.len() {
+        return block.editor_text.clone();
+    }
+    let mut out = String::new();
+    for (index, part) in parts.iter().enumerate() {
+        if index > 0 {
+            if break_is_soft(block, lines, index) {
+                if out.ends_with('-') {
+                    out.pop();
+                } else if !out.ends_with(char::is_whitespace) {
+                    out.push(' ');
+                }
+            } else {
+                out.push('\n');
+            }
+        }
+        out.push_str(part);
+    }
+    out
+}
+
+fn break_is_soft(block: &TextBlock, lines: &[TextLine], row_index: usize) -> bool {
+    let Some(line) = block.rows.get(row_index).and_then(|row| row.first()).and_then(|i| lines.get(*i)) else { return false };
+    if line.hard_break {
+        return false;
+    }
+    if line.soft_break {
+        return true;
+    }
+    let Some(prev) = block.rows.get(row_index.wrapping_sub(1)).and_then(|row| row_rect(row, lines)) else { return false };
+    let Some(next) = block.rows.get(row_index).and_then(|row| row_rect(row, lines)) else { return false };
+    let size = line.size.max(1.0);
+    let slack = block.rect[2] - prev[2];
+    let width = prev[2] - prev[0];
+    // Short rows define the right edge by their own letters. A body line that fills the
+    // measure leaves almost no room for the next word.
+    slack <= size * 0.75 && width >= size * 8.0 && (next[2] - next[0]) + size * 0.25 > slack
+}
diff --git a/crates/edit/src/text_regions/styled.rs b/crates/edit/src/text_regions/styled.rs
index ccb75b3130..f55d52ddc6 100644
--- a/crates/edit/src/text_regions/styled.rs
+++ b/crates/edit/src/text_regions/styled.rs
@@ -405,9 +405,12 @@ fn wrap_styled_rows(
     chars: &[StyledChar],
     width: f64,
     measure: impl Fn(&[StyledChar]) -> Result<f64, EditError>,
-) -> Result<(StyledRows, RowRanges), EditError> {
+) -> Result<(StyledRows, RowRanges, Vec<bool>), EditError> {
     let mut rows: Vec<Vec<StyledChar>> = Vec::new();
     let mut row_ranges = Vec::new();
+    // True when this row starts because the previous word did not fit, not because of a newline.
+    let mut row_soft = Vec::new();
+    let mut next_soft = false;
     let mut row_start = 0;
     let mut row = Vec::new();
     let mut row_width = 0.0;
@@ -419,6 +422,8 @@ fn wrap_styled_rows(
             continue;
         }
         if item.0 == '\n' {
+            row_soft.push(next_soft);
+            next_soft = false;
             row_ranges.push(row_start..row_start + row.len());
             rows.push(std::mem::take(&mut row));
             row_width = 0.0;
@@ -442,6 +447,8 @@ fn wrap_styled_rows(
             while row.last().is_some_and(|c: &StyledChar| c.0.is_whitespace()) {
                 row.pop();
             }
+            row_soft.push(next_soft);
+            next_soft = true;
             row_ranges.push(row_start..row_start + row.len());
             rows.push(std::mem::take(&mut row));
             row_width = 0.0;
@@ -452,10 +459,11 @@ fn wrap_styled_rows(
         at = end;
     }
     if !row.is_empty() {
+        row_soft.push(next_soft);
         row_ranges.push(row_start..row_start + row.len());
         rows.push(row);
     }
-    Ok((rows, row_ranges))
+    Ok((rows, row_ranges, row_soft))
 }
 
 fn apply_range_styles<'a>(
@@ -822,7 +830,7 @@ pub(crate) fn rewrite_styled_block(
         }
         Ok(width)
     };
-    let (rows, row_ranges) = wrap_styled_rows(&chars, width, measure)?;
+    let (rows, row_ranges, row_soft) = wrap_styled_rows(&chars, width, measure)?;
     let streams = content_streams(doc, &p.dict)?;
     let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
     let ops = pieces.parse().ops;
@@ -891,6 +899,14 @@ pub(crate) fn rewrite_styled_block(
             baseline -= source_leading;
             continue;
         }
+        if !row.is_empty() && row_index > 0 {
+            // An empty marker between lines. `/PCSoft` is a wrap and rejoins when the box
+            // widens. `/PCHard` is a newline that was already in the text. Neither is a
+            // paragraph region, so the lines stay in one scope.
+            let name = if row_soft.get(row_index).copied().unwrap_or(false) { "PCSoft" } else { "PCHard" };
+            block_ops.push(Op::new("BMC", vec![Object::name(name)]));
+            block_ops.push(Op::new("EMC", vec![]));
+        }
         let w = measured.get(row_index).copied().unwrap_or(0.0);
         let align = style.align.unwrap_or(if centered { crate::added::Align::Center } else { crate::added::Align::Left });
         let original_rect = block.rows.get(row_index).and_then(|row| row_rect(row, lines)).unwrap_or(block.rect);
diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
index c932ed3608..c8bf9867b2 100644
--- a/crates/ui-egui/src/tools/edit_text_ui.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -399,9 +399,10 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, lines: &[pdfcraft_engine::Text
                 let width = (l.rect[2] - l.rect[0]) + (to[2] - to[0]) - (from[2] - from[0]);
                 let shift = to[0] - from[0];
                 let style = pdfcraft_engine::BlockStyle { width: Some(width), offset: (shift != 0.0).then_some([shift, 0.0]), ..Default::default() };
-                // `text` joins rows with spaces. The editor text is what the paragraph actually
-                // is, line breaks included; a width change must not throw those breaks away.
-                Edit::EditTextBlock { page, block: d.block, text: l.editor_text.clone(), style }
+                // `editor_text` has a newline for every visual row, so a wrap would come back as a
+                // hard break and a wider box would not reflow it. `reflow_text` rejoins a wrap
+                // and keeps a newline that was typed.
+                Edit::EditTextBlock { page, block: d.block, text: l.reflow_text.clone(), style }
             } else {
                 // Translation must keep the selected source operators. Rewriting unchanged text
                 // would also remove unrelated paragraphs that now overlap this one (#594).
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 5a124aa390..95ad044b31 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -3738,7 +3738,7 @@ fn the_live_editor_groups_a_repeated_step_and_keeps_the_neighbour() {
         700.0 - step,
         700.0 - 2.0 * step
     );
-    let mut h = open_letter("repeated.pdf", letter_text(&repeated));
+    let mut h = open_letter("repeated.pdf", letter_text(repeated.as_str()));
     assert!(h.state_mut().execute("edit.edit_text"));
     h.run_steps(2);
     click_page(&mut h, 90.0, 700.0 - step + 4.0);
@@ -3785,7 +3785,7 @@ fn widening_example_one_keeps_the_heading_and_the_next_paragraph() {
                 BT /F1 14 Tf 72 450 Td (3. Add a row under Alpha. Neighbor stays.) Tj ET \
                 BT /F1 12 Tf 14.4 TL 1 0 0 1 72 410 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET \
                 BT /F1 12 Tf 14.4 TL 1 0 0 1 72 366.8 Tm (Neighbor stays.) Tj ET";
-    let mut h = open_letter("letter.pdf", letter_text(&body));
+    let mut h = open_letter("letter.pdf", letter_text(body));
     assert!(h.state_mut().execute("edit.edit_text"));
     h.run_steps(2);
     click_page(&mut h, 90.0, 690.0);
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index c7069200ab..c9d371cc56 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1902,8 +1902,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["text_edit"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_move_and_rewrap_to_a_new_width", "crates/ui-egui/tests/it/editing.rs::dragging_a_paragraph_moves_it_and_its_edge_rewraps_it", "crates/ui-egui/tests/it/editing.rs::a_paragraph_rewraps_from_the_outer_half_of_its_edge_handles", "crates/ui-egui/tests/it/editing.rs::an_open_paragraph_moves_by_its_frame_and_by_the_arrow_keys", "crates/ui-egui/tests/it/editing.rs::arrow_keys_nudge_a_selected_image_instead_of_turning_the_page", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
-notes = "existing paragraphs: drag the box to move it, drag the handle on its left or right edge to rewrap it to a new width (upright pages), including the half of the handle outside the box, which started an area selection instead (#2276); the move is applied in page space through the paragraph's CTM, in its own q … Q; a click still opens it for typing (#40); once open, its frame grabs the box (click to select, drag to move) while the text keeps the caret, and the arrow keys nudge the selected box or image a point, Shift ten points (#1520)"
+evidence = ["crates/edit/src/tests.rs::paragraphs_move_and_rewrap_to_a_new_width", "crates/edit/src/tests.rs::a_wrapped_line_rejoins_when_widened_and_a_typed_break_stays", "crates/edit/src/tests.rs::an_unmarked_full_line_rejoins_and_a_short_break_stays", "crates/ui-egui/tests/it/editing.rs::dragging_a_paragraph_moves_it_and_its_edge_rewraps_it", "crates/ui-egui/tests/it/editing.rs::a_paragraph_rewraps_from_the_outer_half_of_its_edge_handles", "crates/ui-egui/tests/it/editing.rs::a_quick_flick_on_either_edge_rewraps_the_paragraph", "crates/ui-egui/tests/it/editing.rs::an_open_paragraph_moves_by_its_frame_and_by_the_arrow_keys", "crates/ui-egui/tests/it/editing.rs::arrow_keys_nudge_a_selected_image_instead_of_turning_the_page", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
+notes = "existing paragraphs: drag the box to move it, drag the handle on its left or right edge to rewrap it to a new width (upright pages), including the half of the handle outside the box, which started an area selection instead (#2276); a wrap rejoins when the box is widened, and a newline that was typed stays; an unmarked line that fills the measure rejoins, a short line does not; the move is applied in page space through the paragraph's CTM, in its own q … Q; a click still opens it for typing (#40); once open, its frame grabs the box (click to select, drag to move) while the text keeps the caret, and the arrow keys nudge the selected box or image a point, Shift ten points (#1520)"
 
 [[feature]]
 id = "edit.paragraph-detection"

From cb832b0206727942b5ed1403ca7c93742dec95b5 Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Sun, 18 Oct 2026 20:50:21 +0200
Subject: [PATCH 118/270] M7: close a partial rewrite before the next marked
 region (#2517)

An unmarked paragraph was closing its marker at the following line's BT, which is after that line's BDC. The close now follows this paragraph's last ET.
---
 crates/edit/src/tests.rs               | 17 ++++++++++++
 crates/edit/src/text_regions/styled.rs | 38 +++++++++++---------------
 parity/acrobat-features.toml           |  2 +-
 3 files changed, 34 insertions(+), 23 deletions(-)

diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 800481d7d0..81279270a9 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -3057,6 +3057,23 @@ fn a_partial_rewrite_keeps_the_next_marked_region_closed() {
     assert!(!content[neighbour..close].contains("(One.)"), "the rewrite was pulled into the neighbour's marker: {content}");
 }
 
+/// The paragraph being edited is not in a marked region. The next one is. Closing the new
+/// marker at the neighbour's `BT` would land after that region's `BDC` and close it early.
+#[test]
+fn a_partial_rewrite_of_an_unmarked_paragraph_leaves_the_marked_neighbour_closed() {
+    let src = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj ET \
+               /P << /MCID 1 >> BDC BT /F1 12 Tf 14.4 TL 1 0 0 1 72 656.8 Tm (Neighbor stays.) Tj ET EMC";
+    let mut doc = text_page(src);
+    assert_eq!(text::text_blocks(&doc, 0).unwrap().len(), 2);
+    text::replace_block(&mut doc, 0, 0, "One.\nAlpha next row.").unwrap();
+    let doc = reopen(&doc);
+    let texts: Vec<_> = text::text_blocks(&doc, 0).unwrap().into_iter().map(|b| b.text).collect();
+    assert_eq!(texts, ["One. Alpha next row.", "Neighbor stays."], "{texts:?}");
+    let content = page_content(&doc);
+    assert_marker_wraps(&content, "/MCID 1", "(Neighbor stays.)", "(Neighbor stays.)");
+    assert!(!region_through_matching_close(&content, "/MCID 1").contains("(One.)"), "the rewrite was pulled into the neighbour: {content}");
+}
+
 /// Both paragraphs already share one marked region, separated by a blank line. The extra marker
 /// around the edit has to close itself, not the region, so the neighbour stays inside it.
 #[test]
diff --git a/crates/edit/src/text_regions/styled.rs b/crates/edit/src/text_regions/styled.rs
index f55d52ddc6..557a86f1d6 100644
--- a/crates/edit/src/text_regions/styled.rs
+++ b/crates/edit/src/text_regions/styled.rs
@@ -643,11 +643,10 @@ fn shared_scope(block: &TextBlock, lines: &[TextLine]) -> Option<usize> {
 /// Where an extra `/P` marker belongs.
 ///
 /// The marker is omitted when the paragraph is already one marked region and the next line is
-/// in a different one: an `EMC` at that line's `BT` lands after the other region has opened, so
-/// it would close the other region and leave its text outside. When nothing follows, `close` is
-/// the operator just after the paragraph's last `ET` (`ops.len()` means append it after the
-/// stream). Closing earlier, inside the rewritten operators, leaves a kept source row outside
-/// the marker and can put `EMC` inside a `BT`.
+/// in a different one. Otherwise it closes after the paragraph's last `ET` (`ops.len()` means
+/// append it after the stream). Closing at the next line's `BT` is too late when that line's
+/// region opened with `BDC` before the `BT`: the `EMC` would end the neighbour's region. Closing
+/// inside the rewritten operators leaves a kept source row outside the marker.
 fn paragraph_marker(block: &TextBlock, lines: &[TextLine], ops: &[Op]) -> Option<(usize, Option<usize>, usize)> {
     let (start, next) = paragraph_span(block, lines)?;
     if let Some(region) = shared_scope(block, lines)
@@ -658,23 +657,18 @@ fn paragraph_marker(block: &TextBlock, lines: &[TextLine], ops: &[Op]) -> Option
             return None;
         }
     }
-    let close = if next.is_none() {
-        let end = block
-            .lines
-            .iter()
-            .filter_map(|i| lines.get(*i))
-            .flat_map(|line| line.ops.iter().copied().chain(std::iter::once(line.origin.bt_op)))
-            .max()?;
-        ops.iter()
-            .enumerate()
-            .skip(end.saturating_add(1))
-            .find(|(_, op)| op.op.as_slice() == b"ET")
-            .map(|(index, _)| index.saturating_add(1))
-            .unwrap_or(ops.len())
-    } else {
-        0
-    };
-    Some((start, next, close))
+    let end =
+        block.lines.iter().filter_map(|i| lines.get(*i)).flat_map(|line| line.ops.iter().copied().chain(std::iter::once(line.origin.bt_op))).max()?;
+    let close = ops
+        .iter()
+        .enumerate()
+        .skip(end.saturating_add(1))
+        .find(|(_, op)| op.op.as_slice() == b"ET")
+        .map(|(index, _)| index.saturating_add(1))
+        .unwrap_or(ops.len());
+    // `None` is the next-line index: the close is after this paragraph's `ET`, not at the
+    // following line's `BT`.
+    Some((start, None, close))
 }
 
 struct RewriteAnchor<'a> {
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index c9d371cc56..65a93ebf75 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1914,7 +1914,7 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["text_paragraphs"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/automation/tests/it/automation.rs::paragraph_grouping_survives_save_and_reopen_through_tools", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_only_paragraph_stays_one_block", "crates/edit/src/tests.rs::a_partial_rewrite_closes_before_the_operator_that_follows_the_paragraph", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_last_marked_paragraph_stays_inside_its_region", "crates/edit/src/tests.rs::a_partial_rewrite_keeps_the_next_marked_region_closed", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_marked_region_leaves_the_neighbour_inside_it", "crates/automation/tests/it/automation.rs::a_partial_rewrite_of_the_last_paragraph_stays_one_through_tools", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
+evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/automation/tests/it/automation.rs::paragraph_grouping_survives_save_and_reopen_through_tools", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_only_paragraph_stays_one_block", "crates/edit/src/tests.rs::a_partial_rewrite_closes_before_the_operator_that_follows_the_paragraph", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_last_marked_paragraph_stays_inside_its_region", "crates/edit/src/tests.rs::a_partial_rewrite_keeps_the_next_marked_region_closed", "crates/edit/src/tests.rs::a_partial_rewrite_of_an_unmarked_paragraph_leaves_the_marked_neighbour_closed", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_marked_region_leaves_the_neighbour_inside_it", "crates/automation/tests/it/automation.rs::a_partial_rewrite_of_the_last_paragraph_stays_one_through_tools", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
 notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; a blank line (about twice the paragraph's own leading) stays a separate paragraph, and editing the first one leaves the next in place (#2517). An explicit TL is that leading. Without one, Td does not set it: three or more rows at one repeated step stay one paragraph, and a single wider gap stays a break. A rewrite marks the whole paragraph, including a row it leaves in the source, so adding a row does not absorb the next paragraph on a later edit. When the paragraph is the last text on the page, that marker closes after the paragraph's last ET, so a kept source row stays inside it. The extra marker is not added when the paragraph is already one marked region and the next line is in a different region. Hyphenated line ends are joined. A row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it. Still open: a larger heading joined to smaller body lines (#1756) and cells in different columns (#1680, #2478). Two rows and no third step still cannot be told from a paragraph break when there is no TL."
 
 [[feature]]

From 21b911ae4260e7ae41c532aa48a5855fafb49d62 Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Thu, 22 Oct 2026 16:28:55 +0200
Subject: [PATCH 119/270] M7: close a shared text object before the next
 paragraph (#2517)

A partial rewrite put the paragraph marker around the shared ET, so the neighbour in that text object joined the paragraph and the next edit deleted it.
---
 ROADMAP.md                             |  2 +-
 crates/edit/src/tests.rs               | 19 +++++++++++++++++++
 crates/edit/src/text_regions/styled.rs | 22 ++++++++++++++++++++--
 docs/gaps.md                           |  8 +++++---
 docs/roadmap.md                        |  3 ++-
 parity/acrobat-features.toml           |  4 ++--
 6 files changed, 49 insertions(+), 9 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 83cfd66532..e8f8c5a69d 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,7 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M10, #4158 partial):** Word, HTML, RTF and PowerPoint export keep a block that continues another on its line (an italic case name, a link, a superscript) as a run in its own style inside that paragraph, with the source's word space, instead of a paragraph of its own. Style changes that wrap onto the next line still split paragraphs (the reading blocks keep style boundaries). Estimates unchanged.
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
-- **2026-10-18 (M7, #2517):** A partial rewrite of the last paragraph closes its marker after that paragraph's last `ET`, so a row left in the source stays in the paragraph. The extra marker is not added across two marked-content regions. Estimates unchanged.
+- **2026-10-22 (M7, #2517):** A partial rewrite of the last paragraph closes its marker after that paragraph's last `ET`, so a row left in the source stays in the paragraph. When the next paragraph shares the text object, the marker closes before that neighbour instead of after the shared `ET`. The extra marker is not added across two marked-content regions. Estimates unchanged.
 - **2026-10-15 (M7, #2517):** A blank line between paragraphs stays a paragraph break. An explicit `TL` is the measured baseline gap. Without one, three or more rows at a repeated step stay one paragraph, and a single wider gap stays a break. Adding a row, even when an earlier row is left in the source, does not absorb the next paragraph on a later edit. Estimates unchanged.
 
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 81279270a9..c7f4787adc 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -2963,6 +2963,25 @@ fn a_partial_rewrite_that_adds_a_row_keeps_the_neighbour() {
     }
 }
 
+/// Both paragraphs share one text object, with a blank line between them. The paragraph
+/// marker has to close before the neighbour, not after the shared `ET`.
+#[test]
+fn a_partial_rewrite_inside_one_text_object_keeps_the_neighbour() {
+    let src = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj T* T* (Neighbor stays.) Tj ET";
+    let mut doc = text_page(src);
+    let texts = |doc: &Document| text::text_blocks(doc, 0).unwrap().into_iter().map(|b| b.text).collect::<Vec<_>>();
+    assert_eq!(texts(&doc), ["Alpha first row. Alpha next row.", "Neighbor stays."], "the blank line is a paragraph break");
+    text::replace_block(&mut doc, 0, 0, "Alpha first row.\nTwo\nThree").unwrap();
+    let content = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
+    assert_eq!(texts(&doc), ["Alpha first row. Two Three", "Neighbor stays."], "{content}");
+    for saved in [reopen(&doc), Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap()] {
+        assert_eq!(texts(&saved), ["Alpha first row. Two Three", "Neighbor stays."], "save joined the neighbour");
+        let mut again = saved;
+        text::replace_block(&mut again, 0, 0, "Alpha first row.\nTwo\nFour").unwrap();
+        assert_eq!(texts(&reopen(&again)), ["Alpha first row. Two Four", "Neighbor stays."]);
+    }
+}
+
 /// #2516's published steps: adding a row must not make the next edit-by-number rewrite Charlie.
 /// The issue also asks for a stable paragraph id. That is #2508, and this test does not add one.
 #[test]
diff --git a/crates/edit/src/text_regions/styled.rs b/crates/edit/src/text_regions/styled.rs
index 557a86f1d6..5df2d9cd1d 100644
--- a/crates/edit/src/text_regions/styled.rs
+++ b/crates/edit/src/text_regions/styled.rs
@@ -647,6 +647,10 @@ fn shared_scope(block: &TextBlock, lines: &[TextLine]) -> Option<usize> {
 /// append it after the stream). Closing at the next line's `BT` is too late when that line's
 /// region opened with `BDC` before the `BT`: the `EMC` would end the neighbour's region. Closing
 /// inside the rewritten operators leaves a kept source row outside the marker.
+///
+/// A neighbour in the same text object has no `BT` of its own. Closing after the shared `ET`
+/// would take that neighbour into the marker. The marker then opens after `BT` and closes
+/// before the neighbour's text, so `BT` and `ET` stay matched.
 fn paragraph_marker(block: &TextBlock, lines: &[TextLine], ops: &[Op]) -> Option<(usize, Option<usize>, usize)> {
     let (start, next) = paragraph_span(block, lines)?;
     if let Some(region) = shared_scope(block, lines)
@@ -657,18 +661,32 @@ fn paragraph_marker(block: &TextBlock, lines: &[TextLine], ops: &[Op]) -> Option
             return None;
         }
     }
+    let belongs: std::collections::HashSet<usize> = block.lines.iter().copied().collect();
     let end =
         block.lines.iter().filter_map(|i| lines.get(*i)).flat_map(|line| line.ops.iter().copied().chain(std::iter::once(line.origin.bt_op))).max()?;
-    let close = ops
+    let after_text = ops
         .iter()
         .enumerate()
         .skip(end.saturating_add(1))
         .find(|(_, op)| op.op.as_slice() == b"ET")
         .map(|(index, _)| index.saturating_add(1))
         .unwrap_or(ops.len());
+    let neighbour = lines
+        .iter()
+        .enumerate()
+        .filter(|(index, _)| !belongs.contains(index))
+        .filter_map(|(_, line)| line.ops.iter().copied().filter(|op| *op > end).min())
+        .min();
+    if let Some(op) = neighbour.filter(|op| *op < after_text) {
+        let open = block.lines.iter().filter_map(|i| lines.get(*i)).flat_map(|line| line.ops.iter().copied()).min()?;
+        // `BT` stays outside the marker. Both ends are inside the one text object.
+        if open > start {
+            return Some((open, None, op));
+        }
+    }
     // `None` is the next-line index: the close is after this paragraph's `ET`, not at the
     // following line's `BT`.
-    Some((start, None, close))
+    Some((start, None, after_text))
 }
 
 struct RewriteAnchor<'a> {
diff --git a/docs/gaps.md b/docs/gaps.md
index 9457fd7595..4f35e651d1 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -5,6 +5,7 @@
 
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-19 · **Change:** minor (gap 2: composite fonts with `/ToUnicode /Identity-H` read as Unicode, hayro-interpret patch 44; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-17 · **Last updated:** 2026-10-17 · **Change:** minor (gap 6: #2662 redaction audit counts a cover over one word of a long line; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-22 · **Last updated:** 2026-10-22 · **Change:** minor (gap 3: #2517 a partial rewrite inside one text object keeps the next paragraph; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-18 · **Last updated:** 2026-10-18 · **Change:** minor (gap 3: #2517 a partial rewrite keeps a kept row inside the paragraph and leaves the next marked region closed; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (gap 12: reading order is scored, not just word F1) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M1: raw-deflate fallback preserves decoding-limit errors; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -105,9 +106,10 @@ update the numbers.
   baseline is still replaced. A blank line stays a paragraph break. An explicit `TL` is the
   measured baseline gap, and growing a paragraph so its new row is one leading above the next
   one does not absorb that paragraph (#2517). A partial rewrite of the last paragraph keeps a
-  source row inside that paragraph, and does not close a following marked region early. A heading and smaller body lines (#1756), a
-  hanging-indent continuation (#2564), and cells in different columns (#1680, #2478) are still
-  grouped by the same geometry. Estimates are unchanged.
+  source row inside that paragraph, and does not close a following marked region early. Two
+  paragraphs that share one text object keep that boundary when the first is rewritten. A heading
+  and smaller body lines (#1756) and cells in different columns (#1680, #2478) are still grouped
+  by the same geometry. A row that a list item wraps onto stays with that item. Estimates are unchanged.
 
 - **Missing:** robust in-place editing of text PdfCraft didn't write: subset fonts without the
   needed glyphs, CJK and right-to-left text, rotated text, lists, superscript/subscript, keeping
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 184a1b7a37..bad3da9a63 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -9,7 +9,7 @@
 > **Last reviewed:** 2026-10-23 | **Last updated:** 2026-10-23 | **Change:** minor (M10: table spans retain text from covered slots in Office exports; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M10: image export preserves soft-mask Decode opacity ranges; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M10: vector printing preserves existing page XObjects when adding annotation appearances; estimates unchanged)
-> **Last reviewed:** 2026-10-18 · **Last updated:** 2026-10-18 · **Change:** minor (M7 #2517: a partial rewrite keeps its marker around a kept row, and off the next marked region; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-22 · **Last updated:** 2026-10-22 · **Change:** minor (M7 #2517: a partial rewrite inside one text object closes its marker before the next paragraph; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (M7 #2517: a blank line stays a paragraph break; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 > **Last reviewed:** 2026-10-20 | **Last updated:** 2026-10-20 | **Change:** minor (M10, #3532 partial: vector printing retains existing appearances with absent Subtype; estimates unchanged)
@@ -266,6 +266,7 @@ Estimates unchanged.
 | 2026-10-21 | minor | M3: on GNOME/Wayland, a second resize by an edge or move by the tab strip works without a click in between (the compositor kept the button's release from egui). Estimates unchanged. |
 | 2026-10-22 | minor | M4, #3916 partial: edits and Undo/Redo cancel Organize page drags. Pointer-release and save/reopen regressions check page order. Estimates unchanged. |
 | 2026-10-22 | minor | M14 #3558: rebased macOS association recovery; reuse #3042 shared metadata preservation instead of a duplicate save wrapper. Estimates unchanged. |
+| 2026-10-22 | minor | M7 #2517: a partial rewrite of two paragraphs that share one text object closes the marker before the neighbour, so a later edit does not delete it. Estimates unchanged. |
 | 2026-10-18 | minor | M7 #2517: a partial rewrite of the last paragraph closes its marker after the last `ET`, and does not close a following marked region early. Estimates unchanged. |
 | 2026-10-15 | minor | M7 #2517: a blank line between paragraphs stays a paragraph break, and growing the first paragraph does not absorb the next one. Estimates unchanged. |
 | 2026-10-20 | minor | M4: initial-view window and interface options resolve indirect boolean ViewerPreferences values; synthetic true/false and save/reopen regressions retain defaults for malformed entries. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 65a93ebf75..5ff2829e2f 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1914,8 +1914,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["text_paragraphs"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/automation/tests/it/automation.rs::paragraph_grouping_survives_save_and_reopen_through_tools", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_only_paragraph_stays_one_block", "crates/edit/src/tests.rs::a_partial_rewrite_closes_before_the_operator_that_follows_the_paragraph", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_last_marked_paragraph_stays_inside_its_region", "crates/edit/src/tests.rs::a_partial_rewrite_keeps_the_next_marked_region_closed", "crates/edit/src/tests.rs::a_partial_rewrite_of_an_unmarked_paragraph_leaves_the_marked_neighbour_closed", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_marked_region_leaves_the_neighbour_inside_it", "crates/automation/tests/it/automation.rs::a_partial_rewrite_of_the_last_paragraph_stays_one_through_tools", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
-notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; a blank line (about twice the paragraph's own leading) stays a separate paragraph, and editing the first one leaves the next in place (#2517). An explicit TL is that leading. Without one, Td does not set it: three or more rows at one repeated step stay one paragraph, and a single wider gap stays a break. A rewrite marks the whole paragraph, including a row it leaves in the source, so adding a row does not absorb the next paragraph on a later edit. When the paragraph is the last text on the page, that marker closes after the paragraph's last ET, so a kept source row stays inside it. The extra marker is not added when the paragraph is already one marked region and the next line is in a different region. Hyphenated line ends are joined. A row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it. Still open: a larger heading joined to smaller body lines (#1756) and cells in different columns (#1680, #2478). Two rows and no third step still cannot be told from a paragraph break when there is no TL."
+evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/automation/tests/it/automation.rs::paragraph_grouping_survives_save_and_reopen_through_tools", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_only_paragraph_stays_one_block", "crates/edit/src/tests.rs::a_partial_rewrite_closes_before_the_operator_that_follows_the_paragraph", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_last_marked_paragraph_stays_inside_its_region", "crates/edit/src/tests.rs::a_partial_rewrite_keeps_the_next_marked_region_closed", "crates/edit/src/tests.rs::a_partial_rewrite_of_an_unmarked_paragraph_leaves_the_marked_neighbour_closed", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_marked_region_leaves_the_neighbour_inside_it", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_text_object_keeps_the_neighbour", "crates/automation/tests/it/automation.rs::a_partial_rewrite_of_the_last_paragraph_stays_one_through_tools", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
+notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; a blank line (about twice the paragraph's own leading) stays a separate paragraph, and editing the first one leaves the next in place (#2517). An explicit TL is that leading. Without one, Td does not set it: three or more rows at one repeated step stay one paragraph, and a single wider gap stays a break. A rewrite marks the whole paragraph, including a row it leaves in the source, so adding a row does not absorb the next paragraph on a later edit. When the paragraph is the last text on the page, that marker closes after the paragraph's last ET, so a kept source row stays inside it. When the next paragraph shares that text object, the marker opens after BT and closes before the neighbour's text. The extra marker is not added when the paragraph is already one marked region and the next line is in a different region. Hyphenated line ends are joined. A row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it. Still open: a larger heading joined to smaller body lines (#1756) and cells in different columns (#1680, #2478). Two rows and no third step still cannot be told from a paragraph break when there is no TL."
 
 [[feature]]
 id = "edit.font-reuse-substitution"

From 62af4f87cae57d1255fef91560d6393a8afb3e7e Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Thu, 22 Oct 2026 17:07:36 +0200
Subject: [PATCH 120/270] M7: compile the paragraph fixture on current main
 (#2517)

The paragraph-key helper has to carry reflow text, which a width change uses. ClosePath on an empty subpath is a match guard so the edit crate still passes clippy.
---
 crates/edit/src/images.rs                | 8 +++-----
 crates/edit/src/text_regions/grouping.rs | 2 +-
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/crates/edit/src/images.rs b/crates/edit/src/images.rs
index 5180e76018..f66e7f24ee 100644
--- a/crates/edit/src/images.rs
+++ b/crates/edit/src/images.rs
@@ -186,11 +186,9 @@ impl ImageState {
                     self.path.curve_to(self.point(x1, y1), end, end);
                 }
             }
-            b"h" => {
-                // ClosePath with no subpath panics by the same contract (#3581).
-                if self.path.elements().last().is_some() {
-                    self.path.close_path();
-                }
+            // ClosePath with no subpath panics by the same contract (#3581).
+            b"h" if self.path.elements().last().is_some() => {
+                self.path.close_path();
             }
             b"re" => {
                 if let Some([x, y, w, h]) = op.nums::<4>() {
diff --git a/crates/edit/src/text_regions/grouping.rs b/crates/edit/src/text_regions/grouping.rs
index f866daef5e..df281eb922 100644
--- a/crates/edit/src/text_regions/grouping.rs
+++ b/crates/edit/src/text_regions/grouping.rs
@@ -235,7 +235,7 @@ fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
             // A bullet of its own opens a list item (#2564): such a row is a new paragraph, and
             // letting it join is what made an edit of the row above delete this item and the ones
             // after it.
-            if starts_list_item(&row, lines) {
+            if starts_list_item(row, lines) {
                 return false;
             }
             let Some(prev_row) = block.rows.last() else { return false };

From 59513aa8878d610d0d497ffb1b476af4ff9edd9c Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Thu, 22 Oct 2026 22:49:46 +0200
Subject: [PATCH 121/270] M7: keep a preceding paragraph out of a shared text
 object's marker (#2517)

A partial rewrite of the last paragraph opened the marker at the shared BT, so the paragraph before it was inside the region.
---
 crates/edit/src/tests.rs               | 25 +++++++++++++++++++++++++
 crates/edit/src/text_regions/styled.rs | 16 +++++++++++++++-
 parity/acrobat-features.toml           |  4 ++--
 3 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index c7f4787adc..9cc8cf2177 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -2982,6 +2982,31 @@ fn a_partial_rewrite_inside_one_text_object_keeps_the_neighbour() {
     }
 }
 
+/// The last paragraph of a shared text object has no neighbour after it. The marker still has
+/// to open after the preceding paragraph, not at the shared `BT`, or that paragraph joins it.
+#[test]
+fn a_partial_rewrite_of_the_last_paragraph_in_one_text_object_keeps_the_one_before_it() {
+    let src =
+        "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj T* T* (Neighbor stays.) Tj T* (Neighbor next.) Tj ET";
+    let mut doc = text_page(src);
+    let texts = |doc: &Document| text::text_blocks(doc, 0).unwrap().into_iter().map(|b| b.text).collect::<Vec<_>>();
+    assert_eq!(texts(&doc), ["Alpha first row. Alpha next row.", "Neighbor stays. Neighbor next."], "the blank line is a paragraph break");
+    text::replace_block(&mut doc, 0, 1, "Neighbor stays.\nChanged.").unwrap();
+    let content = page_content(&doc);
+    assert_eq!(texts(&doc), ["Alpha first row. Alpha next row.", "Neighbor stays. Changed."], "{content}");
+    let alpha = content.find("(Alpha first row.)").expect("the preceding paragraph");
+    let open = content.find("/P BMC").expect("marker");
+    assert!(alpha < open, "the marker swallowed the preceding paragraph: {content}");
+    let neighbour = content.find("(Neighbor stays.)").expect("the kept row");
+    assert!(open < neighbour, "the kept row is outside the marker: {content}");
+    for saved in [reopen(&doc), Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap()] {
+        assert_eq!(texts(&saved), ["Alpha first row. Alpha next row.", "Neighbor stays. Changed."], "save joined the preceding paragraph");
+        let mut again = saved;
+        text::replace_block(&mut again, 0, 1, "Neighbor stays.\nEdited.").unwrap();
+        assert_eq!(texts(&reopen(&again)), ["Alpha first row. Alpha next row.", "Neighbor stays. Edited."]);
+    }
+}
+
 /// #2516's published steps: adding a row must not make the next edit-by-number rewrite Charlie.
 /// The issue also asks for a stable paragraph id. That is #2508, and this test does not add one.
 #[test]
diff --git a/crates/edit/src/text_regions/styled.rs b/crates/edit/src/text_regions/styled.rs
index 5df2d9cd1d..be7e627ba6 100644
--- a/crates/edit/src/text_regions/styled.rs
+++ b/crates/edit/src/text_regions/styled.rs
@@ -677,13 +677,27 @@ fn paragraph_marker(block: &TextBlock, lines: &[TextLine], ops: &[Op]) -> Option
         .filter(|(index, _)| !belongs.contains(index))
         .filter_map(|(_, line)| line.ops.iter().copied().filter(|op| *op > end).min())
         .min();
+    let open = block.lines.iter().filter_map(|i| lines.get(*i)).flat_map(|line| line.ops.iter().copied()).min()?;
     if let Some(op) = neighbour.filter(|op| *op < after_text) {
-        let open = block.lines.iter().filter_map(|i| lines.get(*i)).flat_map(|line| line.ops.iter().copied()).min()?;
         // `BT` stays outside the marker. Both ends are inside the one text object.
         if open > start {
             return Some((open, None, op));
         }
     }
+    // The last paragraph of a shared text object has no neighbour after it. Opening at the
+    // shared `BT` would take the preceding paragraph into the marker. Open at this paragraph's
+    // first operator instead, and close before the shared `ET`, so both ends stay inside it.
+    let preceding =
+        lines.iter().enumerate().filter(|(index, _)| !belongs.contains(index)).any(|(_, line)| line.ops.iter().any(|op| *op > start && *op < open));
+    if preceding {
+        if let Some(et) = after_text.checked_sub(1).filter(|index| ops.get(*index).is_some_and(|op| op.op.as_slice() == b"ET"))
+            && open > start
+            && open < et
+        {
+            return Some((open, None, et));
+        }
+        return None;
+    }
     // `None` is the next-line index: the close is after this paragraph's `ET`, not at the
     // following line's `BT`.
     Some((start, None, after_text))
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 5ff2829e2f..a5a4fb3bec 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1914,8 +1914,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["text_paragraphs"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/automation/tests/it/automation.rs::paragraph_grouping_survives_save_and_reopen_through_tools", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_only_paragraph_stays_one_block", "crates/edit/src/tests.rs::a_partial_rewrite_closes_before_the_operator_that_follows_the_paragraph", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_last_marked_paragraph_stays_inside_its_region", "crates/edit/src/tests.rs::a_partial_rewrite_keeps_the_next_marked_region_closed", "crates/edit/src/tests.rs::a_partial_rewrite_of_an_unmarked_paragraph_leaves_the_marked_neighbour_closed", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_marked_region_leaves_the_neighbour_inside_it", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_text_object_keeps_the_neighbour", "crates/automation/tests/it/automation.rs::a_partial_rewrite_of_the_last_paragraph_stays_one_through_tools", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
-notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; a blank line (about twice the paragraph's own leading) stays a separate paragraph, and editing the first one leaves the next in place (#2517). An explicit TL is that leading. Without one, Td does not set it: three or more rows at one repeated step stay one paragraph, and a single wider gap stays a break. A rewrite marks the whole paragraph, including a row it leaves in the source, so adding a row does not absorb the next paragraph on a later edit. When the paragraph is the last text on the page, that marker closes after the paragraph's last ET, so a kept source row stays inside it. When the next paragraph shares that text object, the marker opens after BT and closes before the neighbour's text. The extra marker is not added when the paragraph is already one marked region and the next line is in a different region. Hyphenated line ends are joined. A row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it. Still open: a larger heading joined to smaller body lines (#1756) and cells in different columns (#1680, #2478). Two rows and no third step still cannot be told from a paragraph break when there is no TL."
+evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/automation/tests/it/automation.rs::paragraph_grouping_survives_save_and_reopen_through_tools", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_only_paragraph_stays_one_block", "crates/edit/src/tests.rs::a_partial_rewrite_closes_before_the_operator_that_follows_the_paragraph", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_last_marked_paragraph_stays_inside_its_region", "crates/edit/src/tests.rs::a_partial_rewrite_keeps_the_next_marked_region_closed", "crates/edit/src/tests.rs::a_partial_rewrite_of_an_unmarked_paragraph_leaves_the_marked_neighbour_closed", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_marked_region_leaves_the_neighbour_inside_it", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_text_object_keeps_the_neighbour", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_last_paragraph_in_one_text_object_keeps_the_one_before_it", "crates/automation/tests/it/automation.rs::a_partial_rewrite_of_the_last_paragraph_stays_one_through_tools", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
+notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; a blank line (about twice the paragraph's own leading) stays a separate paragraph, and editing the first one leaves the next in place (#2517). An explicit TL is that leading. Without one, Td does not set it: three or more rows at one repeated step stay one paragraph, and a single wider gap stays a break. A rewrite marks the whole paragraph, including a row it leaves in the source, so adding a row does not absorb the next paragraph on a later edit. When the paragraph is the last text on the page, that marker closes after the paragraph's last ET, so a kept source row stays inside it. When the next paragraph shares that text object, the marker opens after BT and closes before the neighbour's text. When the rewritten paragraph is the last one in that text object, the marker opens after the preceding paragraph and closes before the shared ET. The extra marker is not added when the paragraph is already one marked region and the next line is in a different region. Hyphenated line ends are joined. A row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it. Still open: a larger heading joined to smaller body lines (#1756) and cells in different columns (#1680, #2478). Two rows and no third step still cannot be told from a paragraph break when there is no TL."
 
 [[feature]]
 id = "edit.font-reuse-substitution"

From b282ec26be9f8d6a897473871d950c8673f0e1c8 Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Thu, 22 Oct 2026 23:02:52 +0200
Subject: [PATCH 122/270] M7: check a shared text object through the tools
 (#2517)

Editing either end of one text object, then saving and editing again, has to leave the other paragraph in place. The library tests did not drive text_edit and doc_save.
---
 crates/automation/tests/it/automation.rs | 40 ++++++++++++++++++++++++
 crates/edit/src/tests.rs                 | 31 ++++++++++++++++++
 parity/acrobat-features.toml             |  2 +-
 3 files changed, 72 insertions(+), 1 deletion(-)

diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 226796cfe4..942da54a95 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -9612,3 +9612,43 @@ fn a_partial_rewrite_of_the_last_paragraph_stays_one_through_tools() {
     ok(&mut a, "text_edit", json!({ "doc": reopened, "page": 1, "paragraph": 1, "text": "One.\nTwo." }));
     assert_eq!(paragraph_texts(&mut a, reopened), ["One. Two.", "Neighbor stays."]);
 }
+
+/// Both ends of one text object, through open / text_edit / save / reopen / text_extract.
+/// Editing the last paragraph must not take the one before it, and editing the first must
+/// not take the one after it. Incremental and full saves.
+#[test]
+fn a_shared_text_object_keeps_both_paragraphs_through_tools() {
+    let dir = workdir("shared-text-object");
+    let mut a = auto(&dir);
+    let body =
+        "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj T* T* (Neighbor stays.) Tj T* (Neighbor next.) Tj ET";
+    std::fs::write(dir.join("last.pdf"), helvetica_page(body)).unwrap();
+    let doc = ok(&mut a, "doc_open", json!({ "path": "last.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(paragraph_texts(&mut a, doc), ["Alpha first row. Alpha next row.", "Neighbor stays. Neighbor next."]);
+    ok(&mut a, "text_edit", json!({ "doc": doc, "page": 1, "paragraph": 2, "text": "Neighbor stays.\nChanged." }));
+    assert_eq!(paragraph_texts(&mut a, doc), ["Alpha first row. Alpha next row.", "Neighbor stays. Changed."]);
+    let incremental = ok(&mut a, "doc_save", json!({ "doc": doc, "path": "last.pdf" }));
+    assert_eq!(incremental["incremental"], true, "{incremental}");
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "last.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(paragraph_texts(&mut a, reopened), ["Alpha first row. Alpha next row.", "Neighbor stays. Changed."]);
+    ok(&mut a, "text_edit", json!({ "doc": reopened, "page": 1, "paragraph": 2, "text": "Neighbor stays.\nEdited." }));
+    let full = ok(&mut a, "doc_save", json!({ "doc": reopened, "path": "last-full.pdf", "full": true }));
+    assert_eq!(full["incremental"], false, "{full}");
+    let again = ok(&mut a, "doc_open", json!({ "path": "last-full.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(paragraph_texts(&mut a, again), ["Alpha first row. Alpha next row.", "Neighbor stays. Edited."]);
+    let extracted = page_text(&mut a, again);
+    assert!(extracted[0].contains("Alpha first row.") && extracted[0].contains("Edited."), "{extracted:?}");
+
+    std::fs::write(dir.join("first.pdf"), helvetica_page(body)).unwrap();
+    let doc = ok(&mut a, "doc_open", json!({ "path": "first.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "text_edit", json!({ "doc": doc, "page": 1, "paragraph": 1, "text": "Alpha first row.\nTwo\nThree" }));
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "first.pdf" }));
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "first.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(paragraph_texts(&mut a, reopened), ["Alpha first row. Two Three", "Neighbor stays. Neighbor next."]);
+    ok(&mut a, "text_edit", json!({ "doc": reopened, "page": 1, "paragraph": 1, "text": "Alpha first row.\nTwo\nFour" }));
+    ok(&mut a, "doc_save", json!({ "doc": reopened, "path": "first-full.pdf", "full": true }));
+    let again = ok(&mut a, "doc_open", json!({ "path": "first-full.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(paragraph_texts(&mut a, again), ["Alpha first row. Two Four", "Neighbor stays. Neighbor next."]);
+    let extracted = page_text(&mut a, again);
+    assert!(extracted[0].contains("Four") && extracted[0].contains("Neighbor stays."), "{extracted:?}");
+}
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 9cc8cf2177..7ba088722b 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -3007,6 +3007,37 @@ fn a_partial_rewrite_of_the_last_paragraph_in_one_text_object_keeps_the_one_befo
     }
 }
 
+/// Three paragraphs share one text object. Rewriting the middle one must leave the paragraph
+/// before it and the paragraph after it outside the marker.
+#[test]
+fn a_partial_rewrite_of_the_middle_paragraph_in_one_text_object_keeps_both_neighbours() {
+    let src = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (Alpha first row.) Tj T* (Alpha next row.) Tj \
+               T* T* (Mid stays.) Tj T* (Mid next.) Tj T* T* (End stays.) Tj T* (End next.) Tj ET";
+    let mut doc = text_page(src);
+    let texts = |doc: &Document| text::text_blocks(doc, 0).unwrap().into_iter().map(|b| b.text).collect::<Vec<_>>();
+    assert_eq!(
+        texts(&doc),
+        ["Alpha first row. Alpha next row.", "Mid stays. Mid next.", "End stays. End next."],
+        "each blank line is a paragraph break"
+    );
+    text::replace_block(&mut doc, 0, 1, "Mid stays.\nChanged.").unwrap();
+    let content = page_content(&doc);
+    assert_eq!(texts(&doc), ["Alpha first row. Alpha next row.", "Mid stays. Changed.", "End stays. End next."], "{content}");
+    let alpha = content.find("(Alpha first row.)").expect("the preceding paragraph");
+    let open = content.find("/P BMC").expect("marker");
+    let end = content.find("(End stays.)").expect("the following paragraph");
+    assert!(alpha < open, "the marker swallowed the preceding paragraph: {content}");
+    assert!(open < end, "the following paragraph is inside the marker: {content}");
+    let close = content[open..].find("EMC").map(|at| open + at).expect("close");
+    assert!(close < end, "the marker closed after the following paragraph: {content}");
+    for saved in [reopen(&doc), Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap()] {
+        assert_eq!(texts(&saved), ["Alpha first row. Alpha next row.", "Mid stays. Changed.", "End stays. End next."]);
+        let mut again = saved;
+        text::replace_block(&mut again, 0, 1, "Mid stays.\nEdited.").unwrap();
+        assert_eq!(texts(&reopen(&again)), ["Alpha first row. Alpha next row.", "Mid stays. Edited.", "End stays. End next."]);
+    }
+}
+
 /// #2516's published steps: adding a row must not make the next edit-by-number rewrite Charlie.
 /// The issue also asks for a stable paragraph id. That is #2508, and this test does not add one.
 #[test]
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index a5a4fb3bec..ca854bac90 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1914,7 +1914,7 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["text_paragraphs"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/automation/tests/it/automation.rs::paragraph_grouping_survives_save_and_reopen_through_tools", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_only_paragraph_stays_one_block", "crates/edit/src/tests.rs::a_partial_rewrite_closes_before_the_operator_that_follows_the_paragraph", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_last_marked_paragraph_stays_inside_its_region", "crates/edit/src/tests.rs::a_partial_rewrite_keeps_the_next_marked_region_closed", "crates/edit/src/tests.rs::a_partial_rewrite_of_an_unmarked_paragraph_leaves_the_marked_neighbour_closed", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_marked_region_leaves_the_neighbour_inside_it", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_text_object_keeps_the_neighbour", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_last_paragraph_in_one_text_object_keeps_the_one_before_it", "crates/automation/tests/it/automation.rs::a_partial_rewrite_of_the_last_paragraph_stays_one_through_tools", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
+evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::a_wrapped_list_item_keeps_its_continuation_and_the_items_after_it", "crates/edit/src/tests.rs::a_blank_line_keeps_the_next_paragraph", "crates/edit/src/tests.rs::a_grown_paragraph_does_not_swallow_the_next_one", "crates/automation/tests/it/automation.rs::a_blank_line_stays_a_separate_paragraph_through_tools", "crates/automation/tests/it/automation.rs::paragraph_grouping_survives_save_and_reopen_through_tools", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_only_paragraph_stays_one_block", "crates/edit/src/tests.rs::a_partial_rewrite_closes_before_the_operator_that_follows_the_paragraph", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_last_marked_paragraph_stays_inside_its_region", "crates/edit/src/tests.rs::a_partial_rewrite_keeps_the_next_marked_region_closed", "crates/edit/src/tests.rs::a_partial_rewrite_of_an_unmarked_paragraph_leaves_the_marked_neighbour_closed", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_marked_region_leaves_the_neighbour_inside_it", "crates/edit/src/tests.rs::a_partial_rewrite_inside_one_text_object_keeps_the_neighbour", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_last_paragraph_in_one_text_object_keeps_the_one_before_it", "crates/edit/src/tests.rs::a_partial_rewrite_of_the_middle_paragraph_in_one_text_object_keeps_both_neighbours", "crates/automation/tests/it/automation.rs::a_shared_text_object_keeps_both_paragraphs_through_tools", "crates/automation/tests/it/automation.rs::a_partial_rewrite_of_the_last_paragraph_stays_one_through_tools", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
 notes = "lines grouped into paragraphs by stream, font, size, left alignment and regular baseline spacing; a blank line (about twice the paragraph's own leading) stays a separate paragraph, and editing the first one leaves the next in place (#2517). An explicit TL is that leading. Without one, Td does not set it: three or more rows at one repeated step stay one paragraph, and a single wider gap stays a break. A rewrite marks the whole paragraph, including a row it leaves in the source, so adding a row does not absorb the next paragraph on a later edit. When the paragraph is the last text on the page, that marker closes after the paragraph's last ET, so a kept source row stays inside it. When the next paragraph shares that text object, the marker opens after BT and closes before the neighbour's text. When the rewritten paragraph is the last one in that text object, the marker opens after the preceding paragraph and closes before the shared ET. The extra marker is not added when the paragraph is already one marked region and the next line is in a different region. Hyphenated line ends are joined. A row opening with a list marker starts its own item, and the row a list item wraps onto continues it at its hanging indent, so editing one item never takes the items after it. Still open: a larger heading joined to smaller body lines (#1756) and cells in different columns (#1680, #2478). Two rows and no third step still cannot be told from a paragraph break when there is no TL."
 
 [[feature]]

From dbeb9fa96307b02bebe33c32f7d8283eb45c5804 Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Mon, 26 Oct 2026 13:04:27 +0100
Subject: [PATCH 123/270] M7: move a paragraph instead of rewriting it to
 trigger a stale-number regroup

wrap()'s own test for mixed exotic whitespace fed through it directly, bypassing the caller's CR/CRLF normalization, needed its expected value updated for #4199's keep-every-space design, landed on main after this branch's base.
---
 crates/automation/tests/it/automation.rs | 36 +++++++++++-------------
 crates/edit/src/text.rs                  |  3 ++
 2 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 942da54a95..cdef5dc5af 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -8962,8 +8962,8 @@ fn text_box_and_callout_fill_and_border_through_tools() {
 }
 
 /// Three paragraphs: Alpha (two rows), Bravo (one row) and Charlie (two rows), at the leading
-/// of #2516. A third Alpha row brings its last baseline within 2.5 × size of Bravo's, so the next
-/// read groups the two as one paragraph.
+/// of #2516. Alpha's last baseline is 35.6 pt above Bravo's; moving Alpha down 21.2 pt leaves
+/// 14.4 pt, Alpha's own leading, so the next read groups the two as one paragraph.
 fn three_paragraph_pdf() -> Vec<u8> {
     use pdfcraft_cos::{Dict, Document, ObjRef, Object, SaveOptions, Stream, write_full};
     use std::sync::Arc;
@@ -9012,6 +9012,10 @@ fn an_emptied_paragraph_does_not_pass_its_number_to_an_overlapping_neighbour() {
 /// #2516: a paragraph number names the paragraph `text_paragraphs` listed. When an edit regroups
 /// the page so that paragraph no longer exists on its own, the next edit by that number is
 /// refused. It used to rewrite whichever paragraph had taken the number, and that text was gone.
+///
+/// Moving Alpha down (no text change) is the regrouping edit: #2517 wraps a rewrite that adds or
+/// keeps rows in a marked region precisely so it can't be mistaken for a neighbour by geometry
+/// alone, so a text rewrite can no longer manufacture this scenario; a pure move still can.
 #[test]
 fn text_edit_refuses_a_paragraph_number_an_earlier_edit_regrouped() {
     let dir = workdir("text-edit-stale-number");
@@ -9023,12 +9027,9 @@ fn text_edit_refuses_a_paragraph_number_an_earlier_edit_regrouped() {
     assert!(listed["paragraphs"][1]["text"].as_str().unwrap().starts_with("Bravo"));
 
     // Listing again here would renumber the page, so the first edit's result says what moved.
-    let first = ok(
-        &mut a,
-        "text_edit",
-        json!({"doc":doc,"page":1,"paragraph":1,"text":"Alpha paragraph, first row.\nAlpha paragraph, second row.\nAlpha paragraph, a third row."}),
-    );
-    assert_eq!(first["stale_paragraphs"], json!([1, 2]), "the third row regroups Alpha with Bravo: {first}");
+    // Moving Alpha down by 21.2 pt brings its last row within 14.4 pt of Bravo, its own leading.
+    let first = ok(&mut a, "text_edit", json!({"doc":doc,"page":1,"paragraph":1,"dy":-21.2}));
+    assert_eq!(first["stale_paragraphs"], json!([1, 2]), "moving Alpha down regroups it with Bravo: {first}");
 
     // Paragraph 2 of the earlier listing was Bravo, which is now part of Alpha's paragraph.
     let stale = a.call("text_edit", &json!({"doc":doc,"page":1,"paragraph":2,"text":"Bravo paragraph, edited."}));
@@ -9043,13 +9044,14 @@ fn text_edit_refuses_a_paragraph_number_an_earlier_edit_regrouped() {
     assert!(relisted["paragraphs"][1]["text"].as_str().unwrap().starts_with("Charlie"));
     ok(&mut a, "text_edit", json!({"doc":doc,"page":1,"paragraph":2,"text":"Charlie paragraph, edited."}));
     let text = page_text(&mut a, doc).join(" ");
-    assert!(text.contains("Charlie paragraph, edited.") && text.contains("Alpha paragraph, a third row."), "{text}");
+    assert!(text.contains("Charlie paragraph, edited.") && text.contains("Alpha paragraph, second row."), "{text}");
     std::fs::remove_dir_all(dir).unwrap();
 }
 
 /// An edit that merges its paragraph into a neighbour leaves no paragraph of its own to follow:
 /// the merged one holds the edited text too, but rewriting it by the edited paragraph's number
-/// would drop the neighbour's text (#2516).
+/// would drop the neighbour's text (#2516). Moving Alpha down (see the previous test) is the
+/// regrouping edit, since a text rewrite is marked precisely so it cannot merge this way (#2517).
 #[test]
 fn text_edit_does_not_follow_a_paragraph_into_the_one_it_merged_with() {
     let dir = workdir("text-edit-merged-number");
@@ -9057,11 +9059,7 @@ fn text_edit_does_not_follow_a_paragraph_into_the_one_it_merged_with() {
     let mut a = auto(&dir);
     let doc = ok(&mut a, "doc_open", json!({"path":"p.pdf"}))["doc"].as_u64().unwrap();
     ok(&mut a, "text_paragraphs", json!({"doc":doc,"page":1}));
-    let first = ok(
-        &mut a,
-        "text_edit",
-        json!({"doc":doc,"page":1,"paragraph":1,"text":"Alpha paragraph, first row.\nAlpha paragraph, second row.\nAlpha paragraph, a third row."}),
-    );
+    let first = ok(&mut a, "text_edit", json!({"doc":doc,"page":1,"paragraph":1,"dy":-21.2}));
     assert!(first.get("paragraph").is_none(), "the result must not present the merged paragraph as the edited one: {first}");
 
     // Paragraph 1 was Alpha. Alpha now shares a paragraph with Bravo, so the number is refused.
@@ -9075,6 +9073,8 @@ fn text_edit_does_not_follow_a_paragraph_into_the_one_it_merged_with() {
 
 /// The editor background preview takes the same paragraph number as `text_edit`, so it hides the
 /// paragraph the number named in the listing and refuses a number an edit made stale (#2516).
+/// Moving Alpha down (see the two tests above) is the regrouping edit; a text rewrite is marked
+/// precisely so it cannot merge this way (#2517).
 #[test]
 fn page_render_hide_text_block_refuses_a_paragraph_number_an_earlier_edit_regrouped() {
     let dir = workdir("hide-text-block-stale-number");
@@ -9082,11 +9082,7 @@ fn page_render_hide_text_block_refuses_a_paragraph_number_an_earlier_edit_regrou
     let mut a = auto(&dir);
     let doc = ok(&mut a, "doc_open", json!({"path":"p.pdf"}))["doc"].as_u64().unwrap();
     ok(&mut a, "text_paragraphs", json!({"doc":doc,"page":1}));
-    ok(
-        &mut a,
-        "text_edit",
-        json!({"doc":doc,"page":1,"paragraph":1,"text":"Alpha paragraph, first row.\nAlpha paragraph, second row.\nAlpha paragraph, a third row."}),
-    );
+    ok(&mut a, "text_edit", json!({"doc":doc,"page":1,"paragraph":1,"dy":-21.2}));
 
     // Paragraph 2 of the listing was Bravo, now inside Alpha's paragraph; position 2 is Charlie.
     let stale = a.call("page_render", &json!({"doc":doc,"page":1,"dpi":72,"hide_text_block":2}));
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index 7bcff773a8..d815ee4282 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -218,6 +218,9 @@ mod tests {
         assert_eq!(wrapped("A　　B C", 4.0), ["A　　B", "C"]);
         assert_eq!(wrapped("A\u{a0}B C", 3.0), ["A B", "C"]);
         assert_eq!(wrapped("A\u{2028}B C", 3.0), ["A B", "C"]);
+        // `wrap` treats every whitespace character, including `\r`, as a separator to keep
+        // (#4199); the caller turns `\r\n` and `\r` into `\n` before calling it.
+        assert_eq!(wrapped(" \tA  B\r\nC ", 3.0), ["  A", "B ", "C "]);
     }
 
     #[test]

From 8a78fb21cfa0c643fadea9fa8118106c3488198d Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Mon, 26 Oct 2026 13:33:11 +0100
Subject: [PATCH 124/270] M3: translate the menu bar's own overflow sentinel to
 a glyph every font has
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

craft_menu writes "⋯" (U+22EF) itself for the menu of titles that don't fit, through the app's own label callback. No font this app ships or falls back to has that glyph, and egui 0.37's MissingGlyphPolicy::Panic crashes on it as soon as the bar is narrow enough to need it: every editing test that narrows the window while a paragraph is open hit this. The ordinary ellipsis the rest of the app already uses everywhere else is available and reads the same.
---
 crates/ui-egui/src/menus.rs | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/menus.rs b/crates/ui-egui/src/menus.rs
index b6dcc67858..49f2aeba1a 100644
--- a/crates/ui-egui/src/menus.rs
+++ b/crates/ui-egui/src/menus.rs
@@ -256,9 +256,13 @@ fn english(labeled: Labeled<'_>) -> Option<String> {
 }
 
 fn translate(english: &'static str) -> String {
-    // The bundled UI fonts do not all cover the menu's mathematical ellipsis.
+    // craft_menu's bar writes "⋯" (U+22EF, MIDLINE HORIZONTAL ELLIPSIS) itself, for the menu of
+    // titles that don't fit: a sentinel to translate, not an English phrase, and the only one of
+    // its four reserved labels no font this app ships or falls back to has a glyph for.
+    // MissingGlyphPolicy::Panic (egui 0.37) crashes on it. The ordinary ellipsis every other
+    // truncated label in this app already uses is in the bundled faces.
     if english == "\u{22ef}" {
-        return "...".to_owned();
+        return "…".to_owned();
     }
     tl!(english).to_owned()
 }
@@ -662,6 +666,22 @@ mod tests {
         bar.find(command).unwrap_or_else(|| panic!("{} is in the menus", command.key()))
     }
 
+    /// The bar's own overflow-menu sentinel is not rendered as typed: no font this app ships or
+    /// falls back to has U+22EF, and egui 0.37's `MissingGlyphPolicy::Panic` crashes on it when
+    /// the menu bar is narrow enough to need it. The editing tests that narrow the window while a
+    /// paragraph is open reproduce this end to end. The other three reserved labels are plain
+    /// ASCII, so untranslated is safe for them.
+    #[test]
+    fn the_overflow_menu_sentinel_is_not_passed_through_untranslated() {
+        crate::i18n::set_current(crate::i18n::Lang::EN);
+        let translated = translate("⋯");
+        assert_ne!(translated, "⋯", "no installed font has this glyph");
+        assert_eq!(translated, "…", "the ordinary ellipsis the rest of the app already uses");
+        for label in ["Menu", "Scroll menu up", "Scroll menu down"] {
+            assert_eq!(translate(label), label, "plain ASCII reserved labels need no substitution");
+        }
+    }
+
     #[test]
     fn every_menu_command_is_listed_once_with_its_shortcut() {
         let (app, ctx) = app(&["a.pdf"]);

From bb7186d87c71c05228f879e8ba1cfd5910484583 Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Wed, 28 Oct 2026 16:26:05 +0100
Subject: [PATCH 125/270] M7: restore the exact gap a wrap consumed, not a
 guessed space (#2517)

wrap() already dropped the whole gap at a wrap point (#4199); rejoining it always guessed a single space back, so two or more typed spaces silently became one, and a Chinese/Japanese word split (which has no space of its own) could gain a spurious one. wrap() now records how many separator characters it consumed at each wrap (0 for a CJK split); the /PCSoft marker carries it as /N (a file saved before this, or by another writer, reads as 1); reflow_text and the mixed-style row editor insert exactly that many spaces back instead of assuming one.
---
 crates/edit/src/tests.rs                 |  53 +++++++++
 crates/edit/src/text.rs                  |  21 +++-
 crates/edit/src/text/blocks.rs           |  21 +++-
 crates/edit/src/text/interp.rs           |  21 ++++
 crates/edit/src/text/lines.rs            |   2 +
 crates/edit/src/text/rewrite.rs          |  29 +++--
 crates/edit/src/text_regions/grouping.rs |  33 +++---
 crates/edit/src/text_regions/styled.rs   | 137 +++++++++++++++--------
 8 files changed, 240 insertions(+), 77 deletions(-)

diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 7ba088722b..5491dfca43 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -3283,6 +3283,59 @@ fn a_wrapped_line_rejoins_when_widened_and_a_typed_break_stays() {
     assert_eq!(text::text_blocks(&typed, 0).unwrap()[0].editor_text, "One\nTwo\nThree\nfour");
 }
 
+/// #2529 (reviewer): a run of typed spaces that happens to fall at a wrap point is not the same
+/// as the single space an ordinary word gap leaves. Narrowing drops the whole gap, as any wrap
+/// does (#4199's own test: `wrapped("aa  bb  cc", 6.0) == ["aa  bb", "cc"]`); widening it back
+/// must not quietly turn two typed spaces into one.
+#[test]
+fn narrowing_then_widening_keeps_a_typed_double_space() {
+    let mut doc = text_page("BT /F1 24 Tf 20 150 Td (One  Two) Tj ET");
+    let wide = text::text_blocks(&doc, 0).unwrap().into_iter().next().unwrap().rect;
+    let wide_width = wide[2] - wide[0];
+    text::rewrite_block(&mut doc, 0, 0, None, &text::BlockStyle { width: Some(45.0), ..Default::default() }).unwrap();
+    let block = text::text_blocks(&doc, 0).unwrap().into_iter().next().unwrap();
+    assert_eq!(block.editor_text, "One\nTwo", "the narrow box did not wrap between the two typed spaces: {}", block.editor_text);
+    text::rewrite_block(&mut doc, 0, 0, Some(&block.reflow_text), &text::BlockStyle { width: Some(wide_width), ..Default::default() }).unwrap();
+    let rewidened = text::text_blocks(&doc, 0).unwrap().into_iter().next().unwrap();
+    assert_eq!(rewidened.editor_text, "One  Two", "the second typed space was lost: {:?}", rewidened.editor_text);
+}
+
+/// #2529: a Chinese/Japanese word split has no space of its own (`wrap`'s own doc comment: "those
+/// pieces join without a space"). Narrowing a paragraph until it wraps inside such a word, then
+/// widening it back, must restore the two pieces exactly as they were, not insert a space between
+/// them. Checked on both the single-style rewrite path and the row-editor (mixed-style) path.
+#[test]
+fn narrowing_then_widening_a_japanese_word_adds_no_space() {
+    if pdfcraft_fonts::document_japanese_font().is_none() {
+        eprintln!("skipping narrowing_then_widening_a_japanese_word_adds_no_space: built without craft-fonts (set CRAFT_FONTS_DIR)");
+        return;
+    }
+    let text = "日本語の文章です";
+    for draft in [text.to_string(), format!("見出し\n{text}")] {
+        let mut doc = text_page("BT /F1 12 Tf 72 700 Td (Placeholder text) Tj ET");
+        text::rewrite_block(&mut doc, 0, 0, Some(&draft), &text::BlockStyle { width: Some(400.0), ..Default::default() }).unwrap();
+        let wide = text::text_blocks(&reopen(&doc), 0).unwrap().into_iter().next().unwrap();
+        let wide_width = wide.rect[2] - wide.rect[0];
+
+        // Narrow enough to force a wrap inside the Japanese word, not just between the two rows.
+        // A width-only change must pass `reflow_text` explicitly, as the editor UI does: `None`
+        // falls back to the paragraph's space-joined display text and would not keep a typed break.
+        text::rewrite_block(&mut doc, 0, 0, Some(&wide.reflow_text), &text::BlockStyle { width: Some(60.0), ..Default::default() }).unwrap();
+        let narrow = text::text_blocks(&reopen(&doc), 0).unwrap().into_iter().next().unwrap();
+        assert!(narrow.rows.len() > draft.matches('\n').count() + 1, "the narrow box did not wrap: {:?}", narrow.editor_text);
+        assert_eq!(
+            narrow.editor_text.replace('\n', ""),
+            draft.replace('\n', ""),
+            "wrapping must not add or drop characters: {:?}",
+            narrow.editor_text
+        );
+
+        text::rewrite_block(&mut doc, 0, 0, Some(&narrow.reflow_text), &text::BlockStyle { width: Some(wide_width), ..Default::default() }).unwrap();
+        let rewidened = text::text_blocks(&reopen(&doc), 0).unwrap().into_iter().next().unwrap();
+        assert_eq!(rewidened.editor_text, draft, "a Japanese word split gained a space it never had: {:?}", rewidened.editor_text);
+    }
+}
+
 /// A file that did not mark its breaks still rejoins a line that fills the measure, and keeps a
 /// short line that had room.
 #[test]
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index d815ee4282..b366e36f4d 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -122,6 +122,10 @@ pub struct TextLine {
     soft_break: bool,
     /// This line starts after a break a rewrite kept on purpose (`/PCHard`).
     hard_break: bool,
+    /// When `soft_break`: the exact number of separator characters the wrap consumed (0 for a
+    /// Chinese/Japanese word split), from `/PCSoft`'s `/N`; 1 when the marker carried none
+    /// (#2529). Meaningless otherwise.
+    soft_gap: usize,
 }
 
 impl TextLine {
@@ -210,7 +214,7 @@ mod tests {
     }
 
     fn wrapped(text: &str, width: f64) -> Vec<String> {
-        wrap(text, width, |s| s.chars().count() as f64).into_iter().map(|(line, _)| line).collect()
+        wrap(text, width, |s| s.chars().count() as f64).into_iter().map(|(line, _, _)| line).collect()
     }
 
     #[test]
@@ -226,8 +230,19 @@ mod tests {
     #[test]
     fn a_wrap_is_marked_soft_and_a_newline_is_not() {
         let width = |s: &str| s.chars().count() as f64;
-        assert_eq!(wrap("Page 1", 5.0, width), [("Page".into(), false), ("1".into(), true)]);
-        assert_eq!(wrap("One\nTwo", 10.0, width), [("One".into(), false), ("Two".into(), false)]);
+        assert_eq!(wrap("Page 1", 5.0, width), [("Page".into(), false, 0), ("1".into(), true, 1)]);
+        assert_eq!(wrap("One\nTwo", 10.0, width), [("One".into(), false, 0), ("Two".into(), false, 0)]);
+    }
+
+    /// #2529: a run of spaces that happens to fall at a wrap point is recorded exactly, not
+    /// assumed to be one space; a Chinese/Japanese word split, which has no space of its own,
+    /// is recorded as none.
+    #[test]
+    fn a_wrap_records_how_many_spaces_it_consumed() {
+        let width = |s: &str| s.chars().count() as f64;
+        assert_eq!(wrap("One  Two", 5.0, width), [("One".into(), false, 0), ("Two".into(), true, 2)]);
+        assert_eq!(wrap("One   Two", 5.0, width), [("One".into(), false, 0), ("Two".into(), true, 3)]);
+        assert_eq!(wrap("日本語の文章です", 3.0, width), [("日本語".into(), false, 0), ("の文章".into(), true, 0), ("です".into(), true, 0)]);
     }
 
     /// #4199: a run of spaces stays a run, before, between and after words; the spaces where a
diff --git a/crates/edit/src/text/blocks.rs b/crates/edit/src/text/blocks.rs
index 2785f87676..d6dcc585f1 100644
--- a/crates/edit/src/text/blocks.rs
+++ b/crates/edit/src/text/blocks.rs
@@ -340,13 +340,18 @@ pub(crate) fn paragraph_separator(c: char) -> bool {
 /// new line. A row may also end inside a word of Chinese or Japanese text ([`crate::linebreak`]);
 /// those pieces join without a space. Every white-space character is written as one space, so
 /// a run of spaces typed between, before or after words stays (#4199); only the spaces where a
-/// row wraps are dropped. The bool is true when the line continues the previous one because the
-/// next word did not fit, rather than because of a newline.
-pub(super) fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec<(String, bool)> {
+/// row wraps are dropped (recorded as the third value, so a later rejoin can restore the exact
+/// count instead of guessing one, #2529). The bool is true when the line continues the previous
+/// one because the next word did not fit, rather than because of a newline; the number is how
+/// many separator characters stood where that wrap fell (0 for a Chinese/Japanese word split,
+/// which has no space of its own; meaningless when the bool is false).
+pub(super) fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec<(String, bool, usize)> {
     let mut out = Vec::new();
     for row in text.split('\n') {
         let mut line = String::new();
         let mut soft = false;
+        // The gap consumed right before `line` started: 0 until a wrap sets it.
+        let mut wrap_gap = 0usize;
         let start = out.len();
         // The separators read since the last word: each one boundary between `split` pieces.
         let mut gap = 0usize;
@@ -357,13 +362,17 @@ pub(super) fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec
             if word.is_empty() {
                 continue;
             }
-            let spaces = " ".repeat(std::mem::take(&mut gap));
+            let gap_here = std::mem::take(&mut gap);
+            let spaces = " ".repeat(gap_here);
             for (i, piece) in crate::linebreak::pieces(word).into_iter().enumerate() {
                 let candidate = if i == 0 { format!("{line}{spaces}{piece}") } else { format!("{line}{piece}") };
                 // A row holding only the spaces that indent it doesn't wrap before its first word.
                 if line.chars().any(|c| c != ' ') && advance(&candidate) > width {
-                    out.push((std::mem::take(&mut line), soft));
+                    out.push((std::mem::take(&mut line), soft, wrap_gap));
                     soft = true;
+                    // A mid-word piece (i > 0) had no separator of its own; the first piece of a
+                    // word had exactly the separators just taken.
+                    wrap_gap = if i == 0 { gap_here } else { 0 };
                     line = piece.to_string();
                 } else {
                     line = candidate;
@@ -372,7 +381,7 @@ pub(super) fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec
         }
         line.push_str(&" ".repeat(gap));
         if !line.is_empty() || out.len() == start {
-            out.push((line, soft));
+            out.push((line, soft, wrap_gap));
         }
     }
     out
diff --git a/crates/edit/src/text/interp.rs b/crates/edit/src/text/interp.rs
index e3e4bf26b3..73ca1b1424 100644
--- a/crates/edit/src/text/interp.rs
+++ b/crates/edit/src/text/interp.rs
@@ -304,6 +304,11 @@ pub(super) struct Shown {
     /// Set when a `/PCSoft` or `/PCHard` marker was seen since the previous text line.
     pub(super) soft_break: bool,
     pub(super) hard_break: bool,
+    /// The `/N` a `/PCSoft` marker carried: how many separator characters the wrap consumed (0
+    /// for a Chinese/Japanese word split). Meaningless unless `soft_break` is set; 1 for a
+    /// `/PCSoft` with no `/N` (a file saved before this was tracked, or by another writer),
+    /// matching the single space a rejoin always used before #2529.
+    pub(super) soft_gap: usize,
 }
 
 impl Shown {
@@ -554,6 +559,7 @@ struct TextRunState<'a> {
     out: &'a mut Vec<Shown>,
     soft_break: bool,
     hard_break: bool,
+    soft_gap: usize,
 }
 
 fn show_text(op: &Op, i: usize, state: &mut TextRunState<'_>) -> Result<(), EditError> {
@@ -752,6 +758,7 @@ fn show_text(op: &Op, i: usize, state: &mut TextRunState<'_>) -> Result<(), Edit
         actual_text: false,
         soft_break: state.soft_break,
         hard_break: state.hard_break,
+        soft_gap: state.soft_gap,
     });
     Ok(())
 }
@@ -780,6 +787,10 @@ pub(super) fn interpret(
     // before the next line. Neither name is a paragraph region, so it does not change scope.
     let mut soft_break = false;
     let mut hard_break = false;
+    // `/PCSoft`'s `/N` property: how many separator characters the wrap consumed. A `/PCSoft`
+    // with no properties dict (a file saved before this was tracked, or by another writer) reads
+    // as 1, the single space a rejoin always used before #2529.
+    let mut soft_gap = 1usize;
     for (i, op) in ops.iter().enumerate() {
         match op.op.as_slice() {
             // No depth cap: every `EMC` pops, so a capped push would pair it with the enclosing
@@ -788,6 +799,14 @@ pub(super) fn interpret(
                 if op.name(0) == Some(b"PCSoft") {
                     soft_break = true;
                     hard_break = false;
+                    soft_gap = op
+                        .operands
+                        .get(1)
+                        .and_then(Object::as_dict)
+                        .and_then(|d| d.get(b"N"))
+                        .and_then(Object::as_int)
+                        .and_then(|n| usize::try_from(n).ok())
+                        .unwrap_or(1);
                 } else if op.name(0) == Some(b"PCHard") {
                     hard_break = true;
                     soft_break = false;
@@ -908,6 +927,7 @@ pub(super) fn interpret(
                     out: &mut out,
                     soft_break,
                     hard_break,
+                    soft_gap,
                 };
                 show_text(op, i, &mut state)?;
                 // A numeric-only TJ adjustment shows no glyphs and pushes nothing: the break
@@ -915,6 +935,7 @@ pub(super) fn interpret(
                 if out.len() > before {
                     soft_break = false;
                     hard_break = false;
+                    soft_gap = 1;
                 }
             }
             _ => {}
diff --git a/crates/edit/src/text/lines.rs b/crates/edit/src/text/lines.rs
index 78aec5090f..f811f34ea6 100644
--- a/crates/edit/src/text/lines.rs
+++ b/crates/edit/src/text/lines.rs
@@ -282,6 +282,7 @@ fn text_lines_in(doc: &Document, p: &pdfcraft_model::Page, actual_text: bool) ->
                 runs: vec![(s.text.clone(), s.ink.len(), false)],
                 soft_break: s.soft_break,
                 hard_break: s.hard_break,
+                soft_gap: s.soft_gap,
                 ops: std::iter::once(s.op).chain(s.extra_ops.iter().copied()).collect(),
                 origin: Origin {
                     tm: s.tm.0,
@@ -398,6 +399,7 @@ fn add_shown(lines: &mut Vec<TextLine>, last: &mut Option<Pen>, s: Shown, stream
             runs: vec![(s.text.clone(), s.ink.len(), false)],
             soft_break: s.soft_break,
             hard_break: s.hard_break,
+            soft_gap: s.soft_gap,
             ops: std::iter::once(s.op).chain(s.extra_ops.iter().copied()).collect(),
             origin: Origin {
                 tm: s.tm.0,
diff --git a/crates/edit/src/text/rewrite.rs b/crates/edit/src/text/rewrite.rs
index 9589fad226..4b6944deeb 100644
--- a/crates/edit/src/text/rewrite.rs
+++ b/crates/edit/src/text/rewrite.rs
@@ -578,27 +578,38 @@ impl LineWriter<'_> {
         }
     }
 
-    /// Writes one wrapped line, returning its underline (x0, x1, y) in text space.
+    /// Writes one wrapped line, returning its underline (x0, x1, y) in text space. `wrap`: whether
+    /// this line continues the previous one because a word did not fit, and, when it does, how
+    /// many separator characters the wrap consumed (0 for a Chinese/Japanese word split).
     fn write_line(
         &self,
         index: usize,
         line: &str,
-        soft: bool,
+        wrap: (bool, usize),
         last: bool,
         cursor: &mut LineCursor,
         ops: &mut Vec<Op>,
     ) -> Result<(f64, f64, f64), EditError> {
         let n = pdfcraft_content::num;
+        let (soft, gap) = wrap;
         let body = line.trim_matches(' ');
         let interior = body.matches(' ').count();
         let tw = self.stretch(body, last);
         let (shown, visible) = self.shown(line, body, tw);
         let dx = if tw > 0.0 { 0.0 } else { self.alignment.offset(visible) };
         if index > 0 {
-            // Inside this text object, so the marker starts and ends here. `/PCSoft` rejoins
-            // when the box widens. `/PCHard` is a newline that was already in the text.
-            let name = if soft { "PCSoft" } else { "PCHard" };
-            ops.push(Op::new("BMC", vec![Object::name(name)]));
+            // Inside this text object, so the marker starts and ends here. `/PCHard` is a newline
+            // that was already in the text. `/PCSoft` rejoins when the box widens, with `/N` the
+            // exact number of separator characters the wrap consumed (0 for a Chinese/Japanese
+            // word split), so a rejoin restores what was actually there instead of guessing a
+            // single space and silently dropping the rest of a typed run (#2529).
+            if soft {
+                let mut properties = Dict::new();
+                properties.set(b"N".to_vec(), Object::Int(i64::try_from(gap).unwrap_or(i64::MAX)));
+                ops.push(Op::new("BDC", vec![Object::name("PCSoft"), Object::Dict(properties)]));
+            } else {
+                ops.push(Op::new("BMC", vec![Object::name("PCHard")]));
+            }
             ops.push(Op::new("EMC", vec![]));
         }
         if index > 0 || dx != 0.0 {
@@ -648,11 +659,11 @@ impl LineWriter<'_> {
     }
 
     /// Writes every wrapped line, returning their underlines.
-    fn write_all(&self, wrapped: &[(String, bool)], cursor: &mut LineCursor, ops: &mut Vec<Op>) -> Result<Vec<(f64, f64, f64)>, EditError> {
+    fn write_all(&self, wrapped: &[(String, bool, usize)], cursor: &mut LineCursor, ops: &mut Vec<Op>) -> Result<Vec<(f64, f64, f64)>, EditError> {
         wrapped
             .iter()
             .enumerate()
-            .map(|(i, (line, soft))| self.write_line(i, line, *soft, i + 1 == wrapped.len(), cursor, ops))
+            .map(|(i, (line, soft, gap))| self.write_line(i, line, (*soft, *gap), i + 1 == wrapped.len(), cursor, ops))
             .collect()
     }
 }
@@ -672,7 +683,7 @@ struct BlockPlan<'a> {
     underline: bool,
 }
 
-fn block_ops(plan: &BlockPlan<'_>, writer: &LineWriter<'_>, wrapped: &[(String, bool)], show_font: String) -> Result<Vec<Op>, EditError> {
+fn block_ops(plan: &BlockPlan<'_>, writer: &LineWriter<'_>, wrapped: &[(String, bool, usize)], show_font: String) -> Result<Vec<Op>, EditError> {
     let n = pdfcraft_content::num;
     let mut ops = vec![Op::new("q", vec![])];
     ops.extend(reveal_ops(plan.block, plan.lines, plan.style, plan.emit.ctm)?);
diff --git a/crates/edit/src/text_regions/grouping.rs b/crates/edit/src/text_regions/grouping.rs
index df281eb922..26f9343397 100644
--- a/crates/edit/src/text_regions/grouping.rs
+++ b/crates/edit/src/text_regions/grouping.rs
@@ -365,14 +365,17 @@ fn reflow_text(block: &TextBlock, lines: &[TextLine]) -> String {
     let mut out = String::new();
     for (index, part) in parts.iter().enumerate() {
         if index > 0 {
-            if break_is_soft(block, lines, index) {
-                if out.ends_with('-') {
+            match break_gap(block, lines, index) {
+                Some(_) if out.ends_with('-') => {
                     out.pop();
-                } else if !out.ends_with(char::is_whitespace) {
-                    out.push(' ');
                 }
-            } else {
-                out.push('\n');
+                // `gap` is the exact number of separator characters the wrap consumed (0 for a
+                // Chinese/Japanese word split, which has no space of its own) when the marker or
+                // the source recorded it; a line already ending in whitespace is left alone so a
+                // row whose own text kept a trailing space isn't doubled.
+                Some(gap) if !out.ends_with(char::is_whitespace) => out.push_str(&" ".repeat(gap)),
+                Some(_) => {}
+                None => out.push('\n'),
             }
         }
         out.push_str(part);
@@ -380,20 +383,24 @@ fn reflow_text(block: &TextBlock, lines: &[TextLine]) -> String {
     out
 }
 
-fn break_is_soft(block: &TextBlock, lines: &[TextLine], row_index: usize) -> bool {
-    let Some(line) = block.rows.get(row_index).and_then(|row| row.first()).and_then(|i| lines.get(*i)) else { return false };
+/// `None`: a hard break, kept as a newline. `Some(gap)`: a soft wrap, rejoined with exactly `gap`
+/// spaces — the count a `/PCSoft` marker recorded ([`TextLine::soft_gap`]), or, for a line this
+/// app did not mark (a file written elsewhere, or an older save), a single space when the
+/// geometry looks like an ordinary wrapped body line (`#2529`).
+fn break_gap(block: &TextBlock, lines: &[TextLine], row_index: usize) -> Option<usize> {
+    let line = block.rows.get(row_index).and_then(|row| row.first()).and_then(|i| lines.get(*i))?;
     if line.hard_break {
-        return false;
+        return None;
     }
     if line.soft_break {
-        return true;
+        return Some(line.soft_gap);
     }
-    let Some(prev) = block.rows.get(row_index.wrapping_sub(1)).and_then(|row| row_rect(row, lines)) else { return false };
-    let Some(next) = block.rows.get(row_index).and_then(|row| row_rect(row, lines)) else { return false };
+    let prev = block.rows.get(row_index.wrapping_sub(1)).and_then(|row| row_rect(row, lines))?;
+    let next = block.rows.get(row_index).and_then(|row| row_rect(row, lines))?;
     let size = line.size.max(1.0);
     let slack = block.rect[2] - prev[2];
     let width = prev[2] - prev[0];
     // Short rows define the right edge by their own letters. A body line that fills the
     // measure leaves almost no room for the next word.
-    slack <= size * 0.75 && width >= size * 8.0 && (next[2] - next[0]) + size * 0.25 > slack
+    (slack <= size * 0.75 && width >= size * 8.0 && (next[2] - next[0]) + size * 0.25 > slack).then_some(1)
 }
diff --git a/crates/edit/src/text_regions/styled.rs b/crates/edit/src/text_regions/styled.rs
index be7e627ba6..ea18a2a21a 100644
--- a/crates/edit/src/text_regions/styled.rs
+++ b/crates/edit/src/text_regions/styled.rs
@@ -405,12 +405,17 @@ fn wrap_styled_rows(
     chars: &[StyledChar],
     width: f64,
     measure: impl Fn(&[StyledChar]) -> Result<f64, EditError>,
-) -> Result<(StyledRows, RowRanges, Vec<bool>), EditError> {
+) -> Result<(StyledRows, RowRanges, Vec<bool>, Vec<usize>), EditError> {
     let mut rows: Vec<Vec<StyledChar>> = Vec::new();
     let mut row_ranges = Vec::new();
     // True when this row starts because the previous word did not fit, not because of a newline.
     let mut row_soft = Vec::new();
     let mut next_soft = false;
+    // How many separator characters a wrap trimmed off the row that just ended, for the row
+    // about to start (0 for a Chinese/Japanese word split, which trims none; meaningless unless
+    // the row it belongs to is soft). Mirrors `next_soft`.
+    let mut row_gap = Vec::new();
+    let mut next_gap = 0usize;
     let mut row_start = 0;
     let mut row = Vec::new();
     let mut row_width = 0.0;
@@ -424,6 +429,8 @@ fn wrap_styled_rows(
         if item.0 == '\n' {
             row_soft.push(next_soft);
             next_soft = false;
+            row_gap.push(next_gap);
+            next_gap = 0;
             row_ranges.push(row_start..row_start + row.len());
             rows.push(std::mem::take(&mut row));
             row_width = 0.0;
@@ -444,11 +451,15 @@ fn wrap_styled_rows(
         let word = chars.get(at..end).unwrap_or_default();
         let word_width = measure(word)?;
         if !row.is_empty() && !item.0.is_whitespace() && row_width + word_width > width + 0.5 {
+            let mut trimmed = 0usize;
             while row.last().is_some_and(|c: &StyledChar| c.0.is_whitespace()) {
                 row.pop();
+                trimmed += 1;
             }
             row_soft.push(next_soft);
             next_soft = true;
+            row_gap.push(next_gap);
+            next_gap = trimmed;
             row_ranges.push(row_start..row_start + row.len());
             rows.push(std::mem::take(&mut row));
             row_width = 0.0;
@@ -460,10 +471,11 @@ fn wrap_styled_rows(
     }
     if !row.is_empty() {
         row_soft.push(next_soft);
+        row_gap.push(next_gap);
         row_ranges.push(row_start..row_start + row.len());
         rows.push(row);
     }
-    Ok((rows, row_ranges, row_soft))
+    Ok((rows, row_ranges, row_soft, row_gap))
 }
 
 fn apply_range_styles<'a>(
@@ -745,6 +757,78 @@ fn rewrite_anchor<'a>(
     RewriteAnchor { lead, drop, start, split }
 }
 
+/// Open (`op` is `"BMC"`) or close (`"EMC"`) the `/P` marker that wraps the whole rewrite when
+/// `marked` (every row is in this rewrite, see [`rewrite_styled_block`]), so the paragraph
+/// cannot be mistaken for a neighbour by geometry alone (#2517).
+fn push_whole_paragraph_marker(block_ops: &mut Vec<Op>, marked: bool, op: &str) {
+    if !marked {
+        return;
+    }
+    let operands = if op == "BMC" { vec![Object::name("P")] } else { Vec::new() };
+    block_ops.push(Op::new(op, operands));
+}
+
+/// An empty marker between two rows of one rewrite. `/PCHard` is a newline that was already in
+/// the text. `/PCSoft` is a wrap and rejoins when the box widens, with `/N` the exact number of
+/// separator characters it consumed (0 for a Chinese/Japanese word split), so a rejoin restores
+/// what was actually there instead of guessing a single space (#2529). Neither is a paragraph
+/// region, so the lines stay in one scope.
+fn push_row_break_marker(block_ops: &mut Vec<Op>, row_soft: &[bool], row_gap: &[usize], row_index: usize) {
+    if row_soft.get(row_index).copied().unwrap_or(false) {
+        let mut properties = Dict::new();
+        let gap = row_gap.get(row_index).copied().unwrap_or(1);
+        properties.set(b"N".to_vec(), Object::Int(i64::try_from(gap).unwrap_or(i64::MAX)));
+        block_ops.push(Op::new("BDC", vec![Object::name("PCSoft"), Object::Dict(properties)]));
+    } else {
+        block_ops.push(Op::new("BMC", vec![Object::name("PCHard")]));
+    }
+    block_ops.push(Op::new("EMC", vec![]));
+}
+
+/// [`splice`] with the rewritten rows spliced in at `at`, and (when `marker` names one) a `/P`
+/// marker opened at its start and closed at its `next` line or, when nothing follows, after the
+/// paragraph's own last `ET` (appended past the stream's last operator when that close is at or
+/// beyond `ops.len()`, since `splice`'s callback never visits that index).
+fn splice_with_marker(
+    pieces: &Pieces,
+    ops: &[Op],
+    marker: Option<(usize, Option<usize>, usize)>,
+    at: usize,
+    mut block_ops: Vec<Op>,
+    drop: &std::collections::HashSet<usize>,
+) -> Vec<Vec<u8>> {
+    let data = splice(pieces, ops, |i| {
+        let mut insert = Vec::new();
+        if let Some((start_at, next, close)) = marker {
+            if i == start_at {
+                insert.push(Op::new("BMC", vec![Object::name("P")]));
+            }
+            if next.is_none() && i == close {
+                insert.push(Op::new("EMC", vec![]));
+            }
+            if next == Some(i) {
+                insert.push(Op::new("EMC", vec![]));
+            }
+        }
+        if i == at {
+            insert.append(&mut block_ops);
+        }
+        (insert, !drop.contains(&i))
+    });
+    if !marker.is_some_and(|(_, next, close)| next.is_none() && close >= ops.len()) {
+        return data;
+    }
+    let mut data = data;
+    if let Some(last) = data.last_mut() {
+        if last.last().is_some_and(|byte| !byte.is_ascii_whitespace()) {
+            last.push(b'\n');
+        }
+        // `splice` never visits `ops.len()`, so a close after the final operator is appended.
+        last.extend_from_slice(&pdfcraft_content::serialize_ops(&[Op::new("EMC", vec![])]));
+    }
+    data
+}
+
 /// Rewrite visual rows while keeping the source style on each surviving character. Resource
 /// names may differ between Unicode subsets of the same face; encoding searches those subsets.
 pub(crate) fn rewrite_styled_block(
@@ -856,7 +940,7 @@ pub(crate) fn rewrite_styled_block(
         }
         Ok(width)
     };
-    let (rows, row_ranges, row_soft) = wrap_styled_rows(&chars, width, measure)?;
+    let (rows, row_ranges, row_soft, row_gap) = wrap_styled_rows(&chars, width, measure)?;
     let streams = content_streams(doc, &p.dict)?;
     let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
     let ops = pieces.parse().ops;
@@ -895,9 +979,7 @@ pub(crate) fn rewrite_styled_block(
     // scope so the neighbour stays out (#2517). A row left in the source stream cannot share
     // that marker, so it is omitted and geometry groups those rows as before.
     let marked = kept.iter().all(|row| !*row);
-    if marked {
-        block_ops.push(Op::new("BMC", vec![Object::name("P")]));
-    }
+    push_whole_paragraph_marker(&mut block_ops, marked, "BMC");
     let crop = p.crop(doc);
     let centered = is_centred(block, lines, (crop[0] + crop[2]) / 2.0, first.size);
     let source_leading = block
@@ -926,12 +1008,7 @@ pub(crate) fn rewrite_styled_block(
             continue;
         }
         if !row.is_empty() && row_index > 0 {
-            // An empty marker between lines. `/PCSoft` is a wrap and rejoins when the box
-            // widens. `/PCHard` is a newline that was already in the text. Neither is a
-            // paragraph region, so the lines stay in one scope.
-            let name = if row_soft.get(row_index).copied().unwrap_or(false) { "PCSoft" } else { "PCHard" };
-            block_ops.push(Op::new("BMC", vec![Object::name(name)]));
-            block_ops.push(Op::new("EMC", vec![]));
+            push_row_break_marker(&mut block_ops, &row_soft, &row_gap, row_index);
         }
         let w = measured.get(row_index).copied().unwrap_or(0.0);
         let align = style.align.unwrap_or(if centered { crate::added::Align::Center } else { crate::added::Align::Left });
@@ -1076,9 +1153,7 @@ pub(crate) fn rewrite_styled_block(
             style.line_spacing.unwrap_or(1.5).clamp(0.5, 5.0) * style.size.unwrap_or(anchor.size)
         };
     }
-    if marked {
-        block_ops.push(Op::new("EMC", vec![]));
-    }
+    push_whole_paragraph_marker(&mut block_ops, marked, "EMC");
     block_ops.push(Op::new("Q", vec![]));
     block_ops.extend(after.ops());
     if split {
@@ -1091,37 +1166,7 @@ pub(crate) fn rewrite_styled_block(
     // safe. The close is not part of `block_ops`: that vector can end inside a text object
     // when the rewrite splits one, and a kept row's operators come later in the stream.
     let marker = if marked { None } else { paragraph_marker(block, lines, &ops) };
-    let data = splice(&pieces, &ops, |i| {
-        let mut insert = Vec::new();
-        if let Some((start_at, next, close)) = marker {
-            if i == start_at {
-                insert.push(Op::new("BMC", vec![Object::name("P")]));
-            }
-            if next.is_none() && i == close {
-                insert.push(Op::new("EMC", vec![]));
-            }
-            if next == Some(i) {
-                insert.push(Op::new("EMC", vec![]));
-            }
-        }
-        if i == at {
-            insert.append(&mut block_ops);
-        }
-        (insert, !drop.contains(&i))
-    });
-    let data = if marker.is_some_and(|(_, next, close)| next.is_none() && close >= ops.len()) {
-        let mut data = data;
-        if let Some(last) = data.last_mut() {
-            if last.last().is_some_and(|byte| !byte.is_ascii_whitespace()) {
-                last.push(b'\n');
-            }
-            // `splice` never visits `ops.len()`, so a close after the final operator is appended.
-            last.extend_from_slice(&pdfcraft_content::serialize_ops(&[Op::new("EMC", vec![])]));
-        }
-        data
-    } else {
-        data
-    };
+    let data = splice_with_marker(&pieces, &ops, marker, at, block_ops, &drop);
     let contents = rewritten_contents(doc, &streams, data);
     res.set(b"Font".to_vec(), Object::Dict(fonts));
     doc.update_dict(p.obj, |d| {

From 55a933800b94b89c0caae001ec48609cd5f70256 Mon Sep 17 00:00:00 2001
From: ihsan mokhlisse <16743959+ihsanmokhlisse@users.noreply.github.com>
Date: Thu, 29 Oct 2026 10:42:20 +0100
Subject: [PATCH 126/270] M7: keep a typed space run through a saved width
 change (#2517)

The wrap's space count has to survive an incremental save and a full rewrite, and a width-only text_edit has to reflow with that count. A recorded editor session narrows the box and widens it again.
---
 ROADMAP.md                                    |  2 ++
 crates/automation/src/dispatch.rs             | 14 ++++++--
 crates/automation/tests/it/automation.rs      | 27 +++++++++++++++
 crates/edit/src/tests.rs                      | 34 +++++++++++++------
 .../tests/play/narrow-widen-double-space.json | 15 ++++++++
 docs/roadmap.md                               |  2 ++
 parity/acrobat-features.toml                  |  4 +--
 7 files changed, 84 insertions(+), 14 deletions(-)
 create mode 100644 crates/ui-egui/tests/play/narrow-widen-double-space.json

diff --git a/ROADMAP.md b/ROADMAP.md
index e8f8c5a69d..858ab719c6 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,6 +2,7 @@
 
 **Stage: alpha** · next: beta, ~25% (ready for real work 50% → 75%) and ~400–700 h away
 
+> **Last reviewed:** 2026-10-29 | **Last updated:** 2026-10-29 | **Change:** minor (M7 #2517: a narrowed then widened paragraph keeps the typed spaces the wrap consumed, after save and reopen; estimates unchanged)
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
@@ -201,6 +202,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 ## Progress log
 
+- **2026-10-29 (M7, #2517):** Widening a paragraph rejoins a wrap with the number of spaces that wrap consumed, including a typed run and none for a Chinese or Japanese word split. The count survives an incremental save and a full rewrite, and a width-only `text_edit` uses it. Estimates unchanged.
 - **2026-10-27 (M10, OCR models):** Model staging downloads and verifies the ONNX pair after the upstream RTEN URL brownout; runtime discovery prefers complete ONNX pairs per directory, retains complete RTEN fallback and preserves directory precedence.
 - **2026-10-24 (M10, #4158 partial):** Word, HTML, RTF and PowerPoint export keep a block that continues another on its line (an italic case name, a link, a superscript) as a run in its own style inside that paragraph, with the source's word space, instead of a paragraph of its own. Style changes that wrap onto the next line still split paragraphs (the reading blocks keep style boundaries). Estimates unchanged.
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
diff --git a/crates/automation/src/dispatch.rs b/crates/automation/src/dispatch.rs
index b136076bc8..b56b04d92f 100644
--- a/crates/automation/src/dispatch.rs
+++ b/crates/automation/src/dispatch.rs
@@ -538,7 +538,17 @@ impl Automation {
                 };
                 let index = self.paragraph_index(id, page, k, &blocks)?;
                 let block = blocks.get(index).cloned().ok_or_else(|| ToolError::InvalidArgs(format!("paragraph {k} is out of range")))?;
-                let text = a.opt_str("text")?.map(str::to_owned).unwrap_or(block.text);
+                let width = a.opt_num("width")?;
+                // A width change with no new text is the box-edge drag. `reflow_text` rejoins a
+                // wrap with the spaces it consumed and keeps a newline that was typed. `text`
+                // joins every row with one space, so that drag would turn two typed spaces into
+                // one (#2529). A move or a formatting change still uses `text`: those edits are
+                // what the stale-paragraph checks regroup with, and they are not a reflow.
+                let text = match a.opt_str("text")? {
+                    Some(text) => text.to_owned(),
+                    None if width.is_some() => block.reflow_text.clone(),
+                    None => block.text,
+                };
                 let mut style = pdfcraft_engine::BlockStyle {
                     ranges: parse_style_ranges(a.get("ranges"))?,
                     resource: a.opt_str("font_resource")?.map(str::to_owned),
@@ -548,7 +558,7 @@ impl Automation {
                     line_spacing: a.opt_num("line_spacing")?,
                     char_spacing: a.opt_num("char_spacing")?,
                     scale: a.opt_num("scale")?,
-                    width: a.opt_num("width")?,
+                    width,
                     ..Default::default()
                 };
                 let (dx, dy) = (a.opt_num("dx")?, a.opt_num("dy")?);
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index cdef5dc5af..3772f2fb70 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -9496,6 +9496,33 @@ fn a_blank_line_stays_a_separate_paragraph_through_tools() {
     assert_eq!(ok(&mut a, "text_paragraphs", json!({ "doc": spaced_doc, "page": 1 }))["count"], 1);
 }
 
+/// #2529, through the same tools as a width drag. The typed double space falls on the wrap.
+/// Omitting `text` reflows with the saved gap count. An incremental save and a full rewrite
+/// both still have both spaces after the box is widened again.
+#[test]
+fn narrowing_then_widening_keeps_a_typed_double_space_through_tools() {
+    let dir = workdir("double-space-width");
+    std::fs::write(dir.join("a.pdf"), helvetica_page("BT /F1 24 Tf 20 150 Td (One  Two) Tj ET")).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "text_paragraphs", json!({ "doc": doc, "page": 1 }))["paragraphs"][0]["editor_text"], "One  Two");
+    ok(&mut a, "text_edit", json!({ "doc": doc, "page": 1, "paragraph": 1, "width": 45.0 }));
+    let narrow = &ok(&mut a, "text_paragraphs", json!({ "doc": doc, "page": 1 }))["paragraphs"][0];
+    assert_eq!(narrow["editor_text"], "One\nTwo", "{narrow}");
+    for (name, full) in [("narrow-inc.pdf", false), ("narrow-full.pdf", true)] {
+        ok(&mut a, "doc_save", json!({ "doc": doc, "path": name, "full": full }));
+        let saved = ok(&mut a, "doc_open", json!({ "path": name }))["doc"].as_u64().unwrap();
+        let block = &ok(&mut a, "text_paragraphs", json!({ "doc": saved, "page": 1 }))["paragraphs"][0];
+        assert_eq!(block["editor_text"], "One\nTwo", "{name}: {block}");
+        ok(&mut a, "text_edit", json!({ "doc": saved, "page": 1, "paragraph": 1, "width": 200.0 }));
+        let wide_name = format!("wide-{name}");
+        ok(&mut a, "doc_save", json!({ "doc": saved, "path": wide_name, "full": full }));
+        let wide = ok(&mut a, "doc_open", json!({ "path": wide_name }))["doc"].as_u64().unwrap();
+        let block = &ok(&mut a, "text_paragraphs", json!({ "doc": wide, "page": 1 }))["paragraphs"][0];
+        assert_eq!(block["editor_text"], "One  Two", "{name}: the second typed space was lost: {block}");
+    }
+}
+
 fn paragraph_texts(a: &mut Automation, doc: u64) -> Vec<String> {
     ok(a, "text_paragraphs", json!({ "doc": doc, "page": 1 }))["paragraphs"]
         .as_array()
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 5491dfca43..b601db5654 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -3286,18 +3286,32 @@ fn a_wrapped_line_rejoins_when_widened_and_a_typed_break_stays() {
 /// #2529 (reviewer): a run of typed spaces that happens to fall at a wrap point is not the same
 /// as the single space an ordinary word gap leaves. Narrowing drops the whole gap, as any wrap
 /// does (#4199's own test: `wrapped("aa  bb  cc", 6.0) == ["aa  bb", "cc"]`); widening it back
-/// must not quietly turn two typed spaces into one.
+/// must not quietly turn two typed spaces into one. The count is stored on the wrap marker, so
+/// it has to survive an incremental save and a full rewrite, not only the in-memory rewrite.
 #[test]
 fn narrowing_then_widening_keeps_a_typed_double_space() {
-    let mut doc = text_page("BT /F1 24 Tf 20 150 Td (One  Two) Tj ET");
-    let wide = text::text_blocks(&doc, 0).unwrap().into_iter().next().unwrap().rect;
-    let wide_width = wide[2] - wide[0];
-    text::rewrite_block(&mut doc, 0, 0, None, &text::BlockStyle { width: Some(45.0), ..Default::default() }).unwrap();
-    let block = text::text_blocks(&doc, 0).unwrap().into_iter().next().unwrap();
-    assert_eq!(block.editor_text, "One\nTwo", "the narrow box did not wrap between the two typed spaces: {}", block.editor_text);
-    text::rewrite_block(&mut doc, 0, 0, Some(&block.reflow_text), &text::BlockStyle { width: Some(wide_width), ..Default::default() }).unwrap();
-    let rewidened = text::text_blocks(&doc, 0).unwrap().into_iter().next().unwrap();
-    assert_eq!(rewidened.editor_text, "One  Two", "the second typed space was lost: {:?}", rewidened.editor_text);
+    let fresh = text_page("BT /F1 24 Tf 20 150 Td (One  Two) Tj ET");
+    let wide_width = {
+        let wide = text::text_blocks(&fresh, 0).unwrap().into_iter().next().unwrap().rect;
+        wide[2] - wide[0]
+    };
+    for (save, reopen_as) in
+        [("incremental", reopen(&fresh)), ("full", Document::open(Arc::new(write_full(&fresh, &SaveOptions::default()).unwrap())).unwrap())]
+    {
+        let mut doc = reopen_as;
+        text::rewrite_block(&mut doc, 0, 0, None, &text::BlockStyle { width: Some(45.0), ..Default::default() }).unwrap();
+        let doc =
+            if save == "incremental" { reopen(&doc) } else { Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap() };
+        let block = text::text_blocks(&doc, 0).unwrap().into_iter().next().unwrap();
+        assert_eq!(block.editor_text, "One\nTwo", "{save}: the narrow box did not wrap between the two typed spaces: {}", block.editor_text);
+        assert_eq!(block.reflow_text, "One  Two", "{save}: the saved wrap did not remember both spaces: {:?}", block.reflow_text);
+        let mut doc = doc;
+        text::rewrite_block(&mut doc, 0, 0, Some(&block.reflow_text), &text::BlockStyle { width: Some(wide_width), ..Default::default() }).unwrap();
+        let doc =
+            if save == "incremental" { reopen(&doc) } else { Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap() };
+        let rewidened = text::text_blocks(&doc, 0).unwrap().into_iter().next().unwrap();
+        assert_eq!(rewidened.editor_text, "One  Two", "{save}: the second typed space was lost: {:?}", rewidened.editor_text);
+    }
 }
 
 /// #2529: a Chinese/Japanese word split has no space of its own (`wrap`'s own doc comment: "those
diff --git a/crates/ui-egui/tests/play/narrow-widen-double-space.json b/crates/ui-egui/tests/play/narrow-widen-double-space.json
new file mode 100644
index 0000000000..15fe835837
--- /dev/null
+++ b/crates/ui-egui/tests/play/narrow-widen-double-space.json
@@ -0,0 +1,15 @@
+{
+  "name": "narrow then widen keeps two typed spaces",
+  "content": "BT /F1 24 Tf 72 700 Td (One  Two) Tj ET",
+  "steps": [
+    {"command": {"id": "edit.edit_text"}},
+    {"click_page": {"x": 100, "y": 700}},
+    {"expect_editor": {"contains": "One", "text": "One  Two"}},
+    {"key": {"key": "Enter", "modifiers": ["command"]}},
+    {"drag_edge": {"contains": "One", "dx": -220}},
+    {"expect_editor": {"contains": "One", "text": "One\nTwo"}},
+    {"drag_edge": {"contains": "One", "dx": 360}},
+    {"expect_editor": {"contains": "One", "text": "One  Two"}},
+    {"shot": {"name": "narrow-widen-double-space"}}
+  ]
+}
diff --git a/docs/roadmap.md b/docs/roadmap.md
index bad3da9a63..17594ee766 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,5 +1,6 @@
 # PdfCraft roadmap: milestones and what's next
 
+> **Last reviewed:** 2026-10-29 | **Last updated:** 2026-10-29 | **Change:** minor (M7 #2517: a narrowed then widened paragraph keeps the typed spaces the wrap consumed, after save and reopen; estimates unchanged)
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
@@ -256,6 +257,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-29 | minor | M7 #2517: widening a paragraph rejoins a wrap with the spaces that wrap consumed, including a typed run and none for a Chinese or Japanese word split, after an incremental save and a full rewrite. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
 | 2026-10-23 | minor | M8, #3205 follow-up: phone-pattern redaction includes the +39 country code on labelled Italian geographic numbers with a slash; dates, protocol identifiers and whole-run guards remain. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index ca854bac90..056cb1bfe7 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1902,8 +1902,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["text_edit"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_move_and_rewrap_to_a_new_width", "crates/edit/src/tests.rs::a_wrapped_line_rejoins_when_widened_and_a_typed_break_stays", "crates/edit/src/tests.rs::an_unmarked_full_line_rejoins_and_a_short_break_stays", "crates/ui-egui/tests/it/editing.rs::dragging_a_paragraph_moves_it_and_its_edge_rewraps_it", "crates/ui-egui/tests/it/editing.rs::a_paragraph_rewraps_from_the_outer_half_of_its_edge_handles", "crates/ui-egui/tests/it/editing.rs::a_quick_flick_on_either_edge_rewraps_the_paragraph", "crates/ui-egui/tests/it/editing.rs::an_open_paragraph_moves_by_its_frame_and_by_the_arrow_keys", "crates/ui-egui/tests/it/editing.rs::arrow_keys_nudge_a_selected_image_instead_of_turning_the_page", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools"]
-notes = "existing paragraphs: drag the box to move it, drag the handle on its left or right edge to rewrap it to a new width (upright pages), including the half of the handle outside the box, which started an area selection instead (#2276); a wrap rejoins when the box is widened, and a newline that was typed stays; an unmarked line that fills the measure rejoins, a short line does not; the move is applied in page space through the paragraph's CTM, in its own q … Q; a click still opens it for typing (#40); once open, its frame grabs the box (click to select, drag to move) while the text keeps the caret, and the arrow keys nudge the selected box or image a point, Shift ten points (#1520)"
+evidence = ["crates/edit/src/tests.rs::paragraphs_move_and_rewrap_to_a_new_width", "crates/edit/src/tests.rs::a_wrapped_line_rejoins_when_widened_and_a_typed_break_stays", "crates/edit/src/tests.rs::an_unmarked_full_line_rejoins_and_a_short_break_stays", "crates/edit/src/tests.rs::narrowing_then_widening_keeps_a_typed_double_space", "crates/edit/src/tests.rs::narrowing_then_widening_a_japanese_word_adds_no_space", "crates/ui-egui/tests/it/editing.rs::dragging_a_paragraph_moves_it_and_its_edge_rewraps_it", "crates/ui-egui/tests/it/editing.rs::a_paragraph_rewraps_from_the_outer_half_of_its_edge_handles", "crates/ui-egui/tests/it/editing.rs::a_quick_flick_on_either_edge_rewraps_the_paragraph", "crates/ui-egui/tests/it/editing.rs::an_open_paragraph_moves_by_its_frame_and_by_the_arrow_keys", "crates/ui-egui/tests/it/editing.rs::arrow_keys_nudge_a_selected_image_instead_of_turning_the_page", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools", "crates/automation/tests/it/automation.rs::narrowing_then_widening_keeps_a_typed_double_space_through_tools", "crates/ui-egui/tests/play.rs::play_sessions_fetch_paragraph_bugs"]
+notes = "existing paragraphs: drag the box to move it, drag the handle on its left or right edge to rewrap it to a new width (upright pages), including the half of the handle outside the box, which started an area selection instead (#2276); a wrap rejoins when the box is widened, with the number of spaces that wrap consumed (a typed run stays a run; a Chinese or Japanese word split adds none) and that count survives an incremental save and a full rewrite (#2529), and a newline that was typed stays; an unmarked line that fills the measure rejoins, a short line does not; the move is applied in page space through the paragraph's CTM, in its own q … Q; a click still opens it for typing (#40); once open, its frame grabs the box (click to select, drag to move) while the text keeps the caret, and the arrow keys nudge the selected box or image a point, Shift ten points (#1520)"
 
 [[feature]]
 id = "edit.paragraph-detection"

From 5a86f35210ca98adb23ba53ff9d0871593b0cfdb Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Thu, 29 Oct 2026 21:30:21 +1100
Subject: [PATCH 127/270] fix(edit, ui): alignments follow the right rows;
 Format by keyboard keeps the box

Four holes CodeRabbit found on 648dd428:

- alignment_frame framed a one-row paragraph when any alignment entry
  was set, including one past the draft's rows, and then moved rows
  with no alignment of their own to the column's edge. It now takes the
  draft and frames only when every draft row is aligned, by its own
  alignment or the paragraph's.
- remap could not tell which of two same paragraphs an edit took
  ("A\nA" to "A"), and kept the deleted one's alignment. remap_at takes
  the caret where the edit ended, and the typing path (follow_typing,
  both editors) passes it from the box's state. The caret only chooses
  between readings that fit both texts.
- Both editors judged a focus loss by where a click landed, so focusing
  a Format text control by keyboard or a screen reader (no pointer)
  closed the box before the alignment was chosen. They now also judge
  by where the keyboard went (focus_pos): focus outside the document
  view, or on the added-text box's own buttons, keeps the box open as a
  click there does.

Each change has a test seen failing before it.
---
 crates/edit/src/paragraph_align.rs       | 43 +++++++++++++-
 crates/edit/src/tests.rs                 | 16 ++++++
 crates/edit/src/text/rewrite.rs          |  2 +-
 crates/edit/src/text_regions/grouping.rs | 17 +++---
 crates/ui-egui/src/tools/content_ui.rs   | 11 ++--
 crates/ui-egui/src/tools/edit_text_ui.rs | 21 +++++--
 crates/ui-egui/tests/it/content.rs       | 71 ++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs       | 33 +++++++++++
 8 files changed, 193 insertions(+), 21 deletions(-)

diff --git a/crates/edit/src/paragraph_align.rs b/crates/edit/src/paragraph_align.rs
index cf2023e615..8fb0a4c5e4 100644
--- a/crates/edit/src/paragraph_align.rs
+++ b/crates/edit/src/paragraph_align.rs
@@ -69,13 +69,33 @@ fn trimmed(mut aligns: Vec<Option<Align>>) -> Vec<Option<Align>> {
 /// paragraph it changed, or for lines only inserted, of the paragraph before them (so Enter in or
 /// after a centred paragraph makes centred ones).
 pub fn remap(old: &str, new: &str, aligns: &[Option<Align>]) -> Vec<Option<Align>> {
+    remap_at(old, new, aligns, None)
+}
+
+/// [`remap`] for an edit that left the caret at byte `caret` of `new`. Repeated paragraphs can
+/// make where the edit was ambiguous ("A\nA" to "A" deletes either one); the caret, at the edit's
+/// end, says which. It only chooses between readings that fit the texts, so a caret away from the
+/// edit never makes it an edit of other paragraphs.
+pub fn remap_at(old: &str, new: &str, aligns: &[Option<Align>], caret: Option<usize>) -> Vec<Option<Align>> {
     if aligns.is_empty() || old == new {
         return aligns.to_vec();
     }
     let (o, n): (Vec<&str>, Vec<&str>) = (old.split('\n').collect(), new.split('\n').collect());
     let shortest = o.len().min(n.len());
-    let prefix = o.iter().zip(&n).take_while(|(a, b)| a == b).count().min(shortest);
-    let suffix = o.iter().rev().zip(n.iter().rev()).take_while(|(a, b)| a == b).count().min(shortest - prefix);
+    let same_start = o.iter().zip(&n).take_while(|(a, b)| a == b).count().min(shortest);
+    let same_end = o.iter().rev().zip(n.iter().rev()).take_while(|(a, b)| a == b).count().min(shortest);
+    let fewest_kept = shortest - same_start;
+    let (prefix, suffix) = match caret {
+        Some(at) if fewest_kept <= same_end => {
+            // The edit's paragraphs of `new` end before the caret's paragraph when the caret starts
+            // one, and with it otherwise.
+            let starts = at == 0 || at.checked_sub(1).and_then(|i| new.as_bytes().get(i)) == Some(&b'\n');
+            let end = paragraph_at(new, at).saturating_add(usize::from(!starts));
+            let suffix = n.len().saturating_sub(end).clamp(fewest_kept, same_end);
+            (shortest - suffix, suffix)
+        }
+        _ => (same_start, same_end.min(shortest - same_start)),
+    };
     let at = |i: usize| aligns.get(i).copied().flatten();
     let inserted_only = o.len() - prefix - suffix == 0;
     let changed = if inserted_only && prefix > 0 { at(prefix - 1) } else { at(prefix) };
@@ -132,4 +152,23 @@ mod tests {
         assert_eq!(remap("A\nA", "A", &[Some(Center), Some(Right)]), [Some(Center)]);
         assert_eq!(remap("A", "A\nA", &[Some(Center)]), [Some(Center), Some(Center)]);
     }
+
+    /// Repeated rows make the edit's place ambiguous: "A\nA" to "A" deletes either row. The caret,
+    /// where the edit ended, settles which (CodeRabbit on 648dd428).
+    #[test]
+    fn the_caret_says_which_of_two_same_rows_an_edit_took() {
+        let aligns = [Some(Center), Some(Right)];
+        assert_eq!(remap_at("A\nA", "A", &aligns, Some(0)), [Some(Right)], "the first row and its break deleted");
+        assert_eq!(remap_at("A\nA", "A", &aligns, Some(1)), [Some(Center)], "the break and the second row deleted");
+        assert_eq!(remap_at("A\nA", "A", &aligns, None), [Some(Center)], "no caret: as before");
+        // Enter at the start of the first of two same rows: the new row is before it.
+        assert_eq!(remap_at("A\nA", "\nA\nA", &aligns, Some(1)), [Some(Center), Some(Center), Some(Right)]);
+        // Enter at the end of the second: the new row follows it.
+        assert_eq!(remap_at("A\nA", "A\nA\n", &aligns, Some(4)), [Some(Center), Some(Right), Some(Right)]);
+        // A caret away from the edit never makes it an edit of other rows.
+        assert_eq!(remap_at("A\nB\nC", "A\nB\nCx", &[Some(Center), Some(Right), None], Some(0)), [Some(Center), Some(Right)]);
+        // A caret past the end, or not on a character boundary, is no panic.
+        assert_eq!(remap_at("A\nA", "A", &aligns, Some(99)), [Some(Center)]);
+        assert_eq!(remap_at("é\né", "é", &aligns, Some(1)), [Some(Center)]);
+    }
 }
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 7691039f24..f74bb02921 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -7255,6 +7255,22 @@ fn a_justified_paragraph_from_the_editor_fills_its_rows() {
     assert!(row("end")[2] < right - 20.0, "the last row isn't");
 }
 
+/// An alignment for a row the draft doesn't have names no row: a one-row title given one for a
+/// second row only stays where it is, not moved to its column's edge. Nor does a row of the draft
+/// with no alignment of its own move because another row has one (CodeRabbit on 648dd428).
+#[test]
+fn a_title_moves_to_its_column_only_for_an_alignment_of_its_own() {
+    let page = "BT /F1 24 Tf 1 0 0 1 250 700 Tm (Title) Tj ET          BT /F1 10 Tf 12 TL 72 650 Td (The body of the page runs across the whole column here.) Tj T* (It has a second row that is a little shorter.) Tj ET";
+    let title = |doc: &Document| text::text_lines(doc, 0).unwrap().into_iter().find(|l| l.text == "Title").unwrap().rect;
+    let before = title(&text_page(page));
+    for draft in ["Title", "Title\nSub"] {
+        let mut doc = text_page(page);
+        let style = text::BlockStyle { aligns: vec![None, Some(added::Align::Right)], ..Default::default() };
+        text::rewrite_block(&mut doc, 0, 0, Some(draft), &style).unwrap();
+        assert!((title(&doc)[0] - before[0]).abs() < 0.5, "{draft:?}: the title stays put, {:?} vs {before:?}", title(&doc));
+    }
+}
+
 /// A column whose rows are several runs (a second style on the same baseline) reaches the right
 /// edge of its whole rows, not of the run at the left edge: a title wider than that first run is
 /// still held by the column and aligns to it (CodeRabbit on b9940d7d).
diff --git a/crates/edit/src/text/rewrite.rs b/crates/edit/src/text/rewrite.rs
index 3f436d7b24..97712858ad 100644
--- a/crates/edit/src/text/rewrite.rs
+++ b/crates/edit/src/text/rewrite.rs
@@ -766,7 +766,7 @@ pub(crate) fn rewrite_block_from(
     // An alignment for a one-row paragraph is laid out across the column it sits in, as a
     // paragraph of that width moved to its left edge.
     let framed;
-    let style = match alignment_frame(&lines, &blocks, &b, style, text.is_some_and(|t| t != b.editor_text)) {
+    let style = match alignment_frame(&lines, &blocks, &b, style, text.unwrap_or(&b.editor_text)) {
         Some([left, right]) => {
             framed = BlockStyle { width: Some(right - left), offset: Some([left - b.rect[0], 0.0]), ..style.clone() };
             &framed
diff --git a/crates/edit/src/text_regions/grouping.rs b/crates/edit/src/text_regions/grouping.rs
index 3a16e4f7c0..85266c7bcc 100644
--- a/crates/edit/src/text_regions/grouping.rs
+++ b/crates/edit/src/text_regions/grouping.rs
@@ -50,15 +50,12 @@ fn neighbour_left(lines: &[TextLine], block: &TextBlock) -> Option<f64> {
 /// to align in: left-aligning a title centred on the page left it where it was, and since a single
 /// row grows to the page's margin, centring it again moved it right each time. `None` when no
 /// alignment is asked for, when the paragraph is several rows, turned, or given a width or a move of
-/// its own, or when its text changes and no column holds it (`text_changed`).
-pub(crate) fn alignment_frame(
-    lines: &[TextLine],
-    blocks: &[TextBlock],
-    block: &TextBlock,
-    style: &BlockStyle,
-    text_changed: bool,
-) -> Option<[f64; 2]> {
-    let asked = style.align.is_some() || style.aligns.iter().any(Option::is_some);
+/// its own, or when its `draft` text changes and no column holds it.
+pub(crate) fn alignment_frame(lines: &[TextLine], blocks: &[TextBlock], block: &TextBlock, style: &BlockStyle, draft: &str) -> Option<[f64; 2]> {
+    // Every row of the draft is aligned, by its own alignment or the paragraph's: moving the
+    // paragraph to its column's edge would move a row that has none. Entries past the draft's
+    // rows name no row.
+    let asked = (0..crate::paragraph_align::count(draft)).all(|row| style.aligns.get(row).copied().flatten().or(style.align).is_some());
     if !asked || style.width.is_some() || style.offset.is_some() || block.rows.len() != 1 || block.rotation.abs() > 0.01 {
         return None;
     }
@@ -88,7 +85,7 @@ pub(crate) fn alignment_frame(
     // the row keeps the width it would have had without the alignment.
     match frame {
         Some(frame) => Some(frame),
-        None if text_changed => None,
+        None if draft != block.editor_text => None,
         None => Some(own),
     }
 }
diff --git a/crates/ui-egui/src/tools/content_ui.rs b/crates/ui-egui/src/tools/content_ui.rs
index 877edb6ae2..d7b4bd8cca 100644
--- a/crates/ui-egui/src/tools/content_ui.rs
+++ b/crates/ui-egui/src/tools/content_ui.rs
@@ -619,8 +619,9 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
     // Clicks outside the document (the Format text panel) keep the text open, as they keep a
     // paragraph being edited open.
     // Where the click that took the focus was: the pointer itself may be gone by then (a touch, a
-    // pen lifted away).
-    let outside = ctx.input(|i| i.pointer.interact_pos()).is_some_and(|p| !view.viewport_rect().contains(p));
+    // pen lifted away). The keyboard moving there (Tab, a screen reader) keeps it open too.
+    let away = |p: egui::Pos2| !view.viewport_rect().contains(p);
+    let outside = ctx.input(|i| i.pointer.interact_pos()).is_some_and(away) || crate::edit_text_ui::focus_pos(ctx).is_some_and(away);
     // Shown at once, like the paragraph editor: a fade-in shows the page's copy through it. Over
     // the page, so only where the document shows: text scrolled under the mode bar or a side
     // panel must leave them their pointer (#2755).
@@ -700,8 +701,10 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                     })
                     .response
                     .rect;
-                // Pressing a button takes the focus from the text: that is not a click away.
-                let on_buttons = ui.input(|i| i.pointer.interact_pos()).is_some_and(|p| buttons.contains(p));
+                // Pressing a button, or moving the keyboard to one, takes the focus from the text:
+                // that is not a click away.
+                let on_buttons = ui.input(|i| i.pointer.interact_pos()).is_some_and(|p| buttons.contains(p))
+                    || crate::edit_text_ui::focus_pos(ui.ctx()).is_some_and(|p| buttons.contains(p));
                 cancel |= ui.input(|i| i.key_pressed(egui::Key::Escape));
                 commit = done || resp.lost_focus() && !on_buttons && !outside && !view.objects.hold_editor;
             });
diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
index 45fee6cf36..f5ba4e0b67 100644
--- a/crates/ui-egui/src/tools/edit_text_ui.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -155,6 +155,10 @@ pub(crate) fn follow_typing(
     aligns: &mut [&mut Vec<Option<pdfcraft_engine::TextAlign>>],
 ) {
     let now: Vec<Vec<_>> = aligns.iter().map(|a| a.to_vec()).collect();
+    // Where the edit left the caret, as a byte of `after`: it says which of two same rows changed.
+    let caret = egui::TextEdit::load_state(ctx, id)
+        .and_then(|s| s.cursor.char_range())
+        .map(|r| after.char_indices().nth(r.primary.index.into()).map_or(after.len(), |(at, _)| at));
     let next = ctx.data_mut(|d| {
         let seen = d.get_temp_mut_or_default::<AlignHistory>(id.with(ALIGN_HISTORY));
         if seen.iter().any(|(text, was)| text == before && *was != now) {
@@ -163,7 +167,7 @@ pub(crate) fn follow_typing(
         remember(seen, before, now.clone());
         let next = match seen.iter().rev().find(|(text, _)| text == after) {
             Some((_, was)) if was.len() == now.len() => was.clone(),
-            _ => now.iter().map(|a| pdfcraft_engine::paragraph_align::remap(before, after, a)).collect(),
+            _ => now.iter().map(|a| pdfcraft_engine::paragraph_align::remap_at(before, after, a, caret)).collect(),
         };
         remember(seen, after, next.clone());
         next
@@ -624,9 +628,11 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, lines: &[pdfcraft_engine::Text
 /// The inline editor; returns the edit once the text is applied.
 pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -> Option<Edit> {
     let view_id = view.id;
-    // Clicks outside the document (the Format text panel) keep the paragraph open. Where the
-    // click landed is `interact_pos`: `latest_pos` is gone on the frame a tap lifts.
-    let outside = ctx.input(|i| i.pointer.interact_pos()).is_some_and(|p| !view.viewport_rect().contains(p));
+    // Clicks outside the document (the Format text panel) keep the paragraph open, as does the
+    // keyboard moving there. Where the click landed is `interact_pos`: `latest_pos` is gone on the
+    // frame a tap lifts.
+    let away = |p: egui::Pos2| !view.viewport_rect().contains(p);
+    let outside = ctx.input(|i| i.pointer.interact_pos()).is_some_and(away) || focus_pos(ctx).is_some_and(away);
     let page = view.line_editor.as_ref()?.page;
     let xf = view.page_xform(page)?;
     let hold = view.objects.hold_editor;
@@ -821,6 +827,13 @@ pub(crate) fn finished_edit(ed: LineEditor) -> Option<Edit> {
     })
 }
 
+/// Where the keyboard is: the centre of the widget that has it. A text box that loses it to a
+/// widget reached by Tab or a screen reader (the Format text panel's controls) judges where it
+/// went by this, as it judges a click by where the click landed.
+pub(crate) fn focus_pos(ctx: &egui::Context) -> Option<egui::Pos2> {
+    ctx.memory(|m| m.focused()).and_then(|id| ctx.read_response(id)).map(|r| r.rect.center())
+}
+
 /// Whether an editor's text box `r` lost the keyboard this frame, given whether it `had` it at
 /// the end of the editor's last frame (updated here). egui's `lost_focus` holds for a second
 /// frame as well, and an editor that judges a click away by where the click landed must judge it
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 1dadc6adaa..49ce6e4d0d 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1014,6 +1014,77 @@ fn aligning_a_selected_line_of_added_text_aligns_only_that_line() {
     assert_eq!(aligns(&h), (pdfcraft_engine::TextAlign::Left, vec![]));
 }
 
+/// Two lines of added text with the same words, each aligned its own way: deleting the first line
+/// with its break leaves the second line's alignment, not the deleted one's (CodeRabbit on
+/// 648dd428).
+#[test]
+fn deleting_the_first_of_two_same_lines_keeps_the_second_lines_alignment() {
+    use pdfcraft_engine::TextAlign::{Center, Right};
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 220.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Same\nSame".into(), aligns: vec![Some(Center), Some(Right)], ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 120.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    // Select the first line with its break, and delete it.
+    h.key_press(egui::Key::ArrowUp);
+    h.key_press(egui::Key::Home);
+    // "Same" and its line break.
+    for _ in 0..5 {
+        h.key_press_modifiers(egui::Modifiers::SHIFT, egui::Key::ArrowRight);
+    }
+    h.key_press(egui::Key::Backspace);
+    h.run_steps(2);
+    let d = h.state().views[0].content.draft.as_ref().expect("still typing");
+    assert_eq!((d.text.as_str(), d.style.aligns.clone()), ("Same", vec![Some(Right)]), "the second line's alignment stays");
+}
+
+/// The same with the alignment controls reached by keyboard or a screen reader (focused, then
+/// pressed, with no pointer): the box stays open when the focus leaves it for the Format text
+/// panel, and both choices are for the selected line.
+#[test]
+fn aligning_a_selected_line_of_added_text_by_keyboard_keeps_the_box_open() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 220.0];
+    let text = pdfcraft_engine::AddedText {
+        rect,
+        text: "Line one
+Line two"
+            .into(),
+        ..Default::default()
+    };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.key_press_modifiers(egui::Modifiers::SHIFT, egui::Key::Home);
+    h.run_steps(2);
+    let align_by_focus = |h: &mut Harness<'static, PdfCraftApp>, choice: &str| {
+        for label in ["Alignment", choice] {
+            h.get_by_label(label).focus();
+            h.run_steps(2);
+            h.get_by_label(label).click();
+            h.run_steps(3);
+        }
+    };
+    let aligns = |h: &Harness<'static, PdfCraftApp>| match &added(h)[0].content {
+        pdfcraft_engine::AddedContent::Text(t) => (t.align, t.aligns.clone()),
+        _ => panic!(),
+    };
+    align_by_focus(&mut h, "Align right");
+    assert!(h.state().views[0].content.draft.is_some(), "the box stays open");
+    assert_eq!(aligns(&h), (pdfcraft_engine::TextAlign::Left, vec![None, Some(pdfcraft_engine::TextAlign::Right)]));
+    align_by_focus(&mut h, "Centre");
+    assert!(h.state().views[0].content.draft.is_some(), "the box is still open");
+    assert_eq!(aligns(&h), (pdfcraft_engine::TextAlign::Left, vec![None, Some(pdfcraft_engine::TextAlign::Center)]));
+}
+
 /// The same in an added text box: Redo after Undo puts the typing back in the box, and the
 /// document's own Redo stays waiting.
 #[test]
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index e69eb63d85..2087c293a6 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6578,6 +6578,39 @@ fn aligning_a_selected_row_aligns_only_that_row_and_undo_puts_it_back() {
     assert!((row_rect(&h, "nine")[0] - last[0]).abs() < 0.5, "the last row is back");
 }
 
+/// Format text's alignment flyout by keyboard or screen reader: each control is focused, then
+/// pressed, with no pointer anywhere.
+fn align_by_focus(h: &mut Harness<'static, PdfCraftApp>, choice: &str) {
+    for label in ["Alignment", choice] {
+        h.get_by_label(label).focus();
+        h.run_steps(2);
+        h.get_by_label(label).click();
+        h.run_steps(3);
+    }
+}
+
+/// The same as by pointer, with the alignment controls reached by keyboard or a screen reader:
+/// the paragraph stays open when the focus leaves it for the Format text panel, the selected row
+/// takes the alignment, and a second choice is for that row again.
+#[test]
+fn aligning_a_selected_row_by_keyboard_keeps_the_paragraph_open() {
+    let mut h = three_row_paragraph();
+    let first = row_rect(&h, "One");
+    let wide = row_rect(&h, "three");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
+    h.run_steps(2);
+    align_by_focus(&mut h, "Align right");
+    assert!(h.state().views[0].line_editor.is_some(), "the paragraph stays open");
+    let moved = row_rect(&h, "nine");
+    assert!((moved[2] - wide[2]).abs() < 1.0, "the last row is right-aligned: {moved:?}");
+    align_by_focus(&mut h, "Centre");
+    assert!(h.state().views[0].line_editor.is_some(), "the paragraph is still open");
+    assert!((row_rect(&h, "One")[0] - first[0]).abs() < 0.5, "the first row stays put: {:?}", row_rect(&h, "One"));
+    let last = row_rect(&h, "nine");
+    assert!((((last[0] + last[2]) - (wide[0] + wide[2])) / 2.0).abs() < 1.0, "the last row is centred: {last:?} in {wide:?}");
+}
+
 /// A row aligned on its own, deleted by typing, then brought back with Undo from the menu: it
 /// comes back with its alignment, and Redo deletes it again. The box's history keeps only text,
 /// so the restored row took the alignment of the row before it.

From 9f483490c7e16d1071a8b46663177b25e2e4d8e7 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 12:01:18 +0100
Subject: [PATCH 128/270] fix(ui): Escape cancels any drag the pages hold, and
 its release does nothing

Escape cancelled a comment gesture, Prepare's marquee, measuring and the camera tool, each in its
own module; with the Sign area, crop, marquee zoom, a redaction box, the Link tool's rectangle,
a paragraph or picture drag, added content, an object move or a text selection it did nothing,
and the release then drew, placed or opened what the drag had begun (the step-4 probe: Escape
mid-rectangle still opened the signing dialog).

document_area now handles Escape once, before the pages: while the pages hold a press, it drops
every pointer gesture (DocView::cancel_pointer_gestures, as automation's cancel does) and marks
the press cancelled. Until the button is up the page tools take no input from it, so its
release neither clicks (a stamp, a Fill & Sign mark) nor ends a drag. Escape without a press
keeps its meanings (close the editor, clear the selection, back to the Select tool).

Un-ignores escape_cancels_a_signature_rectangle. Two new tests: Escape mid-press keeps the
release from placing a stamp, and Escape mid-drag abandons a crop rectangle. All three fail
with the cancel taken out; the stamp test also fails with the cancel kept and the release let
through.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs       | 22 +++++++++++++++-
 crates/ui-egui/tests/it/pointer.rs | 42 +++++++++++++++++++++++++++++-
 2 files changed, 62 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 91d2c41367..c2c74ac8a7 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -473,6 +473,9 @@ pub struct DocView {
     pub(crate) signature_drag: crate::signature_drag::SignatureDrag,
     /// What the page modules claim for the cursor this frame; `document_area` sets it once.
     pub(crate) cursor: crate::page_cursor::PageCursor,
+    /// Escape cancelled the press the pages hold: the page ignores it until the button is up, so
+    /// its release neither clicks nor ends a drag.
+    pub(crate) press_cancelled: bool,
     /// A non-edit action requested by the organize toolbar, handled by the app.
     pub pending_action: Option<ViewAction>,
     /// The grid gap the next inserted files go to (set by a "+" between pages); otherwise they
@@ -726,6 +729,7 @@ impl DocView {
             fill_signature_page: None,
             signature_drag: Default::default(),
             cursor: Default::default(),
+            press_cancelled: false,
         }
     }
 
@@ -1737,7 +1741,8 @@ fn draw_page(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, i
     }
 
     let slot = PageSlot { i, r, xf };
-    let input = page_tool_input(ui, view, frame, &slot);
+    // A cancelled press takes nothing until the button is up.
+    let input = if view.press_cancelled { PageInput { consumed: true, area_tool: false } } else { page_tool_input(ui, view, frame, &slot) };
     let painter = ui.painter();
     let pcx = comments::PageCx { page: i, xf: &xf, ptr, info, tool, prefs, allowed, hidden: comments_hidden, redact_mark };
     let preview_target = (matches!(tool, QuickTool::Select | QuickTool::Fill(_)) && !comments_hidden).then_some(view.comments.selected).flatten();
@@ -1754,6 +1759,20 @@ fn draw_page(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, i
     page_overlays(ui, view, frame, &slot, &input);
 }
 
+/// Escape while the pages hold a press abandons the gesture it drives, whichever tool's: nothing is
+/// placed, drawn, moved, resized or opened, and the press is ignored until the button is up. The
+/// frame of the release still belongs to the cancelled press.
+fn cancel_on_escape(ctx: &egui::Context, view: &mut DocView, ptr: &PagePointer) {
+    if view.press_cancelled && !ptr.any_down && ptr.edges.is_empty() {
+        view.press_cancelled = false;
+    }
+    if !view.press_cancelled && ptr.origin.is_some() && ptr.primary_down && ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape))
+    {
+        view.cancel_pointer_gestures();
+        view.press_cancelled = true;
+    }
+}
+
 fn draw_pages(
     ui: &mut egui::Ui,
     viewport: Rect,
@@ -1833,6 +1852,7 @@ fn draw_pages(
     // The pointer as the pages see it: nothing over them (a dialog from the frame it opens),
     // or a press they hold. The page modules read it rather than egui's raw pointer state.
     let ptr = PagePointer::read(ui, &resp, modal);
+    cancel_on_escape(ui.ctx(), view, &ptr);
     let pointer = ptr.pos;
     // A press on a page makes it the current one (as in Acrobat), so a page command with
     // no selection (Rotate, Delete) acts on the page the reader pointed at, not on a page
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index 74120834bc..442eade9ea 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -713,7 +713,6 @@ fn touch_drag_moves_a_comment_and_leaves_no_gesture_behind() {
 // Ending a gesture.
 
 #[test]
-#[ignore = "step 4 of the page pointer router: press-time capture and cancel"]
 fn escape_cancels_a_signature_rectangle() {
     let mut h = open(link_pdf(), "150", false);
     h.state_mut().quick_tool = QuickTool::SignArea { certify: false };
@@ -732,3 +731,44 @@ fn escape_cancels_a_signature_rectangle() {
     assert_eq!(s.quick_tool, QuickTool::SignArea { certify: false }, "Escape abandons the rectangle; the tool stays");
     assert!(s.dialog.is_none(), "and no signing dialog opens: {:?}", s.dialog);
 }
+
+/// Escape with the button down drops the press: its release places no stamp, and the next click
+/// places one.
+#[test]
+fn escape_mid_press_keeps_its_release_from_placing_a_stamp() {
+    let mut h = open(link_pdf(), "150", false);
+    stamp_tool(&mut h);
+    let p = at(&h, 150.0, 150.0);
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(1);
+    h.key_press(egui::Key::Escape);
+    h.run_steps(1);
+    h.drop_at(p);
+    h.run_steps(4);
+    assert_eq!(stamps(&h), 0, "the cancelled press places nothing on release");
+    mouse_click(&mut h, p);
+    assert_eq!(stamps(&h), 1, "the next click places a stamp");
+}
+
+/// Escape mid-drag abandons a crop rectangle: the page keeps its boxes.
+#[test]
+fn escape_cancels_a_crop_rectangle() {
+    let mut h = open(text_pdf(), "150", false);
+    h.state_mut().quick_tool = QuickTool::Crop;
+    h.run_steps(4);
+    let (a, b) = (at(&h, 40.0, 360.0), at(&h, 260.0, 60.0));
+    h.hover_at(a);
+    h.run_steps(1);
+    h.drag_at(a);
+    h.run_steps(1);
+    h.hover_at(b);
+    h.run_steps(2);
+    h.key_press(egui::Key::Escape);
+    h.run_steps(1);
+    h.drop_at(b);
+    h.run_steps(4);
+    let s = h.state();
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), None, "no page box was set");
+}

From 35d28a60cc7f627a0bb04d75423cace9fdc00ca1 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 12:15:07 +0100
Subject: [PATCH 129/270] fix(ui): comments, links and text selection decide a
 press by one hit test

The page router (canvas/page_router.rs): a page module answers "what of mine is under this
point?" in one hit test, which gives a Hit (an owner, a layer, a cursor, a tip). On the frame of
a press, the hits at the press point decide who it belongs to, by PR 2's table (the highest
layer the tool reaches), and the router holds that capture until the button is up and its
release has been seen; automation's cancel and Escape drop it. The pointer's hits claim the
cursor and the tip, after the tools that are not converted yet, as before.

Comments: comments::hit is the module's only hit test, with each tool's filter (Select: point
handles, resize handles, then the comment; Fill & Sign: the same over its marks only; shape
tools: the selected comment's handles only). The Select tool's drag, click and double click act
on the comment and part the press was captured on, instead of testing the press origin and the
release point again; fill_grabs and select_grabs ask the router while the button is down. The
topmost comment is the one drawn last (/Annots order), not the last in inspection's top-edge
order: over stacked comments the tip named the top one while a click selected the one
underneath. Text markup declines the drag, so a click on a highlight selects it and a drag
across it still selects the text.

Links: the link hover is a hit (hand and target), and a click follows the link its press was
on. Text selection starts unless the press is held by something that keeps its drag (a link, a
comment that moves); it tested for a link under the pointer at the moment egui called the press
a drag, so a drag from text onto a link selected nothing.

Un-ignores a_click_on_stacked_comments_selects_the_one_drawn_on_top; new test
a_drag_from_text_onto_a_link_selects_the_text. Both fail with their fix reverted (inspection
order for the topmost comment; the link test at the pointer).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs               |  70 ++++--
 crates/ui-egui/src/canvas/page_router.rs   | 151 ++++++++++++
 crates/ui-egui/src/lib.rs                  |   1 +
 crates/ui-egui/src/tools/comments.rs       |   2 +-
 crates/ui-egui/src/tools/comments/input.rs | 254 ++++++++++-----------
 crates/ui-egui/src/tools/comments/state.rs |   5 +-
 crates/ui-egui/tests/it/pointer.rs         |  14 +-
 7 files changed, 337 insertions(+), 160 deletions(-)
 create mode 100644 crates/ui-egui/src/canvas/page_router.rs

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index c2c74ac8a7..d67b18b802 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -29,6 +29,7 @@ mod navigation;
 mod organize;
 pub(super) mod page_cursor;
 pub(super) mod page_pointer;
+pub(super) mod page_router;
 pub mod scroll_speed;
 mod selection;
 pub(super) mod signature_drag;
@@ -473,6 +474,8 @@ pub struct DocView {
     pub(crate) signature_drag: crate::signature_drag::SignatureDrag,
     /// What the page modules claim for the cursor this frame; `document_area` sets it once.
     pub(crate) cursor: crate::page_cursor::PageCursor,
+    /// Who the press the pages hold belongs to.
+    pub(crate) router: crate::page_router::PageRouter,
     /// Escape cancelled the press the pages hold: the page ignores it until the button is up, so
     /// its release neither clicks nor ends a drag.
     pub(crate) press_cancelled: bool,
@@ -590,6 +593,7 @@ impl DocView {
         self.org_drag = None;
         self.panel_drag = None;
         self.selection_drag = false;
+        self.router.cancel();
         self.auto_scroll.cancel();
         self.prepare.cancel_pointer_gesture();
         self.content.cancel_pointer_gesture();
@@ -729,6 +733,7 @@ impl DocView {
             fill_signature_page: None,
             signature_drag: Default::default(),
             cursor: Default::default(),
+            router: Default::default(),
             press_cancelled: false,
         }
     }
@@ -1124,6 +1129,11 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     let PageFrame { resp, ptr, pointer, .. } = *frame;
     let cx = PageToolContext { ui, resp, xf: &xf, ptr, page: i, doc, info };
     let pcx = comments::PageCx { page: i, xf: &xf, ptr, info, tool, prefs, allowed, hidden: comments_hidden, redact_mark };
+    let hits = |view: &DocView, p: Pos2| [link_hit(info, &xf, i, p), comments::hit(&pcx, view, p)].into_iter().flatten();
+    if let Some(o) = ptr.pressed().filter(|o| xf.rect.contains(*o)) {
+        let at = hits(view, o).collect::<Vec<_>>();
+        view.router.press(i, at, tool);
+    }
     if let QuickTool::Measure(measure_tool) = tool {
         crate::measure_ui::page_input(ui, resp, doc, view, &pcx, measure_tool, units);
     }
@@ -1326,6 +1336,15 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         view.links.context = Some((i, l.index));
     }
     let consumed = on_objects || on_edit_text || on_link || on_content || boxing || on_field || comments::page_input(ui, resp, &pcx, view);
+    // The cursor and the tip from what lies under the pointer, after the tools claimed theirs (the
+    // last claim on a layer stands).
+    if frame.env.unobstructed
+        && let Some(p) = pointer
+    {
+        for h in hits(view, p).collect::<Vec<_>>() {
+            view.cursor.claim_with_tip(h.layer, h.icon, h.tip);
+        }
+    }
     PageInput { consumed, area_tool }
 }
 
@@ -1430,8 +1449,10 @@ fn update_text_cursor(view: &mut DocView, gesture: &TextGesture<'_>) {
 }
 
 fn update_selection_on_press(ui: &egui::Ui, view: &mut DocView, text: &PageText, gesture: &TextGesture<'_>) {
+    // A press held by what keeps its drag (a link, a comment that moves) selects no text; one on
+    // text markup lets its drag select the text underneath.
     let press_here = gesture.ptr.origin.is_some_and(|origin| gesture.rect.contains(origin));
-    if gesture.ptr.pressed().is_some() && press_here && !gesture.over_link {
+    if gesture.ptr.pressed().is_some() && press_here && !view.router.keeps_drag() {
         let now = ui.input(|input| input.time);
         let (max_delay, max_dist) = ui.ctx().options(|options| (options.input_options.max_double_click_delay, options.input_options.max_click_dist));
         let consecutive = now - view.last_press_time <= max_delay && view.last_press_pos.is_some_and(|pos| pos.distance(gesture.pointer) <= max_dist);
@@ -1446,7 +1467,7 @@ fn update_selection_on_press(ui: &egui::Ui, view: &mut DocView, text: &PageText,
             view.selection = Some(Selection::run(gesture.page, first, last));
         }
     }
-    if gesture.resp.drag_started() && press_here && !gesture.over_link {
+    if gesture.resp.drag_started() && press_here && !view.router.keeps_drag() {
         view.actions_dismissed = None;
         view.selection_drag = true;
         let origin = gesture.ptr.origin.unwrap_or(gesture.pointer);
@@ -1518,7 +1539,7 @@ fn finish_text_pointer_gesture(ui: &egui::Ui, view: &mut DocView, text: &PageTex
         && let Some((first, last)) = text.nearest(gesture.vx, gesture.vy).and_then(|anchor| click_unit(text, clicks, anchor))
     {
         view.selection = Some(Selection::run(gesture.page, first, last));
-    } else if gesture.resp.clicked() && view.clicks < 2 && !gesture.over_link {
+    } else if gesture.resp.clicked() && view.clicks < 2 && !view.router.keeps_drag() {
         let shift = ui.input(|input| input.modifiers.shift);
         match (
             view.selection.as_mut().filter(|selection| shift && selection.page == gesture.page).map(|selection| &mut selection.span),
@@ -1606,25 +1627,14 @@ fn page_overlays(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_
     // Links: the hand and the link's target, which count only for the tools that follow or
     // edit links (`Layer::reached_by`). Tips draw above the palette, so none shows while it is
     // open, even beside it.
-    if unobstructed && let Some(p) = pointer {
-        for l in info.links.iter().filter(|l| l.page == i) {
-            let sr = xf.user_rect(info, i, l.rect);
-            if sr.contains(p) {
-                let label = match &l.target {
-                    LinkTarget::Page(n, _) => {
-                        crate::i18n::fmt(tl!("Go to page {p}"), &[("p", info.pages.get(*n).map(|p| p.label.as_str()).unwrap_or("?"))])
-                    }
-                    LinkTarget::Uri(u) => u.clone(),
-                    LinkTarget::SetLayers { .. } => tl!("Set layer visibility").to_string(),
-                    LinkTarget::RemoteGoTo { file, .. } => file.clone(),
-                    LinkTarget::Other(s) => crate::i18n::fmt(tl!("{s} action"), &[("s", s)]),
-                };
-                view.cursor.claim_with_tip(Layer::Link, egui::CursorIcon::PointingHand, Some(label));
-                if resp.clicked() && tool == QuickTool::Select && !input.consumed {
-                    frame.out.clicked_link = Some(l.target.clone());
-                }
-            }
-        }
+    if unobstructed
+        && resp.clicked()
+        && tool == QuickTool::Select
+        && !input.consumed
+        && let Some(crate::page_router::Owner::Link { index }) = view.router.owner(i)
+        && let Some(l) = info.links.get(index)
+    {
+        frame.out.clicked_link = Some(l.target.clone());
     }
     // Comments say what they are with any tool, beside its cursor, as Acrobat's do.
     comments::describe(&pcx, view);
@@ -1759,6 +1769,21 @@ fn draw_page(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, i
     page_overlays(ui, view, frame, &slot, &input);
 }
 
+/// The link under `p` on `page`: the hand, and where a click goes. Only the Select tool follows
+/// links and the Link tool edits them (`Layer::reached_by`).
+fn link_hit(info: &DocInfo, xf: &PageXform, page: usize, p: Pos2) -> Option<crate::page_router::Hit> {
+    let (index, l) = info.links.iter().enumerate().rfind(|(_, l)| l.page == page && xf.user_rect(info, page, l.rect).contains(p))?;
+    let label = match &l.target {
+        LinkTarget::Page(n, _) => crate::i18n::fmt(tl!("Go to page {p}"), &[("p", info.pages.get(*n).map(|p| p.label.as_str()).unwrap_or("?"))]),
+        LinkTarget::Uri(u) => u.clone(),
+        LinkTarget::SetLayers { .. } => tl!("Set layer visibility").to_string(),
+        LinkTarget::RemoteGoTo { file, .. } => file.clone(),
+        LinkTarget::Other(s) => crate::i18n::fmt(tl!("{s} action"), &[("s", s)]),
+    };
+    let owner = crate::page_router::Owner::Link { index };
+    Some(crate::page_router::Hit { tip: Some(label), ..crate::page_router::Hit::new(owner, Layer::Link, egui::CursorIcon::PointingHand) })
+}
+
 /// Escape while the pages hold a press abandons the gesture it drives, whichever tool's: nothing is
 /// placed, drawn, moved, resized or opened, and the press is ignored until the button is up. The
 /// frame of the release still belongs to the cancelled press.
@@ -1853,6 +1878,7 @@ fn draw_pages(
     // or a press they hold. The page modules read it rather than egui's raw pointer state.
     let ptr = PagePointer::read(ui, &resp, modal);
     cancel_on_escape(ui.ctx(), view, &ptr);
+    view.router.settle(ptr.any_down, !ptr.edges.is_empty());
     let pointer = ptr.pos;
     // A press on a page makes it the current one (as in Acrobat), so a page command with
     // no selection (Rotate, Delete) acts on the page the reader pointed at, not on a page
diff --git a/crates/ui-egui/src/canvas/page_router.rs b/crates/ui-egui/src/canvas/page_router.rs
new file mode 100644
index 0000000000..82769bd8f4
--- /dev/null
+++ b/crates/ui-egui/src/canvas/page_router.rs
@@ -0,0 +1,151 @@
+//! Who a press on the pages belongs to.
+//!
+//! Each page module answers "what of mine is under this point?" in one place, its hit test, and
+//! the answer is a [`Hit`]: what is there ([`Owner`]), on which [`Layer`], with which cursor and
+//! tip. The pointer's hits set the cursor and the tip; on the frame of a press, the hits at the
+//! press point decide who captures it ([`PageRouter::press`]), by the same table: the highest layer
+//! the active tool reaches. Until the button is up only the owner acts on the press, its drag and
+//! its release, so what the cursor promised is what the press does, and nothing takes a gesture
+//! back halfway.
+
+use egui::CursorIcon;
+
+use crate::QuickTool;
+use crate::page_cursor::Layer;
+
+/// What a hit is on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Owner {
+    /// A comment (or a Fill & Sign mark), by its `/Annots` index, and the part of it.
+    Comment { index: usize, part: CommentPart },
+    /// A link, by its index in the document's links.
+    Link { index: usize },
+}
+
+/// The part of a comment a hit is on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum CommentPart {
+    /// The comment itself: a drag moves it, a click selects it.
+    Body,
+    /// A resize handle of the selected comment: (-1, 0 or 1) across, then down.
+    Handle(i8, i8),
+    /// A point of the selected line, polygon or cloud.
+    Point(usize),
+}
+
+/// What lies under a point, for one page module.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Hit {
+    pub owner: Owner,
+    pub layer: Layer,
+    pub icon: CursorIcon,
+    /// Beside the pointer where this hit wins (a link's target).
+    pub tip: Option<String>,
+    /// A drag from here is not this owner's: a click on a highlight selects it, a drag across it
+    /// selects the text underneath.
+    pub declines_drag: bool,
+}
+
+impl Hit {
+    pub(crate) fn new(owner: Owner, layer: Layer, icon: CursorIcon) -> Self {
+        Hit { owner, layer, icon, tip: None, declines_drag: false }
+    }
+}
+
+/// The hit that wins among `hits` with `tool`: the highest layer the tool reaches, the last of
+/// equals (modules are asked bottom up, in paint order).
+pub(crate) fn top(hits: impl IntoIterator<Item = Hit>, tool: QuickTool) -> Option<Hit> {
+    hits.into_iter().filter(|h| h.layer.reached_by(tool)).fold(None, |best: Option<Hit>, h| match best {
+        Some(b) if b.layer > h.layer => Some(b),
+        _ => Some(h),
+    })
+}
+
+/// A press the pages hold, and who it belongs to.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Capture {
+    pub page: usize,
+    pub owner: Owner,
+    pub declines_drag: bool,
+}
+
+/// The press the pages hold, from its frame until the button is up.
+#[derive(Debug, Default)]
+pub(crate) struct PageRouter {
+    capture: Option<Capture>,
+}
+
+impl PageRouter {
+    /// A press on `page`: `hits` at the press point decide who it belongs to. A press nobody's
+    /// hit claims is held by nobody (the page's text, or a tool that acts anywhere on the page).
+    pub(crate) fn press(&mut self, page: usize, hits: impl IntoIterator<Item = Hit>, tool: QuickTool) {
+        self.capture = top(hits, tool).map(|h| Capture { page, owner: h.owner, declines_drag: h.declines_drag });
+    }
+
+    /// Who holds the press on `page`.
+    pub(crate) fn owner(&self, page: usize) -> Option<Owner> {
+        self.capture.as_ref().filter(|c| c.page == page).map(|c| c.owner)
+    }
+
+    /// Whether the press is held by someone who keeps its drag: then the page's text is not
+    /// selected by it.
+    pub(crate) fn keeps_drag(&self) -> bool {
+        self.capture.as_ref().is_some_and(|c| !c.declines_drag)
+    }
+
+    /// The press is over once the button is up and its release has been seen.
+    pub(crate) fn settle(&mut self, any_down: bool, edges: bool) {
+        if !any_down && !edges {
+            self.capture = None;
+        }
+    }
+
+    /// Drops the press (Escape, a dialog, automation's cancel).
+    pub(crate) fn cancel(&mut self) {
+        self.capture = None;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn hit(layer: Layer, index: usize) -> Hit {
+        Hit::new(Owner::Comment { index, part: CommentPart::Body }, layer, CursorIcon::Move)
+    }
+
+    #[test]
+    fn the_highest_reached_layer_wins_and_the_last_of_equals() {
+        let hits = [hit(Layer::Comment, 0), hit(Layer::Link, 1), hit(Layer::Comment, 2)];
+        assert_eq!(top(hits.clone(), QuickTool::Select).map(|h| h.owner), Some(hits[2].owner));
+        // A stamp reaches neither links nor comments.
+        let stamp = QuickTool::Stamp(pdfcraft_engine::StampKind::DynApproved);
+        assert_eq!(top(hits, stamp), None);
+        assert_eq!(top([hit(Layer::Placed, 3), hit(Layer::Comment, 4)], stamp).map(|h| h.owner), Some(hit(Layer::Placed, 3).owner));
+    }
+
+    #[test]
+    fn a_press_is_held_until_the_button_is_up_and_its_release_seen() {
+        let mut r = PageRouter::default();
+        r.press(2, [hit(Layer::Comment, 7)], QuickTool::Select);
+        assert_eq!(r.owner(2), Some(hit(Layer::Comment, 7).owner));
+        assert_eq!(r.owner(1), None, "only on its page");
+        assert!(r.keeps_drag());
+        r.settle(false, true);
+        assert!(r.owner(2).is_some(), "the release frame still belongs to the press");
+        r.settle(false, false);
+        assert_eq!(r.owner(2), None);
+        r.press(0, [], QuickTool::Select);
+        assert_eq!(r.owner(0), None, "a press nobody claims is held by nobody");
+        assert!(!r.keeps_drag());
+    }
+
+    #[test]
+    fn a_highlight_lets_its_drag_go_to_the_text() {
+        let mut r = PageRouter::default();
+        r.press(0, [Hit { declines_drag: true, ..hit(Layer::Comment, 0) }], QuickTool::Select);
+        assert!(r.owner(0).is_some() && !r.keeps_drag());
+        r.cancel();
+        assert_eq!(r.owner(0), None);
+    }
+}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 8a8c51775a..317c2b45c6 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -77,6 +77,7 @@ use canvas::fling;
 use canvas::image_pick;
 use canvas::page_cursor;
 use canvas::page_pointer;
+use canvas::page_router;
 pub use canvas::scroll_speed;
 use canvas::signature_drag;
 use canvas::wheel_boost;
diff --git a/crates/ui-egui/src/tools/comments.rs b/crates/ui-egui/src/tools/comments.rs
index 5909fdd423..ac1d82ea97 100644
--- a/crates/ui-egui/src/tools/comments.rs
+++ b/crates/ui-egui/src/tools/comments.rs
@@ -37,7 +37,7 @@ pub(crate) use geometry::{corner_ratio, page_rotation, resized};
 pub use geometry::{drawn_text_box_rect, text_box_rect};
 #[cfg(test)]
 use input::hover_tip;
-pub(crate) use input::{describe, fill_grabs, keys, nudge_keys, page_after_text, page_input, select_grabs};
+pub(crate) use input::{describe, fill_grabs, hit, keys, nudge_keys, page_after_text, page_input, select_grabs};
 pub use menu::{CanvasAction, fill_picker, recent_custom_colours, remember_custom_colour, status_badge, swatch_grid};
 #[cfg(test)]
 use menu::{RECENT_CUSTOM, same_colour};
diff --git a/crates/ui-egui/src/tools/comments/input.rs b/crates/ui-egui/src/tools/comments/input.rs
index af78a1e46a..102767b6cb 100644
--- a/crates/ui-egui/src/tools/comments/input.rs
+++ b/crates/ui-egui/src/tools/comments/input.rs
@@ -6,6 +6,7 @@ use super::paint::{drawn_shape, edit_anchor, erase, new_comment};
 use super::state::{Composer, ComposerKind, Gesture, PageCx};
 use super::{Annotation, CommentPrefs, CommentTool, DocInfo, DocView, Edit, Pos2, QuickTool, Rect, Shape, vec2};
 use crate::page_cursor::{Layer, Subject};
+use crate::page_router::{CommentPart, Hit, Owner};
 
 /// Comment input on one page, before text selection runs. Returns `true` when the pointer
 /// gesture belongs to commenting (text selection must ignore it).
@@ -34,79 +35,104 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>,
     }
     let gestures = Gestures { ui, resp, cx, pointer, origin, page_rect, pressed_here, over_page };
     match cx.tool {
-        QuickTool::Comment(_) if draw_grab => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
+        QuickTool::Comment(_) if draw_grab => select_input(ui, resp, cx, view, pointer, origin),
         QuickTool::Comment(tool) if tool.draws() => gestures.draw_shape(view, tool),
         QuickTool::Comment(tool) if tool.clicks_points() => gestures.click_points(view, tool),
         QuickTool::Comment(CommentTool::Callout) => gestures.callout(view),
         QuickTool::Comment(CommentTool::Attach) => gestures.attach(view),
         QuickTool::Comment(CommentTool::Caret) => gestures.caret(view, caret_text.as_deref()),
         QuickTool::Comment(tool @ (CommentTool::Note | CommentTool::TextBox)) => gestures.note_or_box(view, tool),
-        QuickTool::Select => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
-        QuickTool::Fill(_) if fill_grab => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
+        QuickTool::Select => select_input(ui, resp, cx, view, pointer, origin),
+        QuickTool::Fill(_) if fill_grab => select_input(ui, resp, cx, view, pointer, origin),
         _ => false,
     }
 }
 
-/// With a Fill & Sign tool, the Fill & Sign marks already on the page are picked up as with the
-/// Select tool, as in Acrobat: hovering one shows the move cursor, a click selects it, a drag
-/// moves it and the selected one's handles resize it. Elsewhere the tool places its mark. While
-/// the button is down the press decides; otherwise the pointer (egui clears the press origin on
-/// release, so a click is located by the pointer).
+/// What of the comments lies under `p`, for the cursor, the tip and the press: the one hit test
+/// of this module. With the Select tool, the selected comment's point handles, then its resize
+/// handles, then the topmost comment. With a Fill & Sign tool, the same over Fill & Sign's marks
+/// only, as Acrobat picks them up: a press anywhere else places the tool's mark. With a shape
+/// tool (rectangle, oval, line, polygon…), only the selected comment's handles, so the shape just
+/// drawn can be resized straight away (#2338); a press anywhere else, the shape itself included,
+/// draws. `None` with other tools, off the page, or with comments hidden.
+pub(crate) fn hit(cx: &PageCx<'_>, view: &DocView, p: Pos2) -> Option<Hit> {
+    if cx.hidden || !cx.xf.rect.contains(p) {
+        return None;
+    }
+    let pick: fn(&Annotation) -> bool = match cx.tool {
+        QuickTool::Select => |_| true,
+        QuickTool::Fill(_) => |a| a.fill_sign,
+        QuickTool::Comment(tool) if (tool.draws() || tool.clicks_points()) && tool != CommentTool::Eraser => {
+            // A polygon being clicked out keeps its clicks, even near an old shape's handle.
+            if view.comments.gesture.is_some() {
+                return None;
+            }
+            |_| true
+        }
+        _ => return None,
+    };
+    let bodies = matches!(cx.tool, QuickTool::Select | QuickTool::Fill(_));
+    if let Some(a) = view.comments.selected.filter(|(page, _)| *page == cx.page).and_then(|(_, i)| cx.get(i)).filter(|a| pick(a) && cx.allowed) {
+        if grabs_points(cx.tool)
+            && reshapable(a)
+            && let Some(point) = point_handle(cx, a, p)
+        {
+            return Some(Hit::new(Owner::Comment { index: a.index, part: CommentPart::Point(point) }, Layer::Handle, egui::CursorIcon::Crosshair));
+        }
+        if resizable(a)
+            && let Some((x, y)) = HANDLES.into_iter().find(|h| handle_pos(cx.screen_rect(a), *h).distance(p) <= 7.0)
+        {
+            let icon = match (x, y) {
+                (0, _) => egui::CursorIcon::ResizeVertical,
+                (_, 0) => egui::CursorIcon::ResizeHorizontal,
+                (-1, -1) | (1, 1) => egui::CursorIcon::ResizeNwSe,
+                _ => egui::CursorIcon::ResizeNeSw,
+            };
+            return Some(Hit::new(Owner::Comment { index: a.index, part: CommentPart::Handle(x, y) }, Layer::Handle, icon));
+        }
+    }
+    let a = cx.hit(p).filter(|a| bodies && pick(a))?;
+    // A click on a highlight over a link follows the link, so the link's hand and tip show there.
+    if cx.tool == QuickTool::Select && a.subtype == "Highlight" && on_link(cx, p) {
+        return None;
+    }
+    let markup = is_markup(&a.subtype);
+    let icon = if cx.allowed && !markup { egui::CursorIcon::Move } else { egui::CursorIcon::PointingHand };
+    // Signatures and Fill & Sign's marks are placed on the page rather than comments on it.
+    let layer = if a.fill_sign { Layer::Placed } else { Layer::Comment };
+    // Text markup does not move: a click selects it, a drag across it selects the text.
+    Some(Hit { declines_drag: markup, ..Hit::new(Owner::Comment { index: a.index, part: CommentPart::Body }, layer, icon) })
+}
+
+/// Whether the comments take the press on this page (or, with no button down, would take one
+/// under the pointer), so the tools beneath leave it: a live move, resize or reshape, or a press
+/// held by a comment that keeps its drag.
+fn grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
+    if matches!(view.comments.gesture, Some(Gesture::Move { page, .. } | Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page)
+    {
+        return true;
+    }
+    if cx.ptr.any_down {
+        return matches!(view.router.owner(cx.page), Some(Owner::Comment { .. })) && view.router.keeps_drag();
+    }
+    cx.ptr.pos.and_then(|p| hit(cx, view, p)).is_some_and(|h| !h.declines_drag)
+}
+
+/// With a Fill & Sign tool, a Fill & Sign mark already on the page is picked up as with the Select
+/// tool ([`hit`]), so the tool does not place a mark there.
 pub(crate) fn fill_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
-    matches!(cx.tool, QuickTool::Fill(_)) && grabs(cx, view, |a| a.fill_sign)
+    matches!(cx.tool, QuickTool::Fill(_)) && grabs(cx, view)
 }
 
 /// With the Select tool, a comment that would move (not text markup) is picked up before a form
 /// field under it, so a signature placed over a field can still be dragged off it.
 pub(crate) fn select_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
-    cx.tool == QuickTool::Select && grabs(cx, view, |a| !is_markup(&a.subtype))
+    cx.tool == QuickTool::Select && grabs(cx, view)
 }
 
-/// With a shape tool (rectangle, oval, line, polygon…), the selected comment's resize handles
-/// are picked up as with the Select tool, so the shape just drawn can be resized straight away
-/// (#2338). Only the handles: a press anywhere else, the shape itself included, still draws.
-pub(crate) fn draw_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
-    let QuickTool::Comment(tool) = cx.tool else { return false };
-    if !(tool.draws() || tool.clicks_points()) || tool == CommentTool::Eraser || cx.hidden {
-        return false;
-    }
-    let cv = &view.comments;
-    if matches!(cv.gesture, Some(Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page) {
-        return true;
-    }
-    // A polygon being clicked out keeps its clicks, even near an old shape's handle.
-    if cv.gesture.is_some() {
-        return false;
-    }
-    press_point(cx).is_some_and(|p| on_handle(cx, view, p, |_| true))
-}
-
-/// Whether the press (or, with no button down, the pointer) is on a `pick` comment or on the
-/// selected one's resize handles.
-fn grabs(cx: &PageCx<'_>, view: &DocView, pick: impl Fn(&Annotation) -> bool) -> bool {
-    if cx.hidden {
-        return false;
-    }
-    if matches!(view.comments.gesture, Some(Gesture::Move { page, .. } | Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page)
-    {
-        return true;
-    }
-    let Some(p) = press_point(cx) else { return false };
-    on_handle(cx, view, p, &pick) || cx.hit(p).is_some_and(pick)
-}
-
-/// Where a gesture on this page is decided: the press while the button is down, otherwise the
-/// pointer (egui clears the press origin on release). `None` off the page.
-fn press_point(cx: &PageCx<'_>) -> Option<Pos2> {
-    (if cx.ptr.any_down { cx.ptr.origin } else { cx.ptr.pos }).filter(|p| cx.xf.rect.contains(*p))
-}
-
-/// Whether `p` is on a resize handle of the selected comment, when it is a resizable `pick`.
-fn on_handle(cx: &PageCx<'_>, view: &DocView, p: Pos2, pick: impl Fn(&Annotation) -> bool) -> bool {
-    view.comments.selected.filter(|(page, _)| *page == cx.page).and_then(|(_, i)| cx.get(i)).filter(|a| pick(a) && cx.allowed).is_some_and(|a| {
-        (resizable(a) && HANDLES.into_iter().any(|h| handle_pos(cx.screen_rect(a), h).distance(p) <= 7.0))
-            || (grabs_points(cx.tool) && reshapable(a) && point_handle(cx, a, p).is_some())
-    })
+/// With a shape tool, the selected comment's handles are picked up ([`hit`]).
+fn draw_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
+    matches!(cx.tool, QuickTool::Comment(_)) && grabs(cx, view)
 }
 
 /// Whether `p` is on one of this page's links.
@@ -149,80 +175,45 @@ pub(super) fn hover_tip(a: &Annotation, prefs: &CommentPrefs) -> Option<String>
     Some(if body.is_empty() { who } else { format!("{who}\n{body}") })
 }
 
-/// The Select tool: hover, select, move, resize, edit, delete.
-fn select_input(
-    ui: &egui::Ui,
-    resp: &egui::Response,
-    cx: &PageCx<'_>,
-    view: &mut DocView,
-    pointer: Option<Pos2>,
-    origin: Option<Pos2>,
-    pressed_here: bool,
-) -> bool {
-    let cv = &mut view.comments;
-    let selected = cv.selected.filter(|(p, _)| *p == cx.page).and_then(|(_, i)| cx.get(i));
-    // Handles of a selected, resizable comment.
-    let handle_at = |p: Pos2| -> Option<(i8, i8)> {
-        let a = selected.filter(|a| cx.allowed && resizable(a))?;
-        let r = cx.screen_rect(a);
-        HANDLES.into_iter().find(|h| handle_pos(r, *h).distance(p) <= 7.0)
+/// The Select tool: select, move, resize, edit, delete, on the comment the press was on (its
+/// owner, from [`hit`]). The cursor comes from [`hit`] too.
+fn select_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>, view: &mut DocView, pointer: Option<Pos2>, origin: Option<Pos2>) -> bool {
+    let owner = match view.router.owner(cx.page) {
+        Some(Owner::Comment { index, part }) => cx.get(index).map(|a| (a, part)),
+        _ => None,
     };
-    // Ends and corners of a selected line, connected lines, polygon or cloud.
-    let point_at =
-        |p: Pos2| -> Option<usize> { selected.filter(|a| cx.allowed && grabs_points(cx.tool) && reshapable(a)).and_then(|a| point_handle(cx, a, p)) };
+    let cv = &mut view.comments;
     let mut consumed = false;
-    if let Some(p) = pointer {
-        if point_at(p).is_some() {
-            view.cursor.claim(Layer::Handle, egui::CursorIcon::Crosshair);
-        } else if let Some(h) = handle_at(p) {
-            view.cursor.claim(
-                Layer::Handle,
-                match h {
-                    (0, _) => egui::CursorIcon::ResizeVertical,
-                    (_, 0) => egui::CursorIcon::ResizeHorizontal,
-                    (-1, -1) | (1, 1) => egui::CursorIcon::ResizeNwSe,
-                    _ => egui::CursorIcon::ResizeNeSw,
-                },
-            );
-        } else if let Some(a) = cx.hit(p)
-            // A click on a highlight over a link follows the link, so the link's hand and tip
-            // show there.
-            && !(a.subtype == "Highlight" && on_link(cx, p))
-        {
-            let movable = cx.allowed && !is_markup(&a.subtype);
-            let icon = if movable { egui::CursorIcon::Move } else { egui::CursorIcon::PointingHand };
-            // Signatures and Fill & Sign's marks are placed on the page rather than comments on it.
-            view.cursor.claim(if a.fill_sign { Layer::Placed } else { Layer::Comment }, icon);
-        }
-    }
     if resp.drag_started()
-        && pressed_here
-        && let Some(o) = origin
+        && let (Some((a, part)), Some(o)) = (owner, origin)
     {
-        if let (Some(point), Some(a)) = (point_at(o), selected) {
-            let points = a.points.iter().map(|q| [f64::from(q[0]), f64::from(q[1])]).collect();
-            cv.gesture = Some(Gesture::Reshape { page: cx.page, index: a.index, point, points });
-            consumed = true;
-        } else if let (Some(h), Some(a)) = (handle_at(o), selected) {
-            // On screen, the image is also turned by the view's rotation.
-            let turned = !cx.xf.rot.is_multiple_of(180);
-            let aspect_ratio = view.signature_drag.aspect_ratio(cx.page, a.index).map(|ratio| if turned { ratio.recip() } else { ratio });
-            // A drawn signature keeps its shape from the corners, as image signatures do.
-            let aspect_ratio = aspect_ratio.or_else(|| {
-                let r = cx.screen_rect(a);
-                (a.fill_sign && a.subtype == "Ink" && r.height() > 0.0).then(|| r.width() / r.height())
-            });
-            cv.gesture = Some(Gesture::Resize { page: cx.page, index: a.index, handle: h, from: o, aspect_ratio });
-            consumed = true;
-        } else if let Some(a) = cx.hit(o)
-            && !is_markup(&a.subtype)
-        {
-            cv.selected = Some((cx.page, a.index));
-            cv.reveal = true;
-            if cx.allowed {
-                cv.gesture = Some(Gesture::Move { page: cx.page, index: a.index, from: o });
+        match part {
+            CommentPart::Point(point) => {
+                let points = a.points.iter().map(|q| [f64::from(q[0]), f64::from(q[1])]).collect();
+                cv.gesture = Some(Gesture::Reshape { page: cx.page, index: a.index, point, points });
+                consumed = true;
             }
-            consumed = true;
+            CommentPart::Handle(x, y) => {
+                // On screen, the image is also turned by the view's rotation.
+                let turned = !cx.xf.rot.is_multiple_of(180);
+                let aspect_ratio = view.signature_drag.aspect_ratio(cx.page, a.index).map(|ratio| if turned { ratio.recip() } else { ratio });
+                // A drawn signature keeps its shape from the corners, as image signatures do.
+                let aspect_ratio = aspect_ratio.or_else(|| {
+                    let r = cx.screen_rect(a);
+                    (a.fill_sign && a.subtype == "Ink" && r.height() > 0.0).then(|| r.width() / r.height())
+                });
+                cv.gesture = Some(Gesture::Resize { page: cx.page, index: a.index, handle: (x, y), from: o, aspect_ratio });
+                consumed = true;
+            }
+            CommentPart::Body if !is_markup(&a.subtype) => {
+                cv.selected = Some((cx.page, a.index));
+                cv.reveal = true;
+                if cx.allowed {
+                    cv.gesture = Some(Gesture::Move { page: cx.page, index: a.index, from: o });
+                }
+                consumed = true;
+            }
+            CommentPart::Body => {}
         }
     }
     if matches!(cv.gesture, Some(Gesture::Move { page, .. } | Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page) {
@@ -266,15 +257,10 @@ fn select_input(
     // (egui clears the press origin on release, so clicks are located by the pointer.)
     let on_page = pointer.is_some_and(|p| cx.xf.rect.contains(p));
     if resp.clicked() && on_page {
-        let follow_link =
-            cx.tool == QuickTool::Select && !consumed && cv.gesture.is_none() && !resp.double_clicked() && pointer.is_some_and(|p| on_link(cx, p));
-        match pointer.and_then(|p| cx.hit(p)) {
-            Some(a) if a.subtype == "Highlight" && follow_link => {
-                // A plain click follows the link beneath text highlighting. Keep other
-                // annotations and active gestures in control of their own input.
-                cv.selected = None;
-            }
-            Some(a) => {
+        // A click elsewhere (a link beneath text highlighting included: it follows the link)
+        // leaves comments unselected.
+        match owner {
+            Some((a, _)) => {
                 cv.selected = Some((cx.page, a.index));
                 cv.reveal = true;
                 consumed = true;
@@ -285,7 +271,7 @@ fn select_input(
     if resp.double_clicked()
         && on_page
         && cx.allowed
-        && let Some(a) = pointer.and_then(|p| cx.hit(p))
+        && let Some((a, _)) = owner
     {
         cv.selected = Some((cx.page, a.index));
         cv.composer = Some(Composer {
diff --git a/crates/ui-egui/src/tools/comments/state.rs b/crates/ui-egui/src/tools/comments/state.rs
index 36149bb2a0..3bcb12f90d 100644
--- a/crates/ui-egui/src/tools/comments/state.rs
+++ b/crates/ui-egui/src/tools/comments/state.rs
@@ -307,9 +307,10 @@ impl PageCx<'_> {
             .collect()
     }
 
-    /// The topmost comment under `p`.
+    /// The topmost comment under `p`: the one drawn last, in `/Annots` order (inspection lists
+    /// comments by position, not in paint order).
     pub(super) fn hit(&self, p: Pos2) -> Option<&Annotation> {
-        self.comments().filter(|a| self.screen_rects(a).any(|r| r.expand(3.0).contains(p))).last()
+        self.comments().filter(|a| self.screen_rects(a).any(|r| r.expand(3.0).contains(p))).max_by_key(|a| a.index)
     }
 
     pub(crate) fn get(&self, index: usize) -> Option<&Annotation> {
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index 442eade9ea..fbd3d720e4 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -296,11 +296,23 @@ fn a_links_tip_shows_only_with_its_hand() {
     assert_eq!(hover(&mut h, rectangle, 3.0), (Crosshair, false), "a drag draws a rectangle");
 }
 
+/// A drag from plain text onto a link still selects the text: the press decides, not where the
+/// pointer has got to once egui calls it a drag.
+#[test]
+fn a_drag_from_text_onto_a_link_selects_the_text() {
+    let mut h = open(linked_text_pdf(), "150", false);
+    // "before you start." lies right of the link, which covers x 40..160.
+    let (plain, linked) = (at(&h, 200.0, 303.0), at(&h, 100.0, 303.0));
+    assert_eq!(wait_for_cursor(&mut h, plain, |c| c == egui::CursorIcon::Text), egui::CursorIcon::Text, "the page's text has arrived");
+    mouse_drag(&mut h, plain, linked - plain);
+    let selected = h.state().views[0].selected_text().unwrap_or_default();
+    assert!(selected.contains("example.org"), "the drag selected across the link: {selected:?}");
+}
+
 /// Over two comments the tip names the one drawn on top (#3620), and a click should select that
 /// one too. The renderer paints in `/Annots` order, but the hit test takes the last comment in
 /// inspection's order, which is by top edge, and selects the one underneath.
 #[test]
-#[ignore = "step 3 of the page pointer router: one hit test"]
 fn a_click_on_stacked_comments_selects_the_one_drawn_on_top() {
     let mut h = open(stacked_comments_pdf(), "150", false);
     let overlap = at(&h, 125.0, 225.0);

From 7d72f21da366fbb09fa9d02830b2c43d5c60f4fa Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 12:21:35 +0100
Subject: [PATCH 130/270] fix(ui): the area and placement tools act only on
 their own presses, of the primary button

The Sign area, marquee zoom and snapshot, crop and redaction boxes, and the stamps, act where
nothing drawn over the page holds the press (the page router has no owner for it), rather than
wherever the press lands on the page. Fill & Sign already asks the router (fill_grabs).

Their drags start on the primary button and end with its release, however egui reported it:
its drag stop, or the button found up. They started on any button, so a right-drag drew a
signature rectangle and opened the signing dialog (and drew a crop or a marquee), and the end
waited for a pointer position, so a drag whose release came without one never ended.

New test a_right_drag_draws_no_signature_rectangle, seen failing with the drag started on any
button.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs           |  6 ++++--
 crates/ui-egui/src/canvas/crop.rs      |  9 ++++++---
 crates/ui-egui/src/canvas/zoom_snap.rs |  9 ++++++---
 crates/ui-egui/src/tools/redact_ui.rs  |  3 ++-
 crates/ui-egui/src/tools/sign_ui.rs    |  9 ++++++---
 crates/ui-egui/tests/it/pointer.rs     | 21 +++++++++++++++++++++
 6 files changed, 45 insertions(+), 12 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index d67b18b802..f2b5720190 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1145,7 +1145,8 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         && let Some(p) = ptr.within(xf.rect)
     {
         view.cursor.claim(Layer::ToolArea, egui::CursorIcon::Crosshair);
-        if resp.clicked() {
+        // The tool's own click: nothing drawn over the page here holds the press.
+        if resp.clicked() && view.router.owner(i).is_none() {
             // Centred on the click, upright as the page is shown.
             let (vx, vy) = xf.screen_to_view(p);
             let (w, h) = kind.size();
@@ -1169,7 +1170,8 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         && let Some(p) = ptr.within(xf.rect)
     {
         view.cursor.claim(Layer::ToolArea, egui::CursorIcon::Crosshair);
-        if resp.clicked() {
+        // The tool's own click: nothing drawn over the page here holds the press.
+        if resp.clicked() && view.router.owner(i).is_none() {
             // Centred on the click at its natural size (the engine sizes it).
             let (vx, vy) = xf.screen_to_view(p);
             let u = info.pages[i].view_to_user(vx, vy);
diff --git a/crates/ui-egui/src/canvas/crop.rs b/crates/ui-egui/src/canvas/crop.rs
index dd88db1a19..bdd1e9e135 100644
--- a/crates/ui-egui/src/canvas/crop.rs
+++ b/crates/ui-egui/src/canvas/crop.rs
@@ -38,15 +38,18 @@ pub(crate) fn page_input(ui: &egui::Ui, input: CropPageInput<'_>) -> bool {
     if !allowed {
         return false;
     }
-    if resp.drag_started()
+    // The tool's own press, of the primary button: nothing drawn over the page here holds it.
+    if resp.drag_started_by(egui::PointerButton::Primary)
+        && view.router.owner(page).is_none()
         && let Some(o) = origin.filter(|o| xf.rect.contains(*o))
     {
         view.crop_drag = Some((page, o));
     }
     if let Some((p, start)) = view.crop_drag
         && p == page
-        && let Some(end) = pointer
     {
+        // Where the pointer is, or where it went down when it is off the window.
+        let end = pointer.unwrap_or(start);
         let end = Pos2::new(end.x.clamp(xf.rect.left(), xf.rect.right()), end.y.clamp(xf.rect.top(), xf.rect.bottom()));
         let r = Rect::from_two_pos(start, end);
         // Dim what will be cut away.
@@ -60,7 +63,7 @@ pub(crate) fn page_input(ui: &egui::Ui, input: CropPageInput<'_>) -> bool {
             painter.rect_filled(band, CornerRadius::ZERO, Color32::from_black_alpha(70));
         }
         painter.rect_stroke(r, CornerRadius::ZERO, Stroke::new(1.0, Color32::from_rgb(0x14, 0x73, 0xE6)), egui::StrokeKind::Middle);
-        if resp.drag_stopped() {
+        if resp.drag_stopped() || !ptr.primary_down {
             view.crop_drag = None;
             if r.width() >= 4.0 && r.height() >= 4.0 {
                 let (a, b) = (to_user(xf, info, page, r.left_top()), to_user(xf, info, page, r.right_bottom()));
diff --git a/crates/ui-egui/src/canvas/zoom_snap.rs b/crates/ui-egui/src/canvas/zoom_snap.rs
index 8e530ac58e..5a0dcf6733 100644
--- a/crates/ui-egui/src/canvas/zoom_snap.rs
+++ b/crates/ui-egui/src/canvas/zoom_snap.rs
@@ -19,19 +19,22 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, p
     if pointer.is_some_and(|p| xf.rect.contains(p)) {
         view.cursor.claim(Layer::ToolArea, egui::CursorIcon::Crosshair);
     }
-    if resp.drag_started()
+    // The tool's own press, of the primary button: nothing drawn over the page here holds it.
+    if resp.drag_started_by(egui::PointerButton::Primary)
+        && view.router.owner(page).is_none()
         && let Some(o) = origin.filter(|o| xf.rect.contains(*o))
     {
         view.marquee = Some((page, o));
     }
     if let Some((p, start)) = view.marquee
         && p == page
-        && let Some(end) = pointer
     {
+        // Where the pointer is, or where it went down when it is off the window.
+        let end = pointer.unwrap_or(start);
         let end = Pos2::new(end.x.clamp(xf.rect.left(), xf.rect.right()), end.y.clamp(xf.rect.top(), xf.rect.bottom()));
         let r = Rect::from_two_pos(start, end);
         ui.painter().rect_stroke(r, CornerRadius::ZERO, Stroke::new(1.0, Color32::from_rgb(0x14, 0x73, 0xE6)), egui::StrokeKind::Middle);
-        if resp.drag_stopped() {
+        if resp.drag_stopped() || !ptr.primary_down {
             view.marquee = None;
             let (a, b) = (xf.screen_to_view(r.left_top()), xf.screen_to_view(r.right_bottom()));
             view.marquee_done = Some((page, r, [a.0.min(b.0), a.1.min(b.1), a.0.max(b.0), a.1.max(b.1)]));
diff --git a/crates/ui-egui/src/tools/redact_ui.rs b/crates/ui-egui/src/tools/redact_ui.rs
index e5c2ac06e5..96b544b4d0 100644
--- a/crates/ui-egui/src/tools/redact_ui.rs
+++ b/crates/ui-egui/src/tools/redact_ui.rs
@@ -256,7 +256,8 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, over_text: impl Fn(Pos2) -> bo
     if !over_text(p) {
         view.cursor.claim(Layer::ToolArea, egui::CursorIcon::Crosshair);
     }
-    if resp.drag_started() {
+    // The tool's own press, of the primary button: nothing drawn over the page here holds it.
+    if resp.drag_started_by(egui::PointerButton::Primary) && view.router.owner(page).is_none() {
         let origin = ptr.origin.unwrap_or(p);
         if !over_text(origin) {
             view.redact_drag = Some((page, origin));
diff --git a/crates/ui-egui/src/tools/sign_ui.rs b/crates/ui-egui/src/tools/sign_ui.rs
index 921f9a738d..b00d07279a 100644
--- a/crates/ui-egui/src/tools/sign_ui.rs
+++ b/crates/ui-egui/src/tools/sign_ui.rs
@@ -176,20 +176,23 @@ pub(crate) fn page_input(
     if pointer.is_some_and(|p| xf.rect.contains(p)) {
         view.cursor.claim(Layer::ToolArea, egui::CursorIcon::Crosshair);
     }
-    if resp.drag_started()
+    // The tool's own press, of the primary button: nothing drawn over the page here holds it.
+    if resp.drag_started_by(egui::PointerButton::Primary)
+        && view.router.owner(page).is_none()
         && let Some(o) = origin.filter(|o| xf.rect.contains(*o))
     {
         view.sign.drag = Some((page, o));
     }
     if let Some((p, start)) = view.sign.drag
         && p == page
-        && let Some(end) = pointer
     {
+        // Where the pointer is, or where it went down when it is off the window.
+        let end = pointer.unwrap_or(start);
         let end = Pos2::new(end.x.clamp(xf.rect.left(), xf.rect.right()), end.y.clamp(xf.rect.top(), xf.rect.bottom()));
         let r = Rect::from_two_pos(start, end);
         ui.painter().rect_filled(r, CornerRadius::ZERO, Color32::from_rgba_unmultiplied(0x14, 0x73, 0xE6, 28));
         ui.painter().rect_stroke(r, CornerRadius::ZERO, Stroke::new(1.0, Color32::from_rgb(0x14, 0x73, 0xE6)), egui::StrokeKind::Middle);
-        if resp.drag_stopped() {
+        if resp.drag_stopped() || !ptr.primary_down {
             view.sign.drag = None;
             if r.width() >= 8.0 && r.height() >= 8.0 {
                 let user = |q: Pos2| {
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index fbd3d720e4..4a28943b11 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -744,6 +744,27 @@ fn escape_cancels_a_signature_rectangle() {
     assert!(s.dialog.is_none(), "and no signing dialog opens: {:?}", s.dialog);
 }
 
+/// Only the primary button draws a signature rectangle: a right-drag opens no signing dialog.
+#[test]
+fn a_right_drag_draws_no_signature_rectangle() {
+    let mut h = open(link_pdf(), "150", false);
+    h.state_mut().quick_tool = QuickTool::SignArea { certify: false };
+    h.run_steps(4);
+    let (a, b) = (at(&h, 60.0, 200.0), at(&h, 200.0, 120.0));
+    let button = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Secondary, pressed, modifiers: egui::Modifiers::NONE };
+    h.hover_at(a);
+    h.run_steps(1);
+    h.event(button(a, true));
+    h.run_steps(1);
+    h.hover_at(b);
+    h.run_steps(2);
+    h.event(button(b, false));
+    h.run_steps(4);
+    let s = h.state();
+    assert_eq!(s.quick_tool, QuickTool::SignArea { certify: false }, "the tool stays: no rectangle was drawn");
+    assert!(s.dialog.is_none(), "and no signing dialog opens: {:?}", s.dialog);
+}
+
 /// Escape with the button down drops the press: its release places no stamp, and the next click
 /// places one.
 #[test]

From 63fa5010d80cb42396f9ccd09083eed56ddb7721 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 12:29:57 +0100
Subject: [PATCH 131/270] fix(ui): form fields and Prepare decide a press by
 one hit test

Forms: forms_ui::hit is the fields' only hit test (cursor and press). The press opens a text
field (#2213) and its click acts on the field the press was on, from the page router, instead
of the field under the release point: a press on one check box released over the one beside it
ticked the second. Now it ticks neither, as a button pressed and released off itself does
nothing. Forms no longer wait on comments::select_grabs: a comment that moves (a note, a shape,
a signature, a Fill & Sign mark) hits on the Placed layer, over form fields, so it still takes a
press over a field (a signature can be dragged off the field it covers), and text markup stays
on the Comment layer, under them, so a click on a box under a highlight ticks the box.
select_grabs goes.

Prepare Form: prepare::hit (the selected field's corner handles, then a field, on Placed so a
field being moved stays over the comments as before) gives the cursor, and the drag, click and
double click act on what the press was on; a press held by something else is not Prepare's.

New tests: a_press_on_one_check_box_released_over_another_ticks_neither (fails without this
commit: the second box is ticked) and a_check_box_under_a_highlight_takes_the_click (fails with
markup on the Placed layer).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs               | 28 +++++---
 crates/ui-egui/src/canvas/page_router.rs   |  6 ++
 crates/ui-egui/src/tools/comments.rs       |  2 +-
 crates/ui-egui/src/tools/comments/input.rs | 11 +--
 crates/ui-egui/src/tools/forms_ui.rs       | 78 +++++++++++++---------
 crates/ui-egui/src/tools/prepare.rs        | 75 +++++++++++++--------
 crates/ui-egui/tests/it/pointer.rs         | 59 ++++++++++++++++
 7 files changed, 184 insertions(+), 75 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index f2b5720190..4ec1ea6f4e 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1129,7 +1129,24 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     let PageFrame { resp, ptr, pointer, .. } = *frame;
     let cx = PageToolContext { ui, resp, xf: &xf, ptr, page: i, doc, info };
     let pcx = comments::PageCx { page: i, xf: &xf, ptr, info, tool, prefs, allowed, hidden: comments_hidden, redact_mark };
-    let hits = |view: &DocView, p: Pos2| [link_hit(info, &xf, i, p), comments::hit(&pcx, view, p)].into_iter().flatten();
+    let field_tool = match tool {
+        QuickTool::Field(f) => Some(f),
+        _ => None,
+    };
+    // While a table is being set up, nothing else is drawn or moved.
+    let prepare_allowed = can_modify && table_preview.is_none() && frame.out.open_table.is_none();
+    // What lies under a point, bottom up: links, comments, then form fields (Prepare's fields,
+    // being moved, over the comments; filled ones under the comments that move).
+    let hits = |view: &DocView, p: Pos2| {
+        let fields = if preparing {
+            crate::prepare::hit(&xf, info, i, form, field_tool, prepare_allowed, &view.prepare, p)
+        } else if tool == QuickTool::Select {
+            crate::forms_ui::hit(&xf, info, i, form, can_fill, p)
+        } else {
+            None
+        };
+        [link_hit(info, &xf, i, p), comments::hit(&pcx, view, p), fields].into_iter().flatten()
+    };
     if let Some(o) = ptr.pressed().filter(|o| xf.rect.contains(*o)) {
         let at = hits(view, o).collect::<Vec<_>>();
         view.router.press(i, at, tool);
@@ -1231,13 +1248,7 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         frame.out.open_boxes = true;
     }
     let on_field = if preparing {
-        let field_tool = match tool {
-            QuickTool::Field(f) => Some(f),
-            _ => None,
-        };
-        // While a table is being set up, nothing else is drawn or moved.
-        let allowed = can_modify && table_preview.is_none() && frame.out.open_table.is_none();
-        let o = crate::prepare::page_input(cx, form, field_tool, allowed, view);
+        let o = crate::prepare::page_input(cx, form, field_tool, prepare_allowed, view);
         frame.out.field_props |= o.properties;
         frame.out.field_placed |= o.placed;
         frame.out.open_table = frame.out.open_table.or(o.table);
@@ -1245,7 +1256,6 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     } else {
         tool == QuickTool::Select
             && !(editing_content && can_modify && crate::content_ui::select_grabs(&xf, ptr, i, info, added, view))
-            && !comments::select_grabs(&pcx, view)
             && crate::forms_ui::page_input(cx, form, can_fill, view)
     };
     // Redact draws boxes off text; so does Highlight (an area highlight, as in Acrobat).
diff --git a/crates/ui-egui/src/canvas/page_router.rs b/crates/ui-egui/src/canvas/page_router.rs
index 82769bd8f4..c5751cdf14 100644
--- a/crates/ui-egui/src/canvas/page_router.rs
+++ b/crates/ui-egui/src/canvas/page_router.rs
@@ -20,6 +20,12 @@ pub(crate) enum Owner {
     Comment { index: usize, part: CommentPart },
     /// A link, by its index in the document's links.
     Link { index: usize },
+    /// A form field's widget, by the field's index in the form and the widget's in the field.
+    Field { field: usize, widget: usize },
+    /// Prepare Form: a field's widget, to select and move.
+    PrepareField { field: usize, widget: usize },
+    /// Prepare Form: a corner handle of the selected field, to resize it.
+    PrepareCorner { left: bool, top: bool },
 }
 
 /// The part of a comment a hit is on.
diff --git a/crates/ui-egui/src/tools/comments.rs b/crates/ui-egui/src/tools/comments.rs
index ac1d82ea97..a6e718ce7f 100644
--- a/crates/ui-egui/src/tools/comments.rs
+++ b/crates/ui-egui/src/tools/comments.rs
@@ -37,7 +37,7 @@ pub(crate) use geometry::{corner_ratio, page_rotation, resized};
 pub use geometry::{drawn_text_box_rect, text_box_rect};
 #[cfg(test)]
 use input::hover_tip;
-pub(crate) use input::{describe, fill_grabs, hit, keys, nudge_keys, page_after_text, page_input, select_grabs};
+pub(crate) use input::{describe, fill_grabs, hit, keys, nudge_keys, page_after_text, page_input};
 pub use menu::{CanvasAction, fill_picker, recent_custom_colours, remember_custom_colour, status_badge, swatch_grid};
 #[cfg(test)]
 use menu::{RECENT_CUSTOM, same_colour};
diff --git a/crates/ui-egui/src/tools/comments/input.rs b/crates/ui-egui/src/tools/comments/input.rs
index 102767b6cb..17e1e102c3 100644
--- a/crates/ui-egui/src/tools/comments/input.rs
+++ b/crates/ui-egui/src/tools/comments/input.rs
@@ -98,8 +98,9 @@ pub(crate) fn hit(cx: &PageCx<'_>, view: &DocView, p: Pos2) -> Option<Hit> {
     }
     let markup = is_markup(&a.subtype);
     let icon = if cx.allowed && !markup { egui::CursorIcon::Move } else { egui::CursorIcon::PointingHand };
-    // Signatures and Fill & Sign's marks are placed on the page rather than comments on it.
-    let layer = if a.fill_sign { Layer::Placed } else { Layer::Comment };
+    // What a drag moves whole (a note, a shape, a signature, a Fill & Sign mark) is placed on the
+    // page, over a form field; text markup lies on the text, under one.
+    let layer = if a.fill_sign || !markup { Layer::Placed } else { Layer::Comment };
     // Text markup does not move: a click selects it, a drag across it selects the text.
     Some(Hit { declines_drag: markup, ..Hit::new(Owner::Comment { index: a.index, part: CommentPart::Body }, layer, icon) })
 }
@@ -124,12 +125,6 @@ pub(crate) fn fill_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
     matches!(cx.tool, QuickTool::Fill(_)) && grabs(cx, view)
 }
 
-/// With the Select tool, a comment that would move (not text markup) is picked up before a form
-/// field under it, so a signature placed over a field can still be dragged off it.
-pub(crate) fn select_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
-    cx.tool == QuickTool::Select && grabs(cx, view)
-}
-
 /// With a shape tool, the selected comment's handles are picked up ([`hit`]).
 fn draw_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
     matches!(cx.tool, QuickTool::Comment(_)) && grabs(cx, view)
diff --git a/crates/ui-egui/src/tools/forms_ui.rs b/crates/ui-egui/src/tools/forms_ui.rs
index 8b897d8207..077ad8550c 100644
--- a/crates/ui-egui/src/tools/forms_ui.rs
+++ b/crates/ui-egui/src/tools/forms_ui.rs
@@ -15,6 +15,7 @@ use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageToolContext, PageXform};
 use crate::page_cursor::Layer;
+use crate::page_router::{Hit, Owner};
 use crate::theme::Tokens;
 
 const FOCUS_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
@@ -151,48 +152,64 @@ fn toggle_edit(f: &FormField, w: &FormWidget) -> Option<Edit> {
     Some(Edit::SetFieldValue { name: f.name.clone(), value })
 }
 
-/// Clicks on form widgets of one page. `true` when a field owns the press or click.
-pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], allowed: bool, view: &mut DocView) -> bool {
-    let PageToolContext { ui, resp, xf, ptr, page, info, .. } = cx;
-    let Some(p) = ptr.within(xf.rect) else { return false };
-    let hit = form.iter().find_map(|f| {
+/// Whether `w`, a widget of `f`, takes a press: fillable, a push button with an action, or an
+/// empty signature field (signed by clicking it, Use a certificate). A radio button of a group can
+/// be read-only on its own.
+fn usable(f: &FormField, w: &FormWidget, allowed: bool) -> bool {
+    let pressable = f.kind == FormFieldKind::PushButton && !f.read_only() && f.button.is_some();
+    allowed && !w.read_only && (fillable(f) || pressable || f.kind == FormFieldKind::Signature)
+}
+
+/// The form widget under `p` on `page`: the one hit test of the fields, for the cursor and the
+/// press. Over the page's text too: a check box drawn with a glyph, or set on printed text, is a
+/// button, not text to select.
+pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, form: &[FormField], allowed: bool, p: Pos2) -> Option<Hit> {
+    if !xf.rect.contains(p) {
+        return None;
+    }
+    let (field, f, widget, w) = form.iter().enumerate().find_map(|(fi, f)| {
         f.widgets
             .iter()
             .enumerate()
             .find(|(_, w)| w.page == Some(page) && !w.hidden && widget_rect(xf, info, page, w.rect).contains(p))
-            .map(|(i, w)| (f, i, w))
-    });
-    let Some((f, wi, w)) = hit else { return false };
-    // The field's tooltip (`/TU`), as Acrobat shows it on hover (#3854). ISO 32000-2 Table 226
-    // makes it the name the user interface identifies the field by.
-    if let Some(tip) = f.tooltip.as_deref().filter(|t| !t.trim().is_empty()) {
+            .map(|(wi, w)| (fi, f, wi, w))
+    })?;
+    let icon = match (usable(f, w, allowed), f.kind) {
+        (false, _) => egui::CursorIcon::NotAllowed,
+        (true, FormFieldKind::Text) => egui::CursorIcon::Text,
+        _ => egui::CursorIcon::PointingHand,
+    };
+    Some(Hit::new(Owner::Field { field, widget }, Layer::Field, icon))
+}
+
+/// Presses and clicks on form widgets of one page, on the field the press was on ([`hit`]).
+/// `true` while a field holds the press.
+pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], allowed: bool, view: &mut DocView) -> bool {
+    let PageToolContext { ui, resp, xf, ptr, page, info, .. } = cx;
+    // The field's tooltip (`/TU`) under the pointer, as Acrobat shows it on hover (#3854). ISO
+    // 32000-2 Table 226 makes it the name the user interface identifies the field by.
+    if let Some(p) = ptr.within(xf.rect)
+        && let Some(Owner::Field { field, .. }) = hit(xf, info, page, form, allowed, p).map(|h| h.owner)
+        && let Some(tip) = form.get(field).and_then(|f| f.tooltip.as_deref()).filter(|t| !t.trim().is_empty())
+    {
         resp.clone().on_hover_text_at_pointer(tip);
     }
-    // Empty signature fields are signed by clicking them (Use a certificate); push buttons run
-    // their action.
-    let pressable = f.kind == FormFieldKind::PushButton && !f.read_only() && f.button.is_some();
-    // A radio button of a group can be read-only on its own.
-    let usable = allowed && !w.read_only && (fillable(f) || pressable || f.kind == FormFieldKind::Signature);
-    // Over the page's text too: a check box drawn with a glyph, or set on printed text, is a
-    // button, not text to select.
-    view.cursor.claim(
-        Layer::Field,
-        match (usable, f.kind) {
-            (false, _) => egui::CursorIcon::NotAllowed,
-            (true, FormFieldKind::Text) => egui::CursorIcon::Text,
-            _ => egui::CursorIcon::PointingHand,
-        },
-    );
+    let Some(Owner::Field { field, widget: wi }) = view.router.owner(page) else { return false };
+    let Some((f, w)) = form.get(field).and_then(|f| f.widgets.get(wi).map(|w| (f, w))) else { return false };
+    let usable = usable(f, w, allowed);
     // A text field opens on the press rather than the click, so a drag that starts on it
     // selects its text (#2213).
-    let pressed = f.kind == FormFieldKind::Text && usable && resp.is_pointer_button_down_on() && ptr.pressed().is_some();
-    if pressed && view.forms.focus.as_ref().is_none_or(|x| x.name != f.name || x.widget != wi) {
+    if f.kind == FormFieldKind::Text
+        && usable
+        && let Some(at) = ptr.pressed()
+        && view.forms.focus.as_ref().is_none_or(|x| x.name != f.name || x.widget != wi)
+    {
         commit(view, form);
-        view.forms.focus = Some(Focus { press: Some(p), ..open_focus(f, wi) });
+        view.forms.focus = Some(Focus { press: Some(at), ..open_focus(f, wi) });
         view.forms.pressed = true;
     }
     if !resp.clicked() {
-        return resp.is_pointer_button_down_on();
+        return true;
     }
     if !allowed {
         view.forms.notice = Some(FormNotice::Security);
@@ -231,6 +248,7 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], allowed: b
             }
         }
         FormFieldKind::List => {
+            let Some(p) = ptr.within(xf.rect) else { return true };
             commit(view, form);
             view.forms.focus = Some(open_focus(f, wi));
             let r = widget_rect(xf, info, page, w.rect);
diff --git a/crates/ui-egui/src/tools/prepare.rs b/crates/ui-egui/src/tools/prepare.rs
index c5fa2b684e..e8861b5cf6 100644
--- a/crates/ui-egui/src/tools/prepare.rs
+++ b/crates/ui-egui/src/tools/prepare.rs
@@ -13,6 +13,7 @@ use pdfcraft_render::DocInfo;
 use crate::canvas::{DocView, PageToolContext, PageXform};
 use crate::comments;
 use crate::page_cursor::Layer;
+use crate::page_router::{Hit, Owner};
 use crate::theme;
 use crate::widgets;
 
@@ -252,6 +253,38 @@ pub(crate) struct Outcome {
     pub table: Option<(usize, [f64; 4])>,
 }
 
+/// What Prepare Form's Select tool has under `p` on `page`: the selected field's corner handles,
+/// then a field. A field being moved is placed on the page over the comments; nothing with a field
+/// tool, which draws anywhere.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn hit(
+    xf: &PageXform,
+    info: &DocInfo,
+    page: usize,
+    form: &[FormField],
+    tool: Option<FieldTool>,
+    allowed: bool,
+    prep: &PrepareView,
+    p: Pos2,
+) -> Option<Hit> {
+    if tool.is_some() || !allowed || !xf.rect.contains(p) {
+        return None;
+    }
+    let selected_rect = prep
+        .selected
+        .as_ref()
+        .and_then(|(n, wi)| form.iter().find(|f| &f.name == n)?.widgets.get(*wi).filter(|w| w.page == Some(page)))
+        .map(|w| screen_rect(xf, info, page, w.rect));
+    if let Some((_, left, top)) = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(p) <= 6.0)) {
+        let icon = if left == top { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw };
+        return Some(Hit::new(Owner::PrepareCorner { left, top }, Layer::Handle, icon));
+    }
+    let (field, widget) = form.iter().enumerate().find_map(|(fi, f)| {
+        f.widgets.iter().enumerate().find(|(_, w)| w.page == Some(page) && screen_rect(xf, info, page, w.rect).contains(p)).map(|(wi, _)| (fi, wi))
+    })?;
+    Some(Hit::new(Owner::PrepareField { field, widget }, Layer::Placed, egui::CursorIcon::Move))
+}
+
 /// Pointer input on one page while preparing a form.
 pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], tool: Option<FieldTool>, allowed: bool, view: &mut DocView) -> Outcome {
     let PageToolContext { ui, resp, xf, ptr, page, info, .. } = cx;
@@ -383,33 +416,21 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], tool: Opti
             prep.also.clear();
         }
     }
-    // The Select tool: corner handles of the selection, then fields.
-    let selected_rect = prep
-        .selected
-        .as_ref()
-        .and_then(|(n, wi)| form.iter().find(|f| &f.name == n)?.widgets.get(*wi).filter(|w| w.page == Some(page)))
-        .map(|w| screen_rect(xf, info, page, w.rect));
-    let corner = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(p) <= 6.0));
-    let hit = form.iter().find_map(|f| {
-        f.widgets.iter().enumerate().find(|(_, w)| w.page == Some(page) && screen_rect(xf, info, page, w.rect).contains(p)).map(|(i, _)| (f, i))
-    });
-    if let Some((_, left, top)) = corner {
-        view.cursor.claim(Layer::Handle, if left == top { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw });
-    } else if hit.is_some() {
-        view.cursor.claim(Layer::Field, egui::CursorIcon::Move);
-    }
-    if resp.drag_started() {
+    // The Select tool: what the press was on ([`hit`]), a corner handle or a field; elsewhere a
+    // drag draws a selection rectangle. A press held by something drawn over the fields (a
+    // comment) is not Prepare's.
+    let owner = view.router.owner(page);
+    let held = matches!(owner, Some(Owner::PrepareField { .. } | Owner::PrepareCorner { .. }));
+    let hit = match owner {
+        Some(Owner::PrepareField { field, widget }) => form.get(field).map(|f| (f, widget)),
+        _ => None,
+    };
+    if resp.drag_started() && (held || owner.is_none()) {
         let origin = ptr.origin.unwrap_or(p);
-        if let Some((_, left, top)) = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(origin) <= 6.0)) {
+        if let Some(Owner::PrepareCorner { left, top }) = owner {
             prep.grab = Some((page, Grab::Corner(left, top), origin));
             out.consumed = true;
-        } else if let Some((f, wi)) = form.iter().find_map(|f| {
-            f.widgets
-                .iter()
-                .enumerate()
-                .find(|(_, w)| w.page == Some(page) && screen_rect(xf, info, page, w.rect).contains(origin))
-                .map(|(i, _)| (f, i))
-        }) {
+        } else if let Some((f, wi)) = hit {
             prep.selected = Some((f.name.clone(), wi));
             prep.grab = Some((page, Grab::Move, origin));
             out.consumed = true;
@@ -429,7 +450,7 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], tool: Opti
         out.properties = true;
         return out;
     }
-    if resp.clicked() {
+    if resp.clicked() && (held || owner.is_none()) {
         let extend = ui.input(|i| i.modifiers.shift || i.modifiers.command);
         match hit {
             // Shift/⌘-click adds or removes a field from the selection.
@@ -437,14 +458,14 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], tool: Opti
                 prep.select((f.name.clone(), wi), extend);
                 out.consumed = true;
             }
-            None if corner.is_none() => {
+            None if !held => {
                 prep.selected = None;
                 prep.also.clear();
             }
             None => out.consumed = true,
         }
     }
-    out.consumed |= hit.is_some() && resp.is_pointer_button_down_on();
+    out.consumed |= held;
     out
 }
 
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index 4a28943b11..b110041986 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -107,6 +107,31 @@ fn checkbox_pdf() -> Vec<u8> {
     ])
 }
 
+/// A 300×400 page with two unchecked check boxes side by side: `agree` at x 100..120 and
+/// `other` at x 120..140, both at y 200..220.
+fn two_checkboxes_pdf() -> Vec<u8> {
+    pdf(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R] /DA (/ZaDb 0 Tf 0 g) /DR << /Font << /ZaDb 6 0 R >> >> >> >>",
+        PAGES,
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (agree) /V /Off /AS /Off /Rect [100 200 120 220] /P 3 0 R /F 4 /MK << /CA (4) >> /DA (/ZaDb 11 Tf 0 g) >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (other) /V /Off /AS /Off /Rect [120 200 140 220] /P 3 0 R /F 4 /MK << /CA (4) >> /DA (/ZaDb 11 Tf 0 g) >>",
+        "<< /Type /Font /Subtype /Type1 /BaseFont /ZapfDingbats >>",
+    ])
+}
+
+/// The check box `agree` of [`checkbox_pdf`], with a highlight drawn over it.
+fn highlighted_checkbox_pdf() -> Vec<u8> {
+    pdf(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] /DA (/ZaDb 0 Tf 0 g) /DR << /Font << /ZaDb 5 0 R >> >> >> >>",
+        PAGES,
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (agree) /V /Off /AS /Off /Rect [100 200 120 220] /P 3 0 R /F 4 /MK << /CA (4) >> /DA (/ZaDb 11 Tf 0 g) >>",
+        "<< /Type /Font /Subtype /Type1 /BaseFont /ZapfDingbats >>",
+        "<< /Type /Annot /Subtype /Highlight /Rect [95 195 125 225] /QuadPoints [95 225 125 225 95 195 125 195] /C [1 1 0] /F 4 /T (Ana) >>",
+    ])
+}
+
 /// The app with `pdf` open at `zoom` percent and its first frames run. The left panel stays
 /// open only where a test places the page relative to the window's chrome.
 fn open(pdf: Vec<u8>, zoom: &'static str, left_open: bool) -> Harness<'static, PdfCraftApp> {
@@ -688,6 +713,40 @@ fn coalesced_click_places_a_stamp() {
     assert_eq!(stamps(&h), 1, "a click whose press and release share a frame places the stamp");
 }
 
+/// The value of the field named `name` on the first view's document.
+fn field_value(h: &Harness<'_, PdfCraftApp>, name: &str) -> Vec<String> {
+    let s = h.state();
+    s.session.get(s.views[0].id).unwrap().form.iter().find(|f| f.name == name).unwrap().value.clone()
+}
+
+/// A press belongs to the field it lands on: pressed at the right edge of `agree` and released just
+/// over the edge of `other` beside it (a click still, to egui), it ticks neither, as a button
+/// pressed and released off itself does nothing. The release used to tick `other`.
+#[test]
+fn a_press_on_one_check_box_released_over_another_ticks_neither() {
+    let mut h = open(two_checkboxes_pdf(), "150", false);
+    let (press, release) = (at(&h, 119.0, 210.0), at(&h, 121.0, 210.0));
+    h.hover_at(press);
+    h.run_steps(1);
+    h.drag_at(press);
+    h.run_steps(1);
+    h.drop_at(release);
+    h.run_steps(4);
+    assert_eq!((field_value(&h, "agree"), field_value(&h, "other")), (Vec::<String>::new(), Vec::new()), "neither box is ticked");
+}
+
+/// Text markup lies on the text, under a form field: a click on a check box under a highlight
+/// ticks the box, and the field's hand shows there.
+#[test]
+fn a_check_box_under_a_highlight_takes_the_click() {
+    let mut h = open(highlighted_checkbox_pdf(), "150", false);
+    let p = at(&h, 110.0, 210.0);
+    assert_eq!(cursor_at(&mut h, p), egui::CursorIcon::PointingHand);
+    mouse_click(&mut h, p);
+    assert_eq!(field_value(&h, "agree"), ["Yes"], "the box is ticked");
+    assert_eq!(h.state().views[0].comments.selected, None, "and the highlight is not selected");
+}
+
 #[test]
 fn mouse_click_ticks_a_check_box() {
     // Control for the tap below.

From a4c5fbed64425ce7811ec62bb67d1627330d8e13 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 12:50:01 +0100
Subject: [PATCH 132/270] fix(ui): Edit text's paragraphs, pictures, objects
 and added content decide a press by one hit test

Edit text's paragraph edges were tested twice: by edit_text_ui for the cursor, on the page's
paragraphs, and by object_ui for the press, on its own object inventory (grabs_edge). Where the
two inventories disagree, the resize arrow shows and a press starts an invisible area selection
instead (#2276, the review's step-3 probe). The open paragraph's frame showed the Move cursor
4 px out and took the press 6 px out.

Each of these parts now has one hit test, in the page router's table, and acts only on the
press it was captured on:
- edit_text_ui::hit: a paragraph's edges (Handle), its body (Text; Editor for the open one).
- edit_text_ui::picture_hit and picture_handle_hit: a picture's body on the Text layer, asked
  before the paragraphs, so text on top of artwork takes the press; the selected picture's
  corners and rotate knob on Handle, asked after them, so they win over text.
- object_ui::hit: the objects selected together (Placed) and the open paragraph's frame
  (Handle), with one reach (FRAME_REACH, 6 px) for the cursor and the press. An area selection
  starts only where nobody's hit claims the press.
- content_ui::hit: added text and pictures (Placed; the selected one's corners on Handle), over
  form fields; Add text starts a new box only where nobody's hit claims the press.
image_owns_pointer and content_ui::select_grabs go, with the edge test object_ui kept a copy of
(grabs_edge). The page's hits move into canvas::PageHits.

Un-ignores a_paragraph_edge_resizes_wherever_it_shows_the_resize_cursor: it passes on main
already (the inventories agree for its paragraph since the probe was written), so it stays as a
guard rather than as proof. New test an_open_paragraphs_frame_shows_move_wherever_a_press_takes_the_box
fails on the previous commit (the cursor is Default there).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs                  | 176 +++++++++++++-----
 crates/ui-egui/src/canvas/page_router.rs      |  40 ++++
 crates/ui-egui/src/tools/content_ui.rs        |  56 +++---
 crates/ui-egui/src/tools/edit_text_ui.rs      |  66 ++++---
 .../ui-egui/src/tools/edit_text_ui/image.rs   | 100 +++++-----
 crates/ui-egui/src/tools/object_ui.rs         |  54 +++---
 crates/ui-egui/tests/it/editing.rs            |  23 +++
 crates/ui-egui/tests/it/pointer.rs            |   1 -
 8 files changed, 354 insertions(+), 162 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 4ec1ea6f4e..b96364cb56 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1129,26 +1129,34 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     let PageFrame { resp, ptr, pointer, .. } = *frame;
     let cx = PageToolContext { ui, resp, xf: &xf, ptr, page: i, doc, info };
     let pcx = comments::PageCx { page: i, xf: &xf, ptr, info, tool, prefs, allowed, hidden: comments_hidden, redact_mark };
+    let (lines, images) =
+        if matches!(tool, QuickTool::AddText | QuickTool::EditText) && can_modify { edit_inventory(view, doc, i) } else { Default::default() };
     let field_tool = match tool {
         QuickTool::Field(f) => Some(f),
         _ => None,
     };
     // While a table is being set up, nothing else is drawn or moved.
     let prepare_allowed = can_modify && table_preview.is_none() && frame.out.open_table.is_none();
-    // What lies under a point, bottom up: links, comments, then form fields (Prepare's fields,
-    // being moved, over the comments; filled ones under the comments that move).
-    let hits = |view: &DocView, p: Pos2| {
-        let fields = if preparing {
-            crate::prepare::hit(&xf, info, i, form, field_tool, prepare_allowed, &view.prepare, p)
-        } else if tool == QuickTool::Select {
-            crate::forms_ui::hit(&xf, info, i, form, can_fill, p)
-        } else {
-            None
-        };
-        [link_hit(info, &xf, i, p), comments::hit(&pcx, view, p), fields].into_iter().flatten()
+    let hits = PageHits {
+        page: i,
+        xf: &xf,
+        info,
+        tool,
+        pcx: &pcx,
+        form,
+        can_fill,
+        can_modify,
+        editing_content,
+        preparing,
+        field_tool,
+        prepare_allowed,
+        added,
+        lines: &lines,
+        images: &images,
+        clip: ui.clip_rect(),
     };
     if let Some(o) = ptr.pressed().filter(|o| xf.rect.contains(*o)) {
-        let at = hits(view, o).collect::<Vec<_>>();
+        let at = hits.at(view, o);
         view.router.press(i, at, tool);
     }
     if let QuickTool::Measure(measure_tool) = tool {
@@ -1254,9 +1262,7 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         frame.out.open_table = frame.out.open_table.or(o.table);
         o.consumed || field_tool.is_some()
     } else {
-        tool == QuickTool::Select
-            && !(editing_content && can_modify && crate::content_ui::select_grabs(&xf, ptr, i, info, added, view))
-            && crate::forms_ui::page_input(cx, form, can_fill, view)
+        tool == QuickTool::Select && crate::forms_ui::page_input(cx, form, can_fill, view)
     };
     // Redact draws boxes off text; so does Highlight (an area highlight, as in Acrobat).
     let area_tool = tool == QuickTool::Redact && can_modify || tool == QuickTool::Comment(comments::CommentTool::Highlight) && allowed;
@@ -1268,21 +1274,7 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         };
         crate::redact_ui::page_input(cx, over_text, view)
     };
-    let image_owns_pointer = tool == QuickTool::EditText && crate::edit_text_ui::image_owns_pointer(ui, &xf, ptr, i, info, view);
-    let on_objects = !image_owns_pointer && tool == QuickTool::EditText && can_modify && crate::object_ui::page_input(cx, view);
-    let lines = if matches!(tool, QuickTool::AddText | QuickTool::EditText) && can_modify {
-        let generation = doc.edit_generation();
-        match view.edit_lines.get(&i) {
-            Some((g, l)) if *g == generation => l.clone(),
-            _ => {
-                let l = doc.text_blocks(i);
-                view.edit_lines.insert(i, (generation, l.clone()));
-                l
-            }
-        }
-    } else {
-        Vec::new()
-    };
+    let on_objects = tool == QuickTool::EditText && can_modify && crate::object_ui::page_input(cx, view);
     let over_source = tool == QuickTool::AddText
         && pointer.is_some_and(|p| {
             !crate::content_ui::hits_added(&xf, info, i, added, p)
@@ -1314,18 +1306,9 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     // instead of vanishing until the pointer comes back.
     let others_own_pointer = on_objects || on_content;
     let on_edit_text = (tool == QuickTool::EditText || over_source) && can_modify && {
-        let generation = doc.edit_generation();
-        let images = match view.edit_images.get(&i) {
-            Some((g, l)) if *g == generation => l.clone(),
-            _ => {
-                let l = doc.page_images(i);
-                view.edit_images.insert(i, (generation, l.clone()));
-                l
-            }
-        };
         // Editable text takes precedence over background/overlapping artwork. Both
         // inventories are painted every frame, even when text owns the pointer.
-        let text_used = crate::edit_text_ui::page_input(cx, &lines, view, !others_own_pointer && !image_owns_pointer);
+        let text_used = crate::edit_text_ui::page_input(cx, &lines, view, !others_own_pointer);
         let image_cx = crate::edit_text_ui::ImageCx {
             ui,
             resp,
@@ -1333,7 +1316,7 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
             ptr,
             page: i,
             info,
-            allow_interaction: !others_own_pointer && (image_owns_pointer || !text_used),
+            allow_interaction: !others_own_pointer && (matches!(view.router.owner(i), Some(crate::page_router::Owner::Picture { .. })) || !text_used),
         };
         let image_used = crate::edit_text_ui::image_input(&image_cx, &images, view, &mut frame.out.image_action);
         !others_own_pointer && (text_used || image_used)
@@ -1353,13 +1336,122 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     if frame.env.unobstructed
         && let Some(p) = pointer
     {
-        for h in hits(view, p).collect::<Vec<_>>() {
+        for h in hits.at(view, p) {
             view.cursor.claim_with_tip(h.layer, h.icon, h.tip);
         }
     }
     PageInput { consumed, area_tool }
 }
 
+/// Edit text's paragraphs and pictures on page `i`, kept while the document is unchanged.
+fn edit_inventory(
+    view: &mut DocView,
+    doc: &pdfcraft_engine::Document,
+    i: usize,
+) -> (Vec<pdfcraft_engine::TextBlock>, Vec<pdfcraft_engine::PageImage>) {
+    let generation = doc.edit_generation();
+    let lines = match view.edit_lines.get(&i) {
+        Some((g, l)) if *g == generation => l.clone(),
+        _ => {
+            let l = doc.text_blocks(i);
+            view.edit_lines.insert(i, (generation, l.clone()));
+            l
+        }
+    };
+    let images = match view.edit_images.get(&i) {
+        Some((g, l)) if *g == generation => l.clone(),
+        _ => {
+            let l = doc.page_images(i);
+            view.edit_images.insert(i, (generation, l.clone()));
+            l
+        }
+    };
+    (lines, images)
+}
+
+/// What the page modules have under a point on one page, for the page router.
+struct PageHits<'a> {
+    page: usize,
+    xf: &'a PageXform,
+    info: &'a DocInfo,
+    tool: QuickTool,
+    pcx: &'a comments::PageCx<'a>,
+    form: &'a [pdfcraft_engine::FormField],
+    can_fill: bool,
+    can_modify: bool,
+    /// Edit a PDF is open: added text and pictures can be picked up.
+    editing_content: bool,
+    preparing: bool,
+    field_tool: Option<crate::prepare::FieldTool>,
+    /// Prepare may draw and move fields (not while a table is being set up).
+    prepare_allowed: bool,
+    added: &'a [pdfcraft_engine::Added],
+    lines: &'a [pdfcraft_engine::TextBlock],
+    images: &'a [pdfcraft_engine::PageImage],
+    /// The pages' visible area (the picture's rotate knob stays inside it).
+    clip: Rect,
+}
+
+impl PageHits<'_> {
+    /// The hits at `p`, bottom up: links, comments; Edit text's pictures under its paragraphs (text
+    /// on top of artwork takes the press), added content, the objects selected together and the
+    /// open paragraph's frame, the selected picture's grips over them all; then form fields
+    /// (Prepare's, being moved, over the comments; filled ones under added content and the
+    /// comments that move).
+    fn at(&self, view: &DocView, p: Pos2) -> Vec<crate::page_router::Hit> {
+        let PageHits {
+            page,
+            xf,
+            info,
+            tool,
+            pcx,
+            form,
+            can_fill,
+            can_modify,
+            editing_content,
+            preparing,
+            field_tool,
+            prepare_allowed,
+            added,
+            lines,
+            images,
+            clip,
+        } = *self;
+        let fields = if preparing {
+            crate::prepare::hit(xf, info, page, form, field_tool, prepare_allowed, &view.prepare, p)
+        } else if tool == QuickTool::Select {
+            crate::forms_ui::hit(xf, info, page, form, can_fill, p)
+        } else {
+            None
+        };
+        // With Add text, only the paragraphs and pictures not under added content.
+        let editing =
+            can_modify && (tool == QuickTool::EditText || tool == QuickTool::AddText && !crate::content_ui::hits_added(xf, info, page, added, p));
+        let (pictures, paragraphs, objects, grips) = if editing {
+            let open = view.line_editor.as_ref().filter(|e| e.page == page);
+            let frame = open
+                .filter(|e| !e.has_changes())
+                .and_then(|e| lines.get(e.block))
+                .map(|l| xf.user_rect(info, page, l.rect.map(|v| v as f32)).expand(2.0));
+            (
+                crate::edit_text_ui::picture_hit(xf, page, info, images, view, p),
+                crate::edit_text_ui::hit(xf, info, page, lines, open.map(|e| e.block), p),
+                (tool == QuickTool::EditText).then(|| crate::object_ui::hit(view, xf, info, page, frame, p)).flatten(),
+                crate::edit_text_ui::picture_handle_hit(clip, xf, page, info, images, view, p),
+            )
+        } else {
+            (None, None, None, None)
+        };
+        // Added text and pictures, over the page's own paragraphs and under the objects selected
+        // together.
+        let added = (editing_content && can_modify).then(|| crate::content_ui::hit(xf, info, page, added, view, p)).flatten();
+        [link_hit(info, xf, page, p), comments::hit(pcx, view, p), pictures, paragraphs, added, objects, grips, fields]
+            .into_iter()
+            .flatten()
+            .collect()
+    }
+}
+
 /// Text layer: find matches, selection, I-beam and drag-to-select.
 fn text_layer(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, slot: &PageSlot, input: &PageInput) {
     let PageEnv { info, selects_text, tool, .. } = frame.env;
diff --git a/crates/ui-egui/src/canvas/page_router.rs b/crates/ui-egui/src/canvas/page_router.rs
index c5751cdf14..06d3c48568 100644
--- a/crates/ui-egui/src/canvas/page_router.rs
+++ b/crates/ui-egui/src/canvas/page_router.rs
@@ -26,6 +26,46 @@ pub(crate) enum Owner {
     PrepareField { field: usize, widget: usize },
     /// Prepare Form: a corner handle of the selected field, to resize it.
     PrepareCorner { left: bool, top: bool },
+    /// Edit text: a paragraph, by its index among the page's, and what of it a press takes.
+    Paragraph { block: usize, part: ParagraphPart },
+    /// Edit text: a picture, by its index among the page's, and what of it a press takes.
+    Picture { index: usize, part: PicturePart },
+    /// Edit text: the objects selected together, or the frame of the paragraph open for typing.
+    Objects { part: ObjectsPart },
+    /// Added text or a picture placed on the page, by its index among the page's, and a corner of
+    /// the selected one (left, top) or the item itself.
+    Added { index: usize, corner: Option<(bool, bool)> },
+}
+
+/// The part of a picture a hit is on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum PicturePart {
+    /// The picture: a click selects it, a drag moves the selected one.
+    Body,
+    /// A corner of the selected picture (left top, right top, left bottom, right bottom): a drag
+    /// resizes it.
+    Corner(usize),
+    /// The selected picture's rotate knob: a drag turns it.
+    Knob,
+}
+
+/// What of the objects a hit is on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ObjectsPart {
+    /// The objects selected together: a drag moves them all.
+    Selection,
+    /// The frame drawn around the paragraph open for typing: a click selects the box, a drag moves it.
+    Frame,
+}
+
+/// The part of a paragraph a hit is on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ParagraphPart {
+    /// The paragraph: a drag moves it, a click opens it for typing.
+    Body,
+    /// Its left or right edge (on screen): a drag rewraps it.
+    Left,
+    Right,
 }
 
 /// The part of a comment a hit is on.
diff --git a/crates/ui-egui/src/tools/content_ui.rs b/crates/ui-egui/src/tools/content_ui.rs
index a0d9cefa13..fdc6e3f98b 100644
--- a/crates/ui-egui/src/tools/content_ui.rs
+++ b/crates/ui-egui/src/tools/content_ui.rs
@@ -9,7 +9,7 @@ use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageToolContext, PageXform};
 use crate::page_cursor::Layer;
-use crate::page_pointer::PagePointer;
+use crate::page_router::{Hit, Owner};
 use crate::theme::Tokens;
 use crate::widgets;
 
@@ -330,18 +330,22 @@ fn dragged(r: Rect, grab: Grab, d: egui::Vec2, keep_aspect: bool) -> Rect {
     }
 }
 
-/// Added text and images keep pointer ownership over a form field while editing content.
-pub(crate) fn select_grabs(xf: &PageXform, ptr: &PagePointer, page: usize, info: &DocInfo, added: &[Added], view: &DocView) -> bool {
-    let cv = &view.content;
-    if cv.grab.is_some_and(|(grab_page, _, _)| grab_page == page) {
-        return true;
+/// What of the added text and pictures lies under `p` on `page`: the selected item's corners, then
+/// the topmost item. Placed on the page, over a form field under it.
+pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, added: &[Added], view: &DocView, p: Pos2) -> Option<Hit> {
+    if !xf.rect.contains(p) {
+        return None;
     }
-    let Some(p) = ptr.within(xf.rect) else { return false };
-    on_page(added, page).into_iter().any(|(index, item)| {
-        let rect = screen_rect(xf, info, page, item.content.rect());
-        rect.expand(2.0).contains(p)
-            || cv.selected == Some((page, index)) && handles(rect).into_iter().any(|(corner, _, _)| corner.distance(p) <= 6.0)
-    })
+    let items = on_page(added, page);
+    let selected = view.content.selected.filter(|s| s.0 == page).and_then(|(_, si)| items.iter().find(|(i, _)| *i == si));
+    if let Some((index, a)) = selected
+        && let Some((_, left, top)) = handles(screen_rect(xf, info, page, a.content.rect())).into_iter().find(|(c, ..)| c.distance(p) <= 6.0)
+    {
+        let icon = if left == top { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw };
+        return Some(Hit::new(Owner::Added { index: *index, corner: Some((left, top)) }, Layer::Handle, icon));
+    }
+    let (index, _) = items.iter().rev().find(|(_, a)| screen_rect(xf, info, page, a.content.rect()).expand(2.0).contains(p))?;
+    Some(Hit::new(Owner::Added { index: *index, corner: None }, Layer::Placed, egui::CursorIcon::Move))
 }
 
 /// Pointer input on one page in Edit mode (`adding_text` with the Text tool). `true` when it
@@ -396,7 +400,8 @@ pub(crate) fn page_input(
     let corner = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(p) <= 6.0));
     if adding_text && hit.is_none() {
         view.cursor.claim(Layer::ToolArea, egui::CursorIcon::Text);
-        if resp.clicked() {
+        // A new box where nothing drawn over the page holds the press.
+        if resp.clicked() && view.router.owner(page).is_none() {
             // Text that can't be drawn stays where it is being typed (#125).
             if cv.hold_blocked() {
                 return true;
@@ -420,20 +425,21 @@ pub(crate) fn page_input(
         }
         return consumed;
     }
-    if let Some((_, left, top)) = corner {
-        view.cursor.claim(Layer::Handle, if left == top { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw });
-    } else if hit.is_some() {
-        view.cursor.claim(Layer::Placed, egui::CursorIcon::Move);
-    }
+    // A drag on what the press was on ([`hit`]): a corner resizes the selected item, the item
+    // itself moves.
     if resp.drag_started() {
         let origin = ptr.origin.unwrap_or(p);
-        if let Some((_, left, top)) = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(origin) <= 6.0)) {
-            cv.grab = Some((page, Grab::Corner(left, top), origin));
-            consumed = true;
-        } else if let Some((i, _)) = items.iter().rev().find(|(_, a)| screen_rect(xf, info, page, a.content.rect()).expand(2.0).contains(origin)) {
-            cv.selected = Some((page, *i));
-            cv.grab = Some((page, Grab::Move, origin));
-            consumed = true;
+        match view.router.owner(page) {
+            Some(Owner::Added { corner: Some((left, top)), .. }) => {
+                cv.grab = Some((page, Grab::Corner(left, top), origin));
+                consumed = true;
+            }
+            Some(Owner::Added { index, corner: None }) => {
+                cv.selected = Some((page, index));
+                cv.grab = Some((page, Grab::Move, origin));
+                consumed = true;
+            }
+            _ => {}
         }
         return consumed;
     }
diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
index 224bc3f545..4ea80b1d6b 100644
--- a/crates/ui-egui/src/tools/edit_text_ui.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -14,6 +14,7 @@ use pdfcraft_render::DocInfo;
 use crate::canvas::{DocView, PageToolContext, PageXform};
 use crate::page_cursor::Layer;
 use crate::page_pointer::PagePointer;
+use crate::page_router::{Hit, Owner, ParagraphPart};
 
 mod background;
 mod image;
@@ -21,7 +22,7 @@ mod layout;
 
 pub(crate) use background::TextBackground;
 pub use image::{CropMode, ImageSelection};
-pub(crate) use image::{ImageAction, ImageCx, image_input, image_owns_pointer};
+pub(crate) use image::{ImageAction, ImageCx, body_hit as picture_hit, handle_hit as picture_handle_hit, image_input};
 #[cfg(test)]
 use image::{rotate_knob, turn_degrees};
 #[cfg(test)]
@@ -233,8 +234,9 @@ pub struct BlockDrag {
 
 /// How far an edge grip reaches either side of a box's edge (screen pixels).
 const EDGE_REACH: f32 = 6.0;
-/// How far outside an open paragraph's frame the pointer still means the frame (screen pixels).
-const FRAME_REACH: f32 = 4.0;
+/// How far outside an open paragraph's frame the pointer still means the frame (screen pixels):
+/// the frame's Move cursor shows, and a press there takes hold of the box (`object_ui`).
+pub(crate) const FRAME_REACH: f32 = 6.0;
 
 /// The rewrap handles drawn on a paragraph box's left and right edges (screen).
 fn width_handles(b: Rect) -> [Rect; 2] {
@@ -277,11 +279,25 @@ fn has_edges(info: &DocInfo, page: usize) -> bool {
     info.pages.get(page).is_some_and(|p| p.rotation % 180 == 0)
 }
 
-/// Whether a press at `p` takes hold of the width handle of one of the paragraphs `rects` (user
-/// space). The handle is drawn half outside the box and grabs from a little further out still,
-/// where a press is not on the box itself, so area selection must leave it to [`page_input`].
-pub(crate) fn grabs_edge(xf: &PageXform, info: &DocInfo, page: usize, mut rects: impl Iterator<Item = [f64; 4]>, p: Pos2) -> bool {
-    has_edges(info, page) && rects.any(|r| edge_at(paragraph_box(xf, info, page, r), p).is_some())
+/// What of the paragraphs `lines` lies under `p` on `page`: the one hit test of Edit text's
+/// paragraphs, for the cursor and the press. A closed paragraph moves when dragged (the four-way
+/// arrow says so; a click still opens it for typing) and its edge rewraps it, from a little way
+/// outside the box (the handle is drawn half outside it, #2276); the open one takes the text
+/// cursor. `active` is the paragraph open for typing on this page.
+pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, lines: &[pdfcraft_engine::TextBlock], active: Option<usize>, p: Pos2) -> Option<Hit> {
+    if !xf.rect.contains(p) {
+        return None;
+    }
+    let boxes: Vec<Rect> = lines.iter().map(|l| paragraph_box(xf, info, page, l.rect)).collect();
+    let (block, grip) = grab_at(&boxes, p, has_edges(info, page))?;
+    let paragraph = |part| Owner::Paragraph { block, part };
+    Some(match (active, grip) {
+        (None, Grip::Left) => Hit::new(paragraph(ParagraphPart::Left), Layer::Handle, egui::CursorIcon::ResizeHorizontal),
+        (None, Grip::Right) => Hit::new(paragraph(ParagraphPart::Right), Layer::Handle, egui::CursorIcon::ResizeHorizontal),
+        (None, Grip::Move) => Hit::new(paragraph(ParagraphPart::Body), Layer::Text, egui::CursorIcon::Move),
+        (Some(open), _) if open == block => Hit::new(paragraph(ParagraphPart::Body), Layer::Editor, egui::CursorIcon::Text),
+        (Some(_), _) => Hit::new(paragraph(ParagraphPart::Body), Layer::Text, egui::CursorIcon::Text),
+    })
 }
 
 fn user_box(xf: &PageXform, info: &DocInfo, page: usize, r: Rect) -> [f64; 4] {
@@ -416,35 +432,37 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, lines: &[pdfcraft_engine::Text
         return true;
     }
     // Dragging a box (not while a paragraph is open for typing) moves it; from an edge, resizes it.
-    // What it grabs comes from where the button went down, not where the pointer is now: egui
+    // What it grabs is what the press was on ([`hit`]), not what is under the pointer now: egui
     // only calls it a drag once the pointer has moved a few pixels (or been held a moment), and a
     // quick flick has left the edge by then.
+    let owner = match view.router.owner(page) {
+        Some(Owner::Paragraph { block, part }) => Some((block, part)),
+        _ => None,
+    };
     if resp.drag_started()
         && active.is_none()
         && let Some(o) = ptr.origin
-        && let Some((block, grip)) = grab_at(&boxes, o, upright)
+        && let Some((block, part)) = owner
     {
+        let grip = match part {
+            ParagraphPart::Body => Grip::Move,
+            ParagraphPart::Left => Grip::Left,
+            ParagraphPart::Right => Grip::Right,
+        };
         view.block_drag = Some(BlockDrag { page, block, generation: doc.edit_generation(), start: o, grip });
         return true;
     }
     let Some(p) = ptr.within(xf.rect) else { return false };
-    let Some((hit, grip)) = grab_at(&boxes, p, upright) else { return false };
-    if active != Some(hit) {
-        painter.rect_stroke(boxes[hit], CornerRadius::same(2), Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
+    // The paragraph under the pointer: outlined, with its width handles when closed.
+    let Some((hovered, _)) = grab_at(&boxes, p, upright) else { return false };
+    if active != Some(hovered) {
+        painter.rect_stroke(boxes[hovered], CornerRadius::same(2), Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
     }
-    let on_edge = active.is_none() && grip != Grip::Move;
     if upright && active.is_none() {
-        draw_handles(boxes[hit]);
-    }
-    // A closed paragraph moves when dragged (the four-way arrow says so; a click still opens it
-    // for typing); an edge rewraps it. The open one takes the text cursor.
-    if on_edge {
-        view.cursor.claim(Layer::Handle, egui::CursorIcon::ResizeHorizontal);
-    } else if active.is_none() {
-        view.cursor.claim(Layer::Text, egui::CursorIcon::Move);
-    } else {
-        view.cursor.claim(if active == Some(hit) { Layer::Editor } else { Layer::Text }, egui::CursorIcon::Text);
+        draw_handles(boxes[hovered]);
     }
+    // A click opens the paragraph the press was on.
+    let Some((hit, _)) = owner else { return true };
     if resp.clicked() {
         view.image_selection = None;
         // A click that moves the editor to another paragraph applies the open one first, so its
diff --git a/crates/ui-egui/src/tools/edit_text_ui/image.rs b/crates/ui-egui/src/tools/edit_text_ui/image.rs
index d9dbb59fa3..6956e656af 100644
--- a/crates/ui-egui/src/tools/edit_text_ui/image.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui/image.rs
@@ -1,5 +1,6 @@
 use super::{ACCENT, Color32, CornerRadius, DocInfo, DocView, Edit, MAX_OUTLINES, PagePointer, PageXform, Pos2, Rect, Stroke, user_box};
 use crate::page_cursor::Layer;
+use crate::page_router::{Hit, Owner, PicturePart};
 
 /// A selected page image, and what the pointer is doing to it.
 #[derive(Clone, Debug, PartialEq)]
@@ -229,19 +230,45 @@ fn stretched_picture(painter: &egui::Painter, xf: &PageXform, tex: egui::Texture
     clipped.add(egui::Shape::mesh(mesh));
 }
 
-/// Once a selected corner or the rotate knob is grabbed, text under it cannot take over the gesture. The same
-/// applies after the pointer leaves the image/page while dragging.
-pub(crate) fn image_owns_pointer(ui: &egui::Ui, xf: &PageXform, ptr: &PagePointer, page: usize, info: &DocInfo, view: &DocView) -> bool {
-    let Some(selection) = view.image_selection.as_ref().filter(|s| s.page == page) else { return false };
-    if selection.drag.is_some() {
-        return true;
+/// The selected picture's grips under `p`: its corners and its rotate knob. They are asked after
+/// the paragraphs, so text on top of a picture cannot take them; `clip` is the pages' visible
+/// area, which the knob stays inside.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn handle_hit(
+    clip: Rect,
+    xf: &PageXform,
+    page: usize,
+    info: &DocInfo,
+    images: &[pdfcraft_engine::PageImage],
+    view: &DocView,
+    p: Pos2,
+) -> Option<Hit> {
+    let s = view.image_selection.as_ref().filter(|s| s.page == page && s.crop.is_none())?;
+    let b = images.get(s.index)?.visible_rect.map(|r| xf.user_rect(info, page, r.map(|v| v as f32)))?;
+    let picture = |part| Owner::Picture { index: s.index, part };
+    if rotate_knob(b, clip).0.distance(p) < 8.0 {
+        return Some(Hit::new(picture(PicturePart::Knob), Layer::Handle, egui::CursorIcon::Grab));
     }
-    let Some(image) = view.edit_images.get(&page).and_then(|(_, images)| images.get(selection.index)) else { return false };
-    let Some(rect) = image.visible_rect else { return false };
-    let b = xf.user_rect(info, page, rect.map(|v| v as f32));
-    let p = if ptr.primary_down { ptr.origin } else { ptr.pos };
-    let knob = rotate_knob(b, ui.clip_rect()).0;
-    p.is_some_and(|p| [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom(), knob].iter().any(|c| c.distance(p) < 8.0))
+    let corner = [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom()].iter().position(|c| c.distance(p) < 8.0)?;
+    let icon = if matches!(corner, 0 | 3) { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw };
+    Some(Hit::new(picture(PicturePart::Corner(corner)), Layer::Handle, icon))
+}
+
+/// The picture under `p` (its shape, not only its box): a click selects it, a drag moves the
+/// selected one. On the text layer, asked before the paragraphs: editable text on top of a
+/// picture takes the press.
+pub(crate) fn body_hit(xf: &PageXform, page: usize, info: &DocInfo, images: &[pdfcraft_engine::PageImage], view: &DocView, p: Pos2) -> Option<Hit> {
+    if !xf.rect.contains(p) {
+        return None;
+    }
+    let (x, y) = xf.screen_to_view(p);
+    let user = info.pages.get(page)?.view_to_user(x, y).map(f64::from);
+    let index = images
+        .iter()
+        .rposition(|im| im.visible_rect.is_some_and(|r| xf.user_rect(info, page, r.map(|v| v as f32)).contains(p)) && im.contains(user))?;
+    let selected = view.image_selection.as_ref().is_some_and(|s| s.page == page && s.index == index);
+    let icon = if selected { egui::CursorIcon::Move } else { egui::CursorIcon::PointingHand };
+    Some(Hit::new(Owner::Picture { index, part: PicturePart::Body }, Layer::Text, icon))
 }
 
 /// What a right-click on a selected image asks for.
@@ -508,37 +535,28 @@ pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage
             painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
             draw_handles(painter, b);
         }
-        if allow_interaction && let Some(corner) = hover_pos.and_then(|p| corners.iter().position(|c| c.distance(p) < 8.0)) {
-            view.cursor.claim(Layer::Handle, if matches!(corner, 0 | 3) { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw });
-        }
         // The rotate handle: a knob above the top edge, joined to it by a short stem.
         let (knob, stem) = rotate_knob(b, ui.clip_rect());
         if view.image_selection.as_ref().is_some_and(|s| s.drag.is_none()) {
             painter.line_segment([stem, knob], Stroke::new(1.0, ACCENT));
             painter.circle(knob, 5.0, Color32::WHITE, Stroke::new(1.0, ACCENT));
-            if allow_interaction && hover_pos.is_some_and(|p| p.distance(knob) < 8.0) {
-                view.cursor.claim(Layer::Handle, egui::CursorIcon::Grab);
-            }
         }
+        // A drag on what the press was on ([`handle_hit`], [`body_hit`]): the knob turns the
+        // picture, a corner resizes it from the opposite one, the picture itself moves.
         if allow_interaction
             && resp.drag_started()
             && let Some(o) = ptr.origin
-            && o.distance(knob) < 8.0
+            && let Some(Owner::Picture { index, part }) = view.router.owner(page)
+            && index == i
+            && let Some(s) = view.image_selection.as_mut()
         {
-            if let Some(s) = view.image_selection.as_mut() {
-                s.drag = Some((o, None));
-                s.turning = true;
-            }
-        } else if allow_interaction
-            && resp.drag_started()
-            && let Some(o) = ptr.origin
-        {
-            let corner = corners.iter().position(|c| c.distance(o) < 8.0);
-            if corner.is_some() || image_contains(i, o) {
-                let opposite = corner.map(|k| corners[3 - k]);
-                if let Some(s) = view.image_selection.as_mut() {
-                    s.drag = Some((o, opposite));
+            match part {
+                PicturePart::Knob => {
+                    s.drag = Some((o, None));
+                    s.turning = true;
                 }
+                PicturePart::Corner(k) => s.drag = Some((o, 3usize.checked_sub(k).and_then(|opposite| corners.get(opposite)).copied())),
+                PicturePart::Body => s.drag = Some((o, None)),
             }
         }
         if view.image_selection.as_ref().is_some_and(|s| s.turning) {
@@ -584,17 +602,13 @@ pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage
     if selected != Some(hit) {
         painter.rect_stroke(boxes[hit], CornerRadius::ZERO, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)), egui::StrokeKind::Outside);
     }
-    let Some(b) = boxes.get(hit).copied() else { return false };
-    let corner = [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom()].iter().position(|c| c.distance(p) < 8.0);
-    match (selected == Some(hit), corner) {
-        (true, Some(0 | 3)) => view.cursor.claim(Layer::Handle, egui::CursorIcon::ResizeNwSe),
-        (true, Some(_)) => view.cursor.claim(Layer::Handle, egui::CursorIcon::ResizeNeSw),
-        (true, None) => view.cursor.claim(Layer::Placed, egui::CursorIcon::Move),
-        // A click selects it.
-        _ => view.cursor.claim(Layer::Placed, egui::CursorIcon::PointingHand),
-    }
-    if resp.clicked() || resp.secondary_clicked() {
-        view.image_selection = Some(ImageSelection { page, index: hit, drag: None, crop: None, turning: false, settled: None });
+    // A click selects the picture the press was on; a right-click the one under the pointer.
+    let clicked = match view.router.owner(page) {
+        Some(Owner::Picture { index, .. }) if resp.clicked() => Some(index),
+        _ => resp.secondary_clicked().then_some(hit),
+    };
+    if let Some(index) = clicked {
+        view.image_selection = Some(ImageSelection { page, index, drag: None, crop: None, turning: false, settled: None });
     }
     if resp.secondary_clicked() {
         ui.ctx().data_mut(|d| d.insert_temp(menu_key, true));
diff --git a/crates/ui-egui/src/tools/object_ui.rs b/crates/ui-egui/src/tools/object_ui.rs
index 96cc0adf25..db3982cd28 100644
--- a/crates/ui-egui/src/tools/object_ui.rs
+++ b/crates/ui-egui/src/tools/object_ui.rs
@@ -9,6 +9,7 @@ use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageToolContext, PageXform};
 use crate::page_cursor::Layer;
+use crate::page_router::{Hit, ObjectsPart, Owner};
 
 const BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
 
@@ -161,6 +162,19 @@ fn leave_single(view: &mut DocView) {
     view.block_drag = None;
 }
 
+/// What of the objects lies under `p` on `page`: the objects selected together (a drag moves
+/// them), or the frame around the paragraph open for typing (`open`: its box on screen), which
+/// takes hold of the box as in Acrobat: a click selects it, a drag moves it, its text keeps the
+/// caret.
+pub(crate) fn hit(view: &DocView, xf: &PageXform, info: &DocInfo, page: usize, open: Option<Rect>, p: Pos2) -> Option<Hit> {
+    let s = &view.objects;
+    if s.page == Some(page) && !s.selected.is_empty() && s.selected.iter().fold(Rect::NOTHING, |r, o| r.union(screen(xf, info, page, o))).contains(p)
+    {
+        return Some(Hit::new(Owner::Objects { part: ObjectsPart::Selection }, Layer::Placed, egui::CursorIcon::Move));
+    }
+    open.filter(|r| on_frame(r.shrink(2.0), p)).map(|_| Hit::new(Owner::Objects { part: ObjectsPart::Frame }, Layer::Handle, egui::CursorIcon::Move))
+}
+
 /// Returns true while group selection owns the interaction. Ordinary clicks still reach the
 /// single-object text/resize tools. A text draft is finished or discarded through its editor.
 pub(crate) fn page_input(cx: PageToolContext<'_>, view: &mut DocView) -> bool {
@@ -246,14 +260,7 @@ fn input(s: &mut ObjectSelection, cx: PageToolContext<'_>, view: &mut DocView) -
         return s.page == Some(page) && !s.selected.is_empty();
     };
     if !pressed {
-        if s.page == Some(page) && !s.selected.is_empty() {
-            let union = s.selected.iter().fold(Rect::NOTHING, |r, o| r.union(screen(xf, info, page, o)));
-            if union.contains(p) {
-                view.cursor.claim(Layer::Placed, egui::CursorIcon::Move);
-            }
-            return true;
-        }
-        return false;
+        return s.page == Some(page) && !s.selected.is_empty();
     }
     let objects = match s.inventory(doc, page) {
         Ok(objects) => objects,
@@ -296,18 +303,16 @@ fn input(s: &mut ObjectSelection, cx: PageToolContext<'_>, view: &mut DocView) -
         view.current = page;
         return true;
     }
-    if s.page == Some(page) && !s.selected.is_empty() {
-        let union = s.selected.iter().fold(Rect::NOTHING, |r, o| r.union(screen(xf, info, page, o)));
-        if union.contains(p) && !resp.double_clicked() {
-            s.gesture = Some(Gesture { start: p, now: p, marquee: false, additive: false });
-            return true;
-        }
+    // What the press was on ([`hit`]): the selection moves; the frame of the paragraph open for
+    // typing selects its box (for the arrow keys) and moves it.
+    let owner = view.router.owner(page);
+    if owner == Some(Owner::Objects { part: ObjectsPart::Selection }) && !resp.double_clicked() {
+        s.gesture = Some(Gesture { start: p, now: p, marquee: false, additive: false });
+        return true;
     }
-    // The frame of the paragraph open for typing takes hold of the box, as in Acrobat: a click
-    // selects it (for the arrow keys), a drag moves it. Its text keeps the caret.
-    if let Some(block) = view.line_editor.as_ref().filter(|e| e.page == page && !e.has_changes()).map(|e| e.block)
+    if owner == Some(Owner::Objects { part: ObjectsPart::Frame })
+        && let Some(block) = view.line_editor.as_ref().filter(|e| e.page == page && !e.has_changes()).map(|e| e.block)
         && let Some(object) = objects.iter().find(|o| o.target == ObjectTarget { kind: ObjectKind::Text, index: block })
-        && on_frame(screen(xf, info, page, object), p)
     {
         s.clear();
         s.page = Some(page);
@@ -318,11 +323,9 @@ fn input(s: &mut ObjectSelection, cx: PageToolContext<'_>, view: &mut DocView) -
         return true;
     }
     s.clear();
-    // A closed paragraph's width handle reaches past its box, and a press there rewraps the
-    // paragraph (as in `edit_text_ui`) instead of starting an area selection (#2276).
-    let on_edge = view.line_editor.as_ref().is_none_or(|e| e.page != page)
-        && crate::edit_text_ui::grabs_edge(xf, info, page, objects.iter().filter(|o| o.target.kind == ObjectKind::Text).map(|o| o.rect), p);
-    if hit.is_some() || on_edge {
+    // A press on something (a paragraph, its edge reaching past its box #2276, a picture, added
+    // content) is its own; only one on the empty page starts an area selection.
+    if hit.is_some() || view.router.owner(page).is_some() {
         return false;
     }
     leave_single(view);
@@ -335,12 +338,9 @@ fn input(s: &mut ObjectSelection, cx: PageToolContext<'_>, view: &mut DocView) -
 /// Whether `p` is on the frame drawn around a paragraph open for typing (`r`, screen): just
 /// outside the text, where a press would otherwise close the paragraph.
 fn on_frame(r: Rect, p: Pos2) -> bool {
-    r.expand(2.0 + FRAME_REACH).contains(p) && !r.expand(2.0).contains(p)
+    r.expand(2.0 + crate::edit_text_ui::FRAME_REACH).contains(p) && !r.expand(2.0).contains(p)
 }
 
-/// How far outside a paragraph's frame a press still grabs it (screen pixels).
-const FRAME_REACH: f32 = 6.0;
-
 /// The arrow keys move the selected image or objects a point, Shift and an arrow ten points,
 /// as in Acrobat. They are taken before the view turns the page with them.
 pub(crate) fn nudge_keys(ctx: &egui::Context, view: &mut DocView, doc: &Document) {
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 0d44f91067..f247eb59b0 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -4334,6 +4334,29 @@ fn an_open_paragraph_moves_by_its_frame_and_by_the_arrow_keys() {
     assert_eq!(h.state().session.get(id).unwrap().text_lines(0).len(), 1, "moved, not retyped");
 }
 
+/// The open paragraph's frame shows the Move cursor as far out as a press there takes hold of the
+/// box: the cursor reached 4 px past the frame, the press 6.
+#[test]
+fn an_open_paragraphs_frame_shows_move_wherever_a_press_takes_the_box() {
+    let mut h = harness(2, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let id = h.state().views[0].id;
+    let before = h.state().session.get(id).unwrap().text_blocks(0)[0].clone();
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = r.width() / 200.0;
+    let screen = |x: f64, y: f64| egui::pos2(r.left() + x as f32 * k, r.top() + (300.0 - y as f32) * k);
+    click_at(&mut h, screen((before.rect[0] + before.rect[2]) / 2.0, (before.rect[1] + before.rect[3]) / 2.0));
+    assert!(h.state().views[0].line_editor.is_some(), "a click on the text opens it for typing");
+    // 7 px above the text: 5 px past the frame drawn 2 px out.
+    let far = screen((before.rect[0] + before.rect[2]) / 2.0, before.rect[3]) - egui::vec2(0.0, 7.0);
+    h.hover_at(far);
+    h.run_steps(3);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Move, "the frame offers to move the box there");
+    click_at(&mut h, far);
+    assert!(h.state().views[0].line_editor.is_none(), "and a click there selects the box");
+}
+
 /// Contributor-original text, with an off-origin CropBox. Keep the moving paragraph last in
 /// source order so an ordinary hit picks it again when two independent boxes fully overlap.
 fn paragraph_drag_fixture(content: &str, rotation: i64, unit: i64) -> Vec<u8> {
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index b110041986..397d6316f8 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -405,7 +405,6 @@ fn narrow_from_left(dx: f32) -> (egui::CursorIcon, usize) {
 }
 
 #[test]
-#[ignore = "step 3 of the page pointer router: one hit test"]
 fn a_paragraph_edge_resizes_wherever_it_shows_the_resize_cursor() {
     let (inside_cursor, inside_lines) = narrow_from_left(1.0);
     assert_eq!(inside_cursor, egui::CursorIcon::ResizeHorizontal);

From bcc71601d48126223ee5e84811436ac7ca36ca47 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 12:53:44 +0100
Subject: [PATCH 133/270] docs: page modules decide a press by one hit test and
 act on the router's owner

A "Page presses" non-negotiable in CLAUDE.md, beside "Page input" and "Page cursor": a page
module decides what of its own is under a point in one hit test (a Hit from
canvas/page_router.rs) that gives its cursor, its tip and its press, and acts on a press only
when the router says it is its own, never by testing the press point again or by asking
another module; Escape cancels any press the pages hold.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CLAUDE.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CLAUDE.md b/CLAUDE.md
index cd1b5b284a..c47674135c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -23,6 +23,7 @@ PdfCraft is a clean-room, open-source, Rust-native PDF application targeting Ado
 - **Layering.** Nothing below L7 depends on egui/winit/eframe/rfd (`plan/architecture.md` §3). `cos`/`filters`/`crypt`/`arlington` stay standalone.
 - **Page input.** Page modules read `PagePointer` (`crates/ui-egui/src/page_pointer.rs`), never egui's raw pointer state (`hover_pos`, `interact_pos`, `latest_pos`, `press_origin`, button reads); `page_pointer::tests::page_modules_read_the_pointer_only_through_page_pointer` enforces it.
 - **Page cursor.** Page modules claim the cursor for what is under the pointer (`view.cursor.claim(Layer::…, icon)`, `crates/ui-egui/src/canvas/page_cursor.rs`), never set it (`set_cursor_icon`, `cursor_icon =`, `on_hover_cursor`); `document_area` sets it once, from the claim on the highest layer the active tool reaches. `page_pointer::tests::page_modules_claim_the_cursor_and_never_set_it` enforces it.
+- **Page presses.** A page module decides what of its own is under a point in one hit test, which returns a `Hit` (owner, layer, cursor, tip; `crates/ui-egui/src/canvas/page_router.rs`) and gives its cursor, its tip and its press. It acts on a press only when the router says the press is its own (`view.router.owner(page)`), never by testing the press point again or by asking another module whether it wants it. Escape cancels any press the pages hold (`cancel_on_escape`), and that press is ignored until the button is up.
 - **Fidelity.** The PDF object graph is the model. Preserve unknown data. Saves are incremental unless a full rewrite is required. Never silently drop or repair data without recording it.
 - **Never panic.** Every PDF, script, MCP call, settings file and keystroke is untrusted input, and none of it may crash the app or lose the user's work. This outranks feature work. Return `Result` (the crate's error enum) and propagate with `?`, or fall back leniently and record it. In non-test code:
   - No `unwrap`/`expect`/`panic!`/`unreachable!`/`todo!` unless it is provably infallible, with a comment saying why.

From 4b3033c86942e0850ad888172a684fec543c12e4 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 13:55:29 +0100
Subject: [PATCH 134/270] fix(ui): review fixes for the page router: Escape on
 text drags, the open frame's sides, a stale owner

From a review of this branch:
- Escape mid-drag with a text markup tool (Highlight, Underline, Strikeout, Squiggly, Replace
  Text) or Redact over text left the half-made selection on the page: the cancel took the Escape
  that would have cleared it. It is dropped now. The marks made from a selection at its end
  (after the page tools, which the release blocking did not reach) also wait for a cancelled
  press's button; egui ends its own drag on Escape without a drag stop, so they were not made
  in practice, but nothing but egui stopped them.
- The open paragraph's frame took the press above and below the text only: its sides still gave
  edge grips (a closed paragraph's rewrap handles) on the Editor layer, over the frame. Edges now
  belong to closed paragraphs only.
- A press in the frame right after a release kept the last press's owner until a page claimed
  it, so a drag from the margin beside a page could move the comment just clicked. A new press
  now drops the last owner before the pages give it theirs.
- A release and a new press in one frame no longer leave the new press cancelled.
- Added content is picked up with the tools that act on it (Select, Add text, Edit text), not with
  every tool while Edit a PDF is open.
- The layer docs in page_cursor.rs say what lies on each layer now.

New tests an_open_paragraphs_frame_takes_the_box_beside_its_text and
a_drag_from_beside_the_page_right_after_a_click_leaves_the_comment_alone (the release and the
next press in one frame) fail on the previous commit. escape_cancels_a_highlight_being_dragged_over_text
(with a control: the drag highlights without Escape) passes there too, for the reason above, and
stays as a guard.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs             | 27 ++++++++++---
 crates/ui-egui/src/canvas/page_cursor.rs | 18 +++++----
 crates/ui-egui/src/tools/edit_text_ui.rs |  3 +-
 crates/ui-egui/tests/it/editing.rs       | 24 +++++++++++
 crates/ui-egui/tests/it/pointer.rs       | 51 ++++++++++++++++++++++++
 5 files changed, 109 insertions(+), 14 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index b96364cb56..f843a2ca6c 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1444,7 +1444,8 @@ impl PageHits<'_> {
         };
         // Added text and pictures, over the page's own paragraphs and under the objects selected
         // together.
-        let added = (editing_content && can_modify).then(|| crate::content_ui::hit(xf, info, page, added, view, p)).flatten();
+        let picks_up = matches!(tool, QuickTool::Select | QuickTool::AddText | QuickTool::EditText);
+        let added = (editing_content && can_modify && picks_up).then(|| crate::content_ui::hit(xf, info, page, added, view, p)).flatten();
         [link_hit(info, xf, page, p), comments::hit(pcx, view, p), pictures, paragraphs, added, objects, grips, fields]
             .into_iter()
             .flatten()
@@ -1688,9 +1689,12 @@ fn page_overlays(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_
     }
     crate::image_pick::drop_stale(doc, view);
     crate::image_pick::paint(painter, &xf, i, info, view);
-    comments::page_after_text(resp, &pcx, view);
-    if tool == QuickTool::Redact && can_modify {
-        crate::redact_ui::after_text(resp, i, info, view);
+    // A cancelled press ends no selection: no markup or redaction is made from it.
+    if !view.press_cancelled {
+        comments::page_after_text(resp, &pcx, view);
+        if tool == QuickTool::Redact && can_modify {
+            crate::redact_ui::after_text(resp, i, info, view);
+        }
     }
     if input.area_tool {
         crate::redact_ui::paint(painter, i, view, pointer);
@@ -1892,11 +1896,19 @@ fn link_hit(info: &DocInfo, xf: &PageXform, page: usize, p: Pos2) -> Option<crat
 /// placed, drawn, moved, resized or opened, and the press is ignored until the button is up. The
 /// frame of the release still belongs to the cancelled press.
 fn cancel_on_escape(ctx: &egui::Context, view: &mut DocView, ptr: &PagePointer) {
-    if view.press_cancelled && !ptr.any_down && ptr.edges.is_empty() {
+    // Over once the button is up and its release seen, or when a new press comes (its release and
+    // the next press can share a frame).
+    let new_press = matches!(ptr.edges.last(), Some(crate::page_pointer::Edge::Press(_)));
+    if view.press_cancelled && (new_press || !ptr.any_down && ptr.edges.is_empty()) {
         view.press_cancelled = false;
     }
     if !view.press_cancelled && ptr.origin.is_some() && ptr.primary_down && ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape))
     {
+        // A text selection being dragged goes with its drag: the markup, redaction or Replace
+        // Text that its end would make is not made.
+        if view.selection_drag {
+            view.clear_selection();
+        }
         view.cancel_pointer_gestures();
         view.press_cancelled = true;
     }
@@ -1983,6 +1995,11 @@ fn draw_pages(
     let ptr = PagePointer::read(ui, &resp, modal);
     cancel_on_escape(ui.ctx(), view, &ptr);
     view.router.settle(ptr.any_down, !ptr.edges.is_empty());
+    // A new press is no longer the last one's, wherever it lands (the page it is on gives it
+    // its owner; in the gap between pages it has none).
+    if ptr.pressed().is_some() {
+        view.router.cancel();
+    }
     let pointer = ptr.pos;
     // A press on a page makes it the current one (as in Acrobat), so a page command with
     // no selection (Rotate, Delete) acts on the page the reader pointed at, not on a page
diff --git a/crates/ui-egui/src/canvas/page_cursor.rs b/crates/ui-egui/src/canvas/page_cursor.rs
index 382f5efb63..e40dc1c4f3 100644
--- a/crates/ui-egui/src/canvas/page_cursor.rs
+++ b/crates/ui-egui/src/canvas/page_cursor.rs
@@ -20,18 +20,19 @@ use crate::QuickTool;
 pub(crate) enum Layer {
     /// The page under the active tool: the crosshair it places or draws with, its I-beam or hand.
     ToolArea,
-    /// The page's text, to select, and Edit text's paragraphs.
+    /// The page's text, to select; Edit text's paragraphs, and its pictures beneath them.
     Text,
     /// Links.
     Link,
-    /// Comments: notes, shapes and markup.
+    /// Text markup (highlights, underlines…), which lies on the text: under a form field.
     Comment,
     /// Form fields.
     Field,
-    /// What a drag moves whole: signatures and Fill & Sign's marks, added text and images,
-    /// selected objects, pictures in Edit text.
+    /// What a drag moves whole: notes, shapes, signatures and Fill & Sign's marks, added text and
+    /// pictures, the objects selected together, Prepare's fields.
     Placed,
-    /// The grips of the selected item: resize, rewrap and crop handles, paragraph edges.
+    /// The grips of the selected item: resize, rewrap, rotate and crop handles, paragraph edges,
+    /// the frame of the paragraph open for typing.
     Handle,
     /// An open editor: a paragraph being typed in, a picture being cropped.
     Editor,
@@ -45,9 +46,10 @@ const LAYERS: [Layer; 9] =
 
 impl Layer {
     /// Whether a press with `tool` acts on what lies on this layer, so that the layer's claims
-    /// count. Only the Select tool follows links (the Link tool edits them) and picks up
-    /// comments: every other tool draws, places or selects text over them. The other layers are
-    /// claimed only by the modules of the tools that act on them, so they count for every tool.
+    /// count. Only the Select tool follows links (the Link tool edits them) and selects text
+    /// markup: every other tool draws, places or selects text over them. The other layers are
+    /// claimed only by the modules of the tools that act on them (each module's hit test filters
+    /// by tool), so they count for every tool.
     pub(crate) fn reached_by(self, tool: QuickTool) -> bool {
         match self {
             Layer::Link => matches!(tool, QuickTool::Select | QuickTool::Link),
diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
index 4ea80b1d6b..6ec31b0015 100644
--- a/crates/ui-egui/src/tools/edit_text_ui.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -289,7 +289,8 @@ pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, lines: &[pdfcraft
         return None;
     }
     let boxes: Vec<Rect> = lines.iter().map(|l| paragraph_box(xf, info, page, l.rect)).collect();
-    let (block, grip) = grab_at(&boxes, p, has_edges(info, page))?;
+    // Edges rewrap closed paragraphs only: around the open one lies its frame (`object_ui`).
+    let (block, grip) = grab_at(&boxes, p, has_edges(info, page) && active.is_none())?;
     let paragraph = |part| Owner::Paragraph { block, part };
     Some(match (active, grip) {
         (None, Grip::Left) => Hit::new(paragraph(ParagraphPart::Left), Layer::Handle, egui::CursorIcon::ResizeHorizontal),
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index f247eb59b0..be5413b49c 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -4357,6 +4357,30 @@ fn an_open_paragraphs_frame_shows_move_wherever_a_press_takes_the_box() {
     assert!(h.state().views[0].line_editor.is_none(), "and a click there selects the box");
 }
 
+/// The open paragraph's frame takes hold of the box on its sides too: there the edges of a closed
+/// paragraph would rewrap it, but around the open one lies its frame.
+#[test]
+fn an_open_paragraphs_frame_takes_the_box_beside_its_text() {
+    let mut h = harness(2, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let id = h.state().views[0].id;
+    let before = h.state().session.get(id).unwrap().text_blocks(0)[0].clone();
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = r.width() / 200.0;
+    let screen = |x: f64, y: f64| egui::pos2(r.left() + x as f32 * k, r.top() + (300.0 - y as f32) * k);
+    let middle = (before.rect[1] + before.rect[3]) / 2.0;
+    click_at(&mut h, screen((before.rect[0] + before.rect[2]) / 2.0, middle));
+    assert!(h.state().views[0].line_editor.is_some(), "a click on the text opens it for typing");
+    // 6 px left of the text: 4 px past the frame drawn 2 px out.
+    let beside = screen(before.rect[0], middle) - egui::vec2(6.0, 0.0);
+    h.hover_at(beside);
+    h.run_steps(3);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Move, "the frame offers to move the box there");
+    click_at(&mut h, beside);
+    assert!(h.state().views[0].line_editor.is_none(), "and a click there selects the box");
+}
+
 /// Contributor-original text, with an off-origin CropBox. Keep the moving paragraph last in
 /// source order so an ordinary hit picks it again when two independent boxes fully overlap.
 fn paragraph_drag_fixture(content: &str, rotation: i64, unit: i64) -> Vec<u8> {
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index 397d6316f8..0d058cb458 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -802,6 +802,57 @@ fn escape_cancels_a_signature_rectangle() {
     assert!(s.dialog.is_none(), "and no signing dialog opens: {:?}", s.dialog);
 }
 
+/// A highlight dragged over the line of [`text_pdf`] at 150 %, from x 45 to x 150, with Escape
+/// before the release when `escape`; the comments then on the page.
+fn drag_a_highlight(escape: bool) -> usize {
+    let mut h = open(text_pdf(), "150", false);
+    h.state_mut().quick_tool = QuickTool::Comment(CommentTool::Highlight);
+    h.run_steps(4);
+    let (a, b) = (at(&h, 45.0, 303.0), at(&h, 150.0, 303.0));
+    assert_eq!(wait_for_cursor(&mut h, a, |c| c == egui::CursorIcon::Text), egui::CursorIcon::Text, "the page's text has arrived");
+    h.drag_at(a);
+    h.run_steps(1);
+    h.hover_at(b);
+    h.run_steps(2);
+    if escape {
+        h.key_press(egui::Key::Escape);
+        h.run_steps(1);
+    }
+    h.drop_at(b);
+    h.run_steps(4);
+    let s = h.state();
+    s.session.get(s.views[0].id).unwrap().info.annotations.len()
+}
+
+/// Escape mid-drag abandons a highlight being drawn over text: the release makes no highlight.
+#[test]
+fn escape_cancels_a_highlight_being_dragged_over_text() {
+    assert_eq!(drag_a_highlight(false), 1, "control: the drag highlights the text");
+    assert_eq!(drag_a_highlight(true), 0, "with Escape before the release, no highlight is made");
+}
+
+/// A click on a comment, and in the frame of its release a press beside the page, then a drag
+/// from there: the drag is not the comment's, so it does not move it.
+#[test]
+fn a_drag_from_beside_the_page_right_after_a_click_leaves_the_comment_alone() {
+    let mut h = open(comment_on_text_pdf(), "150", false);
+    let on_comment = at(&h, 120.0, 315.0);
+    let beside = page(&h).left_center() - egui::vec2(20.0, 0.0);
+    let before = square(&h).expect("the rectangle");
+    h.hover_at(on_comment);
+    h.run_steps(1);
+    h.drag_at(on_comment);
+    h.run_steps(1);
+    let button = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE };
+    one_frame(&mut h, [button(on_comment, false), egui::Event::PointerMoved(beside), button(beside, true)]);
+    h.run_steps(1);
+    h.hover_at(beside + egui::vec2(0.0, 60.0));
+    h.run_steps(2);
+    h.drop_at(beside + egui::vec2(0.0, 60.0));
+    h.run_steps(4);
+    assert_eq!(square(&h), Some(before), "the comment stays where it was");
+}
+
 /// Only the primary button draws a signature rectangle: a right-drag opens no signing dialog.
 #[test]
 fn a_right_drag_draws_no_signature_rectangle() {

From adeb9c1cf2336c10639d8172325e708edf515856 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 14:22:11 +0100
Subject: [PATCH 135/270] fix(comments): Undo and Redo close the panel's inline
 editor

A delete moves the panel's inline editor along with its comment or reply,
but Undo and Redo cleared only the selection. Either can put annotations
back or take them away, so the editor stayed keyed to an index that could
now be another reply: with B's editor open, delete reply A, Undo, and Save
wrote B's draft over A. history_step now closes the editor (and its
unsaved text) with the selection. Found by FredApps in review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ROADMAP.md                                 |  2 +-
 crates/ui-egui/src/editing.rs              |  2 +-
 crates/ui-egui/src/tools/comments/state.rs | 10 ++++
 crates/ui-egui/tests/it/comments.rs        | 65 ++++++++++++++++++++++
 parity/acrobat-features.toml               |  4 +-
 5 files changed, 79 insertions(+), 4 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 7708f1ae04..6f580f6097 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -201,7 +201,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 ## Progress log
 
 - **2026-10-27 (M10, OCR models):** Model staging downloads and verifies the ONNX pair after the upstream RTEN URL brownout; runtime discovery prefers complete ONNX pairs per directory, retains complete RTEN fallback and preserves directory precedence.
-- **2026-10-25 (M5, comment replies):** One reply can be deleted from the Comments panel without its thread. On the selected card each reply has its own "…" menu (Edit, Copy text, Delete); Delete takes that reply with its pop-up and the replies to it, as `comment_delete` already did headlessly, and the comment and its other replies stay. The card stays selected, and the panel's editor stays open, on what they were on though the delete moved it in `/Annots`. A locked reply can't be deleted. Estimates unchanged.
+- **2026-10-25 (M5, comment replies):** One reply can be deleted from the Comments panel without its thread. On the selected card each reply has its own "…" menu (Edit, Copy text, Delete); Delete takes that reply with its pop-up and the replies to it, as `comment_delete` already did headlessly, and the comment and its other replies stay. The card stays selected, and the panel's editor stays open, on what they were on though the delete moved it in `/Annots`. Undo and Redo close the editor, since either can move what it was open on. A locked reply can't be deleted. Estimates unchanged.
 - **2026-10-24 (M10, #4158 partial):** Word, HTML, RTF and PowerPoint export keep a block that continues another on its line (an italic case name, a link, a superscript) as a run in its own style inside that paragraph, with the source's word space, instead of a paragraph of its own. Style changes that wrap onto the next line still split paragraphs (the reading blocks keep style boundaries). Estimates unchanged.
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 1ee4c7a6f6..7e5ea8ed6f 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -232,7 +232,7 @@ impl PdfCraftApp {
                 if let Some(doc) = self.session.get(id) {
                     self.views[i].document_changed(&doc.info);
                 }
-                self.views[i].comments.selected = None;
+                self.views[i].comments.history_stepped();
                 let label = crate::i18n::edit_label(&label);
                 if undo {
                     self.notify_fmt("Undid {label}", &[("label", &label)]);
diff --git a/crates/ui-egui/src/tools/comments/state.rs b/crates/ui-egui/src/tools/comments/state.rs
index db45041906..a886e2dfd7 100644
--- a/crates/ui-egui/src/tools/comments/state.rs
+++ b/crates/ui-egui/src/tools/comments/state.rs
@@ -230,6 +230,16 @@ impl CommentView {
             self.editor_focus = None;
         }
     }
+
+    /// Undo or Redo just ran. Either may have put annotations back or taken them away, on any
+    /// page, so a (page, index) held here may now name another one. The selection and the inline
+    /// editor close, its unsaved text with it, rather than Save writing that text over whatever
+    /// took its place.
+    pub(crate) fn history_stepped(&mut self) {
+        self.selected = None;
+        self.editing = None;
+        self.editor_focus = None;
+    }
 }
 
 /// Where the annotation at `keep` is once the one at `gone` was deleted, or `None` when it went
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 2fcc2299d1..70326c2f30 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -1426,6 +1426,71 @@ fn one_reply_is_deleted_from_its_menu_and_the_thread_stays() {
     h.get_by_label("Wrong reply");
 }
 
+// Contributor-original PDF: a comment and its replies A, B and C, in that `/Annots` order.
+const THREE_REPLIES: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [4 0 R 5 0 R 6 0 R 7 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (note) /T (Ben) /Contents (The comment) >> endobj
+5 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (a) /IRT 4 0 R /T (Cat) /Contents (Reply A) >> endobj
+6 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (b) /IRT 4 0 R /T (Dan) /Contents (Reply B) >> endobj
+7 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (c) /IRT 4 0 R /T (Eve) /Contents (Reply C) >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+/// Opens the inline editor on the reply that shows `text`, from its "…" menu, and types `draft`
+/// into it without saving.
+fn draft_reply(h: &mut Harness<'static, PdfCraftApp>, text: &str, draft: &str) {
+    reply_options(h, text).click();
+    h.run_steps(2);
+    h.query_all_by_label("Edit").last().expect("the reply menu's Edit, after the toolbar tab").click();
+    h.run_steps(2);
+    let editor = h.query_all_by(|n| n.role() == Role::MultilineTextInput && n.placeholder() != Some("Add a reply")).next().expect("reply editor");
+    editor.click();
+    h.run_steps(1);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+    h.event(egui::Event::Text(draft.into()));
+    h.run_steps(2);
+}
+
+/// A reply's inline editor, left open with a draft, closes on Undo and on Redo. Either can put
+/// a reply back in its place or take one away, and the editor would have saved the draft over
+/// whichever reply took that place: reply A after delete → Undo, reply C after Redo.
+#[test]
+fn undo_and_redo_close_a_reply_editor_left_open() {
+    let mut h = harness_with_bytes(THREE_REPLIES.to_vec(), |app| {
+        app.set_option("panel", "comments").unwrap();
+        app.views[0].comments.selected = Some((0, 0));
+    });
+    let texts = |h: &Harness<'static, PdfCraftApp>| -> Vec<String> { comments(h).iter().filter_map(|a| a.contents.clone()).collect() };
+    let all = ["The comment", "Reply A", "Reply B", "Reply C"];
+    assert_eq!(texts(&h), all);
+
+    draft_reply(&mut h, "Reply B", "B's draft");
+    reply_options(&h, "Reply A").click();
+    h.run_steps(2);
+    h.get_by_label("Delete").click();
+    h.run_steps(3);
+    assert_eq!(texts(&h), ["The comment", "Reply B", "Reply C"]);
+    assert_eq!(h.state().views[0].comments.editing, Some((0, 1, "B's draft".to_string())), "the editor follows B up");
+
+    h.state_mut().undo();
+    h.run_steps(3);
+    assert_eq!(texts(&h), all, "undo puts A back where B's editor now points");
+    assert_eq!(h.state().views[0].comments.editing, None, "the editor closes on undo");
+    assert_eq!(h.query_all_by_label("Save").count(), 0, "no draft is left to save over A");
+
+    h.state_mut().views[0].comments.selected = Some((0, 0));
+    h.run_steps(2);
+    draft_reply(&mut h, "Reply B", "B's draft");
+    assert_eq!(h.state().views[0].comments.editing, Some((0, 2, "B's draft".to_string())));
+    h.state_mut().redo();
+    h.run_steps(3);
+    assert_eq!(texts(&h), ["The comment", "Reply B", "Reply C"], "redo deletes A again, and C takes B's place");
+    assert_eq!(h.state().views[0].comments.editing, None, "the editor closes on redo");
+    assert_eq!(h.query_all_by_label("Save").count(), 0, "no draft is left to save over C");
+}
+
 #[test]
 fn the_header_names_no_replies_when_there_are_none() {
     let h = harness_with_bytes(PER_PAGE_NAMES.to_vec(), |app| {
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 52d6fa0c72..f7e95de61d 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4051,8 +4051,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_edit"]
-evidence = ["crates/annot/src/tests.rs::text_box_text_and_colour_changes_are_drawn", "crates/annot/src/tests.rs::editing_a_text_box_refits_its_rectangle", "crates/automation/tests/it/automation.rs::comments_through_tools", "crates/ui-egui/tests/it/comments.rs::ctrl_enter_posts_a_highlight_comment_and_shift_enter_adds_a_line", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays"]
-notes = "double-click a comment or card, or Edit in the menus (a reply from its own \"…\" menu); Ctrl+Enter (also Command+Enter) saves text in the focused comment editor, Shift+Enter adds a newline; a text box's rectangle follows the new text (wrap width and top edge stay, the height fits the wrapped lines)"
+evidence = ["crates/annot/src/tests.rs::text_box_text_and_colour_changes_are_drawn", "crates/annot/src/tests.rs::editing_a_text_box_refits_its_rectangle", "crates/automation/tests/it/automation.rs::comments_through_tools", "crates/ui-egui/tests/it/comments.rs::ctrl_enter_posts_a_highlight_comment_and_shift_enter_adds_a_line", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/tests/it/comments.rs::undo_and_redo_close_a_reply_editor_left_open"]
+notes = "double-click a comment or card, or Edit in the menus (a reply from its own \"…\" menu); Ctrl+Enter (also Command+Enter) saves text in the focused comment editor, Shift+Enter adds a newline; a text box's rectangle follows the new text (wrap width and top edge stay, the height fits the wrapped lines). Undo or Redo closes the panel's editor without saving it, since either can move the comment it was open on"
 
 [[feature]]
 id = "comment.copy-comment-text"

From 3d14ffd722a0ab46df5603c2741fb9818e15d7c7 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 14:27:40 +0100
Subject: [PATCH 136/270] fix(ui): Add text places a box on a picture and
 beside a paragraph again

With Add text, the page router's hits included Edit text's pictures and paragraph edges, which
nothing acts on with Add text, and Add text starts a box only where nobody owns the press: on a
scanned page (a picture filling it) no click placed a box, a click within a paragraph's edge
grip beside it did nothing, and the cursor over a picture was the hand. Add text now has only
the paragraphs' bodies, over their text, where it finishes the box being typed (over_source).

New test add_text_places_a_box_on_a_picture_and_beside_a_paragraph, seen failing on the
previous commit. From CodeRabbit's review of #5300.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs       | 15 +++++++++----
 crates/ui-egui/tests/it/editing.rs | 36 ++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+), 4 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index f843a2ca6c..6bdf5660c6 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1433,11 +1433,18 @@ impl PageHits<'_> {
                 .filter(|e| !e.has_changes())
                 .and_then(|e| lines.get(e.block))
                 .map(|l| xf.user_rect(info, page, l.rect.map(|v| v as f32)).expand(2.0));
+            // Add text acts on the page's paragraphs only over their text (it finishes the box
+            // being typed there): not on pictures, nor beside a paragraph, where a click starts
+            // a new box.
+            let edit_text = tool == QuickTool::EditText;
+            let body = |h: &crate::page_router::Hit| {
+                matches!(h.owner, crate::page_router::Owner::Paragraph { part: crate::page_router::ParagraphPart::Body, .. })
+            };
             (
-                crate::edit_text_ui::picture_hit(xf, page, info, images, view, p),
-                crate::edit_text_ui::hit(xf, info, page, lines, open.map(|e| e.block), p),
-                (tool == QuickTool::EditText).then(|| crate::object_ui::hit(view, xf, info, page, frame, p)).flatten(),
-                crate::edit_text_ui::picture_handle_hit(clip, xf, page, info, images, view, p),
+                edit_text.then(|| crate::edit_text_ui::picture_hit(xf, page, info, images, view, p)).flatten(),
+                crate::edit_text_ui::hit(xf, info, page, lines, open.map(|e| e.block), p).filter(|h| edit_text || body(h)),
+                edit_text.then(|| crate::object_ui::hit(view, xf, info, page, frame, p)).flatten(),
+                edit_text.then(|| crate::edit_text_ui::picture_handle_hit(clip, xf, page, info, images, view, p)).flatten(),
             )
         } else {
             (None, None, None, None)
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index be5413b49c..96020a67fd 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -3935,6 +3935,42 @@ fn editing_existing_images_on_the_page() {
     check_existing_artwork("picture.png", png);
 }
 
+/// Add text places a box with a click anywhere off its own boxes: on a scanned page (one picture
+/// filling it) too, and just beside a paragraph, where Edit text would rewrap it.
+#[test]
+fn add_text_places_a_box_on_a_picture_and_beside_a_paragraph() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::AddText;
+    h.run_steps(2);
+    let c = h.state().views[0].page_screen_rect(0).expect("on screen").center();
+    h.hover_at(c);
+    h.run_steps(2);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Text, "the I-beam over the picture");
+    click_at(&mut h, c);
+    assert!(h.state().views[0].content.draft.is_some(), "a click on the picture starts a text box");
+
+    let mut h = harness(2, |_| {});
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::AddText;
+    h.run_steps(2);
+    let id = h.state().views[0].id;
+    let block = h.state().session.get(id).unwrap().text_blocks(0)[0].clone();
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = r.width() / 200.0;
+    // 6 px left of the text: 4 px past its box, within a closed paragraph's edge grip in Edit text.
+    let beside = egui::pos2(r.left() + block.rect[0] as f32 * k, r.top() + (300.0 - ((block.rect[1] + block.rect[3]) / 2.0) as f32) * k)
+        - egui::vec2(6.0, 0.0);
+    click_at(&mut h, beside);
+    assert!(h.state().views[0].content.draft.is_some(), "a click beside the paragraph starts a text box");
+}
+
 #[test]
 fn dragging_the_rotate_knob_turns_a_page_image() {
     let mut png = Vec::new();

From 43337c7fd5f7b5123efcebcc84de35c394726e7a Mon Sep 17 00:00:00 2001
From: Hamza <mail.hamzanaveed@gmail.com>
Date: Thu, 29 Oct 2026 19:06:11 +0500
Subject: [PATCH 137/270] Drop the dead operand-overflow branch rather than
 revive it

Review is right that `Stack::push` always returned `Some(())`, so `overflowed`
never became true and the whole-instruction discard was dead code.

Making it live breaks the page. `an_operator_with_hundreds_of_operands_does_
not_end_the_content` (#4260) puts 300 stray operands before `0 1 0 rg` and
asserts the `rg` still reads its own three: with the discard alive the fill
stays the previous red, measured as `left: [255, 0, 0]` against
`right: [0, 255, 0]`.

The ring buffer already gives the right answer. It keeps the newest operands,
which are the ones nearest the operator -- its own -- and no operator takes
anywhere near 256 of them: `scn` takes one per colourant and ISO 32000 allows a
DeviceN space 32. So the strays fall off the back and the operator is applied to
its own operands, which is what Acrobat and Chromium do. Dropping the
instruction would lose content that is there to be read.

The dead branch and the flag are gone, `push` no longer returns a result it
cannot produce, and a test pins what the buffer does: the strays are `1` and the
operator's own operand is `0`, so the two answers differ. Keeping the oldest
operands instead fails it at 256 strays.
---
 crates/render/src/raster/tests.rs      | 34 +++++++++++++++++++++--
 vendor/hayro-syntax/src/content/mod.rs | 38 ++++++++------------------
 2 files changed, 43 insertions(+), 29 deletions(-)

diff --git a/crates/render/src/raster/tests.rs b/crates/render/src/raster/tests.rs
index 696eaddb61..39a489bb1d 100644
--- a/crates/render/src/raster/tests.rs
+++ b/crates/render/src/raster/tests.rs
@@ -7058,8 +7058,9 @@ fn a_malformed_token_does_not_end_the_content_stream() {
         // A `re` with three operands: the typed iterator used to abort on a path operator it
         // could not dispatch, which is what #3568 reports.
         "20 10 10 re",
-        // More operands than the limit (ISO 32000-2 Annex C gives 10): the instruction is
-        // dropped, not the stream.
+        // Eleven operands: under the 256 the stack holds, so this one runs on its own last
+        // operand. Past the limit is covered by
+        // `an_operator_past_the_operand_limit_reads_its_own_operands` below.
         "0 0 0 0 0 0 0 0 0 0 0 g",
         // A stray delimiter: the lexer could not read an operator and jumped to the end.
         ")",
@@ -7080,6 +7081,35 @@ fn a_malformed_token_does_not_end_the_content_stream() {
     }
 }
 
+/// An operator preceded by more operands than the stack holds is applied to its own operands,
+/// which are the ones nearest it, rather than to whichever of the strays survived. The parser
+/// had a branch meant to drop such an instruction whole, dead because `Stack::push` always
+/// reported success (noted in review of #3636); reviving it loses legitimate content, which
+/// `an_operator_with_hundreds_of_operands_does_not_end_the_content` measures, so the dead branch
+/// is gone and this pins what the ring buffer does instead.
+#[test]
+fn an_operator_past_the_operand_limit_reads_its_own_operands() {
+    // The strays are `1` and the operator's own operand is `0`, so the two answers differ: white
+    // if the operator read a stray, black if it read its own.
+    let page = |strays: usize| {
+        let stream = format!("{}0 g 0 0 20 20 re f", "1 ".repeat(strays));
+        let pdf = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] /Contents 4 0 R >> endobj\n4 0 obj << /Length {} >> stream\n{stream}\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
+            stream.len()
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+        assert!(p.error.is_none(), "{strays} strays: {:?}", p.error);
+        p.rgba.as_chunks::<4>().0.to_vec()
+    };
+    let all_black = |pixels: &[[u8; 4]]| pixels.iter().all(|p| *p == [0, 0, 0, 255]);
+
+    // None, a few, the limit, and past it: the fill is the black the `g` asked for every time.
+    for strays in [0, 5, 255, 256, 257, 600] {
+        assert!(all_black(&page(strays)), "{strays} stray operands: the `g` reads its own operand");
+    }
+}
+
 /// Content after an inline image whose data holds `EI` is still read. This pins the property
 /// but does **not** exercise the look-ahead gating added for #3636's review: accepting a false
 /// `EI` truncates the image, while the text after the real one is read either way, and this
diff --git a/vendor/hayro-syntax/src/content/mod.rs b/vendor/hayro-syntax/src/content/mod.rs
index 33c0e5bd05..1d71d73d2e 100644
--- a/vendor/hayro-syntax/src/content/mod.rs
+++ b/vendor/hayro-syntax/src/content/mod.rs
@@ -190,11 +190,6 @@ impl<'a> UntypedIter<'a> {
             self.committed = self.skip_blanks_and_comments();
         }
 
-        // PdfCraft patch: set when this instruction carried more operands than the limit. Its
-        // operator is then dropped with them, rather than applied to the ones that did fit
-        // (#3568).
-        let mut overflowed = false;
-
         while !self.reader.at_end() {
             // I believe booleans/null never appear as an operator?
             if matches!(
@@ -212,9 +207,7 @@ impl<'a> UntypedIter<'a> {
                     if self.undecided() {
                         return None;
                     }
-                    if self.stack.push(object).is_none() {
-                        overflowed = true;
-                    }
+                    self.stack.push(object);
                 } else if self.reader.read_without_context::<Operator<'_>>().is_some() {
                     if self.undecided() {
                         return None;
@@ -234,7 +227,6 @@ impl<'a> UntypedIter<'a> {
                     // content was deliberately not parsed.
                     warn!("skipped an unreadable name in content stream");
                     self.stack.clear();
-                    overflowed = false;
                     continue;
                 } else {
                     return None;
@@ -253,7 +245,6 @@ impl<'a> UntypedIter<'a> {
                         // the rest of the page was lost. Step over it and carry on (#3568).
                         if !self.lookahead && self.skip_bad_token() {
                             self.stack.clear();
-                            overflowed = false;
                             continue;
                         }
 
@@ -302,7 +293,7 @@ impl<'a> UntypedIter<'a> {
                         UnfilteredEnd::Found(end_data, end_after_ei) => {
                             let image_data = stream_data.get(..end_data)?;
                             let stream = Stream::new(image_data, dict.clone());
-                            self.stack.push(Object::Stream(stream))?;
+                            self.stack.push(Object::Stream(stream));
                             self.reader.read_bytes(end_after_ei)?;
                             self.reader.skip_white_spaces();
                             accepted = true;
@@ -464,7 +455,7 @@ impl<'a> UntypedIter<'a> {
                                 return None;
                             }
 
-                            self.stack.push(Object::Stream(stream))?;
+                            self.stack.push(Object::Stream(stream));
 
                             self.reader.read_bytes(2)?;
                             self.reader.skip_white_spaces();
@@ -482,17 +473,6 @@ impl<'a> UntypedIter<'a> {
                     }
                 }
 
-                if overflowed && !self.lookahead {
-                    // PdfCraft patch: see `overflowed` above. ISO 32000-2 Annex C gives 10 as the
-                    // historical operand limit; past it the instruction is dropped whole.
-                    warn!("dropped an instruction with more operands than the limit");
-                    self.stack.clear();
-                    overflowed = false;
-                    self.committed = self.reader.offset();
-                    self.reader.skip_white_spaces_and_comments();
-                    continue;
-                }
-
                 self.operator = Some(operator);
                 self.committed = self.reader.offset();
                 // PdfCraft patch (28): operands in reading order, if some were dropped.
@@ -717,11 +697,16 @@ impl<'a> Stack<'a> {
     }
 
     /// PdfCraft patch (28): push an operand, dropping the oldest once `MAX_OPERANDS` are held
-    /// (see `MAX_OPERANDS`). Never fails: it used to, and the failure ended the content stream.
-    fn push(&mut self, operand: Object<'a>) -> Option<()> {
+    /// (see `MAX_OPERANDS`). It cannot fail: it used to, and the failure ended the content stream.
+    ///
+    /// The operands kept are the newest, so the ones nearest the operator -- which are its own.
+    /// No operator takes anywhere near `MAX_OPERANDS` of them (`scn` takes one per colourant, and
+    /// ISO 32000 allows a DeviceN space 32), so an instruction preceded by stray operands is
+    /// applied to its own and the strays fall off the back.
+    fn push(&mut self, operand: Object<'a>) {
         if self.data.len() < MAX_OPERANDS {
             self.data.push(operand);
-            return Some(());
+            return;
         }
 
         self.dropped = true;
@@ -729,7 +714,6 @@ impl<'a> Stack<'a> {
             *slot = operand;
         }
         self.oldest = (self.oldest + 1) % MAX_OPERANDS;
-        Some(())
     }
 
     /// PdfCraft patch (28): put the operands back in the order they were read, oldest first,

From 8a21ed1236fdea41778d00cb46882f134370d522 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 15:06:53 +0100
Subject: [PATCH 138/270] fix(ui): Add text opens a paragraph from just inside
 its edge again

With Add text, the page router's hits kept only the paragraphs' bodies (3d14ffd7), so a click
just inside a closed paragraph's left or right edge, within the edge's grip, had no owner: it
neither opened the paragraph (over_source counts the point as the paragraph's) nor started a new
box. Add text now keeps a paragraph's hit wherever the point lies in a paragraph's box, edges
included, by the same test as over_source (edit_text_ui::over_paragraph), and drops it only
beside the box, where a click starts a new box. The edge's grip shows there again, and a drag
from it rewraps the paragraph, as on main.

New test add_text_opens_a_paragraph_from_just_inside_its_edge, seen failing with this commit's
source reverted. From CodeRabbit's second review of #5300.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs             | 18 +++++++-----------
 crates/ui-egui/src/tools/edit_text_ui.rs |  6 ++++++
 crates/ui-egui/tests/it/editing.rs       | 23 +++++++++++++++++++++++
 3 files changed, 36 insertions(+), 11 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 6bdf5660c6..79c95d049b 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1276,10 +1276,8 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     };
     let on_objects = tool == QuickTool::EditText && can_modify && crate::object_ui::page_input(cx, view);
     let over_source = tool == QuickTool::AddText
-        && pointer.is_some_and(|p| {
-            !crate::content_ui::hits_added(&xf, info, i, added, p)
-                && lines.iter().any(|line| xf.user_rect(info, i, line.rect.map(|v| v as f32)).expand(2.0).contains(p))
-        });
+        && pointer
+            .is_some_and(|p| !crate::content_ui::hits_added(&xf, info, i, added, p) && crate::edit_text_ui::over_paragraph(&xf, info, i, &lines, p));
     let source_blocked = over_source && view.content.hold_blocked();
     if over_source && resp.clicked() && !source_blocked {
         if let Some(edit) = view.content.finish_draft(added) {
@@ -1433,16 +1431,14 @@ impl PageHits<'_> {
                 .filter(|e| !e.has_changes())
                 .and_then(|e| lines.get(e.block))
                 .map(|l| xf.user_rect(info, page, l.rect.map(|v| v as f32)).expand(2.0));
-            // Add text acts on the page's paragraphs only over their text (it finishes the box
-            // being typed there): not on pictures, nor beside a paragraph, where a click starts
-            // a new box.
+            // Add text acts on the page's paragraphs only in their boxes, edges included (it
+            // finishes the box being typed there, `over_source`): not on pictures, nor beside a
+            // paragraph, where a click starts a new box.
             let edit_text = tool == QuickTool::EditText;
-            let body = |h: &crate::page_router::Hit| {
-                matches!(h.owner, crate::page_router::Owner::Paragraph { part: crate::page_router::ParagraphPart::Body, .. })
-            };
+            let on_paragraphs = edit_text || crate::edit_text_ui::over_paragraph(xf, info, page, lines, p);
             (
                 edit_text.then(|| crate::edit_text_ui::picture_hit(xf, page, info, images, view, p)).flatten(),
-                crate::edit_text_ui::hit(xf, info, page, lines, open.map(|e| e.block), p).filter(|h| edit_text || body(h)),
+                on_paragraphs.then(|| crate::edit_text_ui::hit(xf, info, page, lines, open.map(|e| e.block), p)).flatten(),
                 edit_text.then(|| crate::object_ui::hit(view, xf, info, page, frame, p)).flatten(),
                 edit_text.then(|| crate::edit_text_ui::picture_handle_hit(clip, xf, page, info, images, view, p)).flatten(),
             )
diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
index 6ec31b0015..f5f19582de 100644
--- a/crates/ui-egui/src/tools/edit_text_ui.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -273,6 +273,12 @@ fn paragraph_box(xf: &PageXform, info: &DocInfo, page: usize, rect: [f64; 4]) ->
     xf.user_rect(info, page, rect.map(|v| v as f32)).expand(2.0)
 }
 
+/// Whether `p` lies in the box of one of the paragraphs `lines` on `page`, its edge grips there
+/// included, not beside it: where Add text acts on the page's own paragraphs.
+pub(crate) fn over_paragraph(xf: &PageXform, info: &DocInfo, page: usize, lines: &[pdfcraft_engine::TextBlock], p: Pos2) -> bool {
+    lines.iter().any(|l| paragraph_box(xf, info, page, l.rect).contains(p))
+}
+
 /// The width handles need the page upright (or upside down): on a quarter-turned page the
 /// screen's horizontal is the paragraph's vertical.
 fn has_edges(info: &DocInfo, page: usize) -> bool {
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 96020a67fd..508e27bab2 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -3971,6 +3971,29 @@ fn add_text_places_a_box_on_a_picture_and_beside_a_paragraph() {
     assert!(h.state().views[0].content.draft.is_some(), "a click beside the paragraph starts a text box");
 }
 
+/// Add text opens a paragraph with a click anywhere in its box, just inside its edge too, where the
+/// edge's grip shows (a drag there rewraps it, as with Edit text). Add text's hits left the grip
+/// out there, so the click neither opened the paragraph nor started a box.
+#[test]
+fn add_text_opens_a_paragraph_from_just_inside_its_edge() {
+    let mut h = harness(2, |_| {});
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::AddText;
+    h.run_steps(2);
+    let id = h.state().views[0].id;
+    let block = h.state().session.get(id).unwrap().text_blocks(0)[0].clone();
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = r.width() / 200.0;
+    // 2 px right of where the text starts: 4 px into its box, within its left edge's grip.
+    let inside = egui::pos2(r.left() + block.rect[0] as f32 * k, r.top() + (300.0 - ((block.rect[1] + block.rect[3]) / 2.0) as f32) * k)
+        + egui::vec2(2.0, 0.0);
+    h.hover_at(inside);
+    h.run_steps(2);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::ResizeHorizontal, "the edge's grip");
+    click_at(&mut h, inside);
+    assert!(h.state().views[0].line_editor.is_some(), "the click opens the paragraph for typing");
+    assert!(h.state().views[0].content.draft.is_none(), "and starts no text box");
+}
+
 #[test]
 fn dragging_the_rotate_knob_turns_a_page_image() {
     let mut png = Vec::new();

From 2929ba854e5a3351896eeb0685e7ffd09afc52fb Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 15:07:04 +0100
Subject: [PATCH 139/270] fix(ui): a click on a link or a form button counts
 only released over it

A click acted on what its press was on wherever the button came up: a press on a link, a push
button, a signature field or a list box that slipped off it before the release (still a click to
egui, within 6 px) followed the link, ran the button's action, opened signing or picked a list
box's option. On main a click went to what lay under its release. Now it needs both: the
link's or the fields' hit test at the release point must give what the press was on, as a button
pressed and released off itself does nothing. Check boxes and radio buttons already did so, by
their overlay's click-outside test.

New tests a_press_on_a_link_released_off_it_follows_nothing and
a_press_on_a_button_released_off_it_runs_nothing, seen failing with this commit's source
reverted; the check box test shares their slipping_click helper. From CodeRabbit's second review
of #5300.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs         |  6 ++--
 crates/ui-egui/src/tools/forms_ui.rs |  5 +++-
 crates/ui-egui/tests/it/pointer.rs   | 45 +++++++++++++++++++++++++++-
 3 files changed, 52 insertions(+), 4 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 79c95d049b..03bfa167a1 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1737,12 +1737,14 @@ fn page_overlays(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_
     paint_field_highlights(painter, &xf, info, form.as_slice(), i, view.highlight_fields);
     // Links: the hand and the link's target, which count only for the tools that follow or
     // edit links (`Layer::reached_by`). Tips draw above the palette, so none shows while it is
-    // open, even beside it.
+    // open, even beside it. A click follows the link its press was on, released over it: one that
+    // slips off the link first follows nothing, as a button's does.
     if unobstructed
         && resp.clicked()
         && tool == QuickTool::Select
         && !input.consumed
-        && let Some(crate::page_router::Owner::Link { index }) = view.router.owner(i)
+        && let Some(owner @ crate::page_router::Owner::Link { index }) = view.router.owner(i)
+        && pointer.and_then(|p| link_hit(info, &xf, i, p)).is_some_and(|h| h.owner == owner)
         && let Some(l) = info.links.get(index)
     {
         frame.out.clicked_link = Some(l.target.clone());
diff --git a/crates/ui-egui/src/tools/forms_ui.rs b/crates/ui-egui/src/tools/forms_ui.rs
index 077ad8550c..7232b1169b 100644
--- a/crates/ui-egui/src/tools/forms_ui.rs
+++ b/crates/ui-egui/src/tools/forms_ui.rs
@@ -208,7 +208,10 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], allowed: b
         view.forms.focus = Some(Focus { press: Some(at), ..open_focus(f, wi) });
         view.forms.pressed = true;
     }
-    if !resp.clicked() {
+    // A click counts released over the widget its press was on, as a button's does: one that slips
+    // off it first does nothing (a check box's overlay closes on it too).
+    if !resp.clicked() || !ptr.pos.and_then(|p| hit(xf, info, page, form, allowed, p)).is_some_and(|h| h.owner == Owner::Field { field, widget: wi })
+    {
         return true;
     }
     if !allowed {
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index 0d058cb458..889caf4c1c 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -132,6 +132,16 @@ fn highlighted_checkbox_pdf() -> Vec<u8> {
     ])
 }
 
+/// A 300×400 page with a push button at x 100..200, y 200..220 whose action opens a web address.
+fn button_pdf() -> Vec<u8> {
+    pdf(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] /DA (/Helv 0 Tf 0 g) >> >>",
+        PAGES,
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (web) /Rect [100 200 200 220] /P 3 0 R /A << /S /URI /URI (https://example.org/) >> >>",
+    ])
+}
+
 /// The app with `pdf` open at `zoom` percent and its first frames run. The left panel stays
 /// open only where a test places the page relative to the window's chrome.
 fn open(pdf: Vec<u8>, zoom: &'static str, left_open: bool) -> Harness<'static, PdfCraftApp> {
@@ -725,13 +735,46 @@ fn field_value(h: &Harness<'_, PdfCraftApp>, name: &str) -> Vec<String> {
 fn a_press_on_one_check_box_released_over_another_ticks_neither() {
     let mut h = open(two_checkboxes_pdf(), "150", false);
     let (press, release) = (at(&h, 119.0, 210.0), at(&h, 121.0, 210.0));
+    slipping_click(&mut h, press, release);
+    assert_eq!((field_value(&h, "agree"), field_value(&h, "other")), (Vec::<String>::new(), Vec::new()), "neither box is ticked");
+}
+
+/// A click whose pointer slips from `press` to `release` before the button comes up (a click
+/// still, to egui, while they are close), in frames of their own as [`mouse_click`] sends them.
+fn slipping_click(h: &mut Harness<'_, PdfCraftApp>, press: egui::Pos2, release: egui::Pos2) {
     h.hover_at(press);
     h.run_steps(1);
     h.drag_at(press);
     h.run_steps(1);
     h.drop_at(release);
     h.run_steps(4);
-    assert_eq!((field_value(&h, "agree"), field_value(&h, "other")), (Vec::<String>::new(), Vec::new()), "neither box is ticked");
+}
+
+/// A click follows the link its press was on only when released over it: pressed just inside the
+/// link's edge and released just past it, it follows nothing, as a button pressed and released off
+/// itself does nothing. The press used to be enough.
+#[test]
+fn a_press_on_a_link_released_off_it_follows_nothing() {
+    let mut h = open(link_pdf(), "150", false);
+    // The link ends at x 250.
+    let press = at(&h, 249.0, 325.0);
+    slipping_click(&mut h, press, press + egui::vec2(5.0, 0.0));
+    assert_eq!(h.state().pending_link, None, "nothing asks to open the link");
+    mouse_click(&mut h, press);
+    assert!(h.state().pending_link.is_some(), "a click there asks to open it");
+}
+
+/// The same for a push button: pressed just inside its edge and released just past it, it runs no
+/// action. The press used to be enough.
+#[test]
+fn a_press_on_a_button_released_off_it_runs_nothing() {
+    let mut h = open(button_pdf(), "150", false);
+    // The button ends at x 200.
+    let press = at(&h, 199.0, 210.0);
+    slipping_click(&mut h, press, press + egui::vec2(5.0, 0.0));
+    assert_eq!(h.state().pending_link, None, "the button's action does not run");
+    mouse_click(&mut h, press);
+    assert!(h.state().pending_link.is_some(), "a click there runs it");
 }
 
 /// Text markup lies on the text, under a form field: a click on a check box under a highlight

From 11bc8c56528fc3a820669d41c0eec29310cdad24 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 15:32:48 +0100
Subject: [PATCH 140/270] fix(ui): Add text finishes a paragraph drag that
 leaves the paragraph's box

With Add text the page's own paragraphs took input only while the pointer was over one
(over_source), and their drags end in edit_text_ui::page_input. A paragraph dragged off its box
was left hanging after the release (block_drag), to land wherever the pointer next met a
paragraph; one flicked off in its first move never started, so nothing moved. main has the same
test. Add text now also acts on the paragraph the page router says holds the press, until the
button is up, so the drag ends where it is released, as with Edit text, and Add text's
new-box path does not take the press over.

New test add_text_finishes_a_paragraph_drag_that_leaves_its_box, seen failing before the fix
(the drag still pending after the release); the flick was checked by hand the same way. From
CodeRabbit's third review of #5300.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs       |  8 ++++++--
 crates/ui-egui/tests/it/editing.rs | 33 ++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 03bfa167a1..c39fdedef1 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1275,9 +1275,13 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         crate::redact_ui::page_input(cx, over_text, view)
     };
     let on_objects = tool == QuickTool::EditText && can_modify && crate::object_ui::page_input(cx, view);
+    // Add text acts on the page's own paragraphs over them, and on the one its press was on until
+    // the button is up: a drag that leaves the box still ends, and no new box takes it over.
     let over_source = tool == QuickTool::AddText
-        && pointer
-            .is_some_and(|p| !crate::content_ui::hits_added(&xf, info, i, added, p) && crate::edit_text_ui::over_paragraph(&xf, info, i, &lines, p));
+        && (matches!(view.router.owner(i), Some(crate::page_router::Owner::Paragraph { .. }))
+            || pointer.is_some_and(|p| {
+                !crate::content_ui::hits_added(&xf, info, i, added, p) && crate::edit_text_ui::over_paragraph(&xf, info, i, &lines, p)
+            }));
     let source_blocked = over_source && view.content.hold_blocked();
     if over_source && resp.clicked() && !source_blocked {
         if let Some(edit) = view.content.finish_draft(added) {
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 508e27bab2..baeee71f5c 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -3994,6 +3994,39 @@ fn add_text_opens_a_paragraph_from_just_inside_its_edge() {
     assert!(h.state().views[0].content.draft.is_none(), "and starts no text box");
 }
 
+/// With Add text a paragraph dragged off its own box still moves to where the button comes up, as
+/// with Edit text. Add text acted on the page's paragraphs only while the pointer was over one, so
+/// the drag was left hanging, to land wherever the pointer next met a paragraph.
+#[test]
+fn add_text_finishes_a_paragraph_drag_that_leaves_its_box() {
+    let mut h = harness(2, |_| {});
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::AddText;
+    h.run_steps(2);
+    let id = h.state().views[0].id;
+    let before = h.state().session.get(id).unwrap().text_blocks(0)[0].rect;
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = r.width() / 200.0;
+    let from = egui::pos2(r.left() + ((before[0] + before[2]) / 2.0) as f32 * k, r.top() + (300.0 - ((before[1] + before[3]) / 2.0) as f32) * k);
+    // The drag starts in the box (8 px down), then goes 60 pt down, onto the blank page under it.
+    h.hover_at(from);
+    h.run_steps(1);
+    h.drag_at(from);
+    h.run_steps(1);
+    h.hover_at(from + egui::vec2(0.0, 8.0));
+    h.run_steps(1);
+    for i in 1..=4 {
+        h.hover_at(from + egui::vec2(0.0, 15.0 * k * i as f32));
+        h.run_steps(1);
+    }
+    h.drop_at(from + egui::vec2(0.0, 60.0 * k));
+    for _ in 0..10 {
+        h.run_steps(2);
+    }
+    assert!(h.state().views[0].block_drag.is_none(), "the drag is over");
+    let after = h.state().session.get(id).unwrap().text_blocks(0)[0].rect;
+    assert!(before[1] - after[1] > 50.0, "the paragraph moved down with it: {before:?} to {after:?}");
+}
+
 #[test]
 fn dragging_the_rotate_knob_turns_a_page_image() {
     let mut png = Vec::new();

From f175beb25a17fc9dc967d396aeae1a10c503549e Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Fri, 23 Oct 2026 21:16:12 +0200
Subject: [PATCH 141/270] M11: PDF Optimizer stores black-and-white images as
 CCITT Group 4 when smaller

pdfcraft_filters::encode_g4 encodes packed 1-bit rows as Group 4 (ITU-T
T.6, /K -1) through the fax crate (MIT, already in the tree via tiff),
with rows capped at 32,767 samples so its 16-bit positions can't
overflow; round trips are checked against hayro-ccitt.

The optimizer (Settings::mono, CCITT G4 by default, so Reduce File Size
too) re-encodes a 1-bit image of one colour component, or an image
mask, stored with no filter or general-purpose ones, when that is
smaller as stored. The samples decode to the same bits, so colour
space, decode array and masks stay. PDF Optimizer gets a Monochrome
Images row and doc_optimize a mono option. optimize.mono-compression
goes from planned to partial (JBIG2 and monochrome downsampling not
yet).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 Cargo.lock                                  |   2 +
 Cargo.toml                                  |   4 +
 ROADMAP.md                                  |   1 +
 crates/automation/src/documents.rs          |   9 +-
 crates/automation/src/tools.rs              |   3 +-
 crates/automation/tests/it/automation.rs    |  89 ++++++++++
 crates/filters/Cargo.toml                   |   4 +-
 crates/filters/README.md                    |   7 +-
 crates/filters/src/ccitt.rs                 | 182 +++++++++++++++++++
 crates/filters/src/lib.rs                   |   6 +-
 crates/optimize/README.md                   |   8 +
 crates/optimize/src/images.rs               |  64 ++++++-
 crates/optimize/src/lib.rs                  |  17 +-
 crates/optimize/tests/optimize.rs           | 185 +++++++++++++++++++-
 crates/ui-egui/src/i18n/ar.tsv              |   2 +
 crates/ui-egui/src/i18n/bg.tsv              |   2 +
 crates/ui-egui/src/i18n/ca.tsv              |   2 +
 crates/ui-egui/src/i18n/ckb.tsv             |   2 +
 crates/ui-egui/src/i18n/cs.tsv              |   2 +
 crates/ui-egui/src/i18n/de.tsv              |   2 +
 crates/ui-egui/src/i18n/el.tsv              |   2 +
 crates/ui-egui/src/i18n/es.tsv              |   2 +
 crates/ui-egui/src/i18n/fi.tsv              |   2 +
 crates/ui-egui/src/i18n/fr.tsv              |   2 +
 crates/ui-egui/src/i18n/hi.tsv              |   2 +
 crates/ui-egui/src/i18n/hu.tsv              |   2 +
 crates/ui-egui/src/i18n/id.tsv              |   2 +
 crates/ui-egui/src/i18n/it.tsv              |   2 +
 crates/ui-egui/src/i18n/ja.tsv              |   2 +
 crates/ui-egui/src/i18n/kk.tsv              |   2 +
 crates/ui-egui/src/i18n/ko.tsv              |   2 +
 crates/ui-egui/src/i18n/lo.tsv              |   2 +
 crates/ui-egui/src/i18n/lt.tsv              |   2 +
 crates/ui-egui/src/i18n/nb.tsv              |   2 +
 crates/ui-egui/src/i18n/pl.tsv              |   2 +
 crates/ui-egui/src/i18n/pt-br.tsv           |   2 +
 crates/ui-egui/src/i18n/ro.tsv              |   2 +
 crates/ui-egui/src/i18n/ru.tsv              |   2 +
 crates/ui-egui/src/i18n/sl.tsv              |   2 +
 crates/ui-egui/src/i18n/sq.tsv              |   2 +
 crates/ui-egui/src/i18n/te.tsv              |   2 +
 crates/ui-egui/src/i18n/th.tsv              |   2 +
 crates/ui-egui/src/i18n/tr.tsv              |   2 +
 crates/ui-egui/src/i18n/uk.tsv              |   2 +
 crates/ui-egui/src/i18n/vi.tsv              |   2 +
 crates/ui-egui/src/i18n/zh-hans.tsv         |   2 +
 crates/ui-egui/src/i18n/zh-hant.tsv         |   2 +
 crates/ui-egui/src/workflows/optimize_ui.rs |  20 ++-
 crates/ui-egui/tests/it/create.rs           |   2 +
 docs/roadmap.md                             |   2 +
 parity/acrobat-features.toml                |  12 +-
 51 files changed, 666 insertions(+), 17 deletions(-)
 create mode 100644 crates/filters/src/ccitt.rs

diff --git a/Cargo.lock b/Cargo.lock
index 8fd7c9133b..42426bc688 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4424,7 +4424,9 @@ dependencies = [
 name = "pdfcraft-filters"
 version = "0.15.0"
 dependencies = [
+ "fax",
  "flate2",
+ "hayro-ccitt",
  "proptest",
  "thiserror 2.0.21",
  "weezl 0.2.1",
diff --git a/Cargo.toml b/Cargo.toml
index 64a3cf5b60..5a92b67475 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -65,6 +65,10 @@ hayro-syntax = "0.7.2"
 lopdf = "0.45"
 flate2 = { version = "1.1", default-features = false, features = ["rust_backend"] }
 weezl = "0.2"
+# CCITT Group 4 encoding (pdfcraft-filters); already in the tree through tiff.
+fax = "0.2.7"
+# An independent CCITT decoder, for round-trip tests; already in the tree through hayro.
+hayro-ccitt = "0.3"
 
 # foundation
 thiserror = "2"
diff --git a/ROADMAP.md b/ROADMAP.md
index f5de8044e1..42f70325bc 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,6 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
+- **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
 - **2026-10-23 (M7, #2636 partial):** A new `PasteContent` edit pastes an added text box or image copied in the same document or another, keeping its style, picture, turns, flips and crop, as one undo step; `content_copy` drives it headlessly. A paste lands beside earlier copies (18 pt steps) and stays on the page. A pasted image reuses its picture object in its own document and after the first paste into another; there a colour profile is dropped and CMYK colours stored losslessly are turned to RGB. The desktop keys and menus follow in separate PRs. Estimates unchanged.
diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
index 476c451028..1b26dec7f1 100644
--- a/crates/automation/src/documents.rs
+++ b/crates/automation/src/documents.rs
@@ -279,7 +279,7 @@ impl Automation {
     }
 
     pub(crate) fn doc_optimize(&mut self, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, Preset};
+        use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, MonoCompression, Preset};
         let id = self.doc(a)?.id;
         let before = self.doc(a)?.bytes.len();
         let path = self.resolve(a.str("path")?, true)?;
@@ -317,6 +317,13 @@ impl Automation {
         };
         settings.color = images("color", settings.color)?;
         settings.gray = images("gray", settings.gray)?;
+        if let Some(c) = a.get("mono").and_then(|m| m.get("compression")).and_then(Value::as_str) {
+            settings.mono = match c {
+                "ccitt_g4" | "ccitt" | "g4" => MonoCompression::CcittG4,
+                "retain" => MonoCompression::Retain,
+                other => return Err(ToolError::InvalidArgs(format!("unknown mono compression {other:?} (ccitt_g4, retain)"))),
+            };
+        }
         for (key, flag) in [
             ("merge_fragments", &mut settings.merge_fragments),
             ("discard_thumbnails", &mut settings.discard_thumbnails),
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 53c4582af9..c4a9f283b5 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1433,7 +1433,7 @@ pub fn tools() -> Vec<ToolDef> {
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
             .with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
-        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
+        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { compression: ccitt_g4|retain } (default ccitt_g4: black-and-white images and image masks are stored losslessly as CCITT Group 4 when that is smaller; counted in images_recompressed). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
             .cmd("optimize.advanced")
             .with(schema(
                 json!({
@@ -1444,6 +1444,7 @@ pub fn tools() -> Vec<ToolDef> {
                     "merge_fragments": { "type": "boolean" },
                     "color": { "type": "object" },
                     "gray": { "type": "object" },
+                    "mono": { "type": "object" },
                     "discard_thumbnails": { "type": "boolean" },
                     "discard_alternate_images": { "type": "boolean" },
                     "discard_tags": { "type": "boolean" },
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 01d0d1eb24..aa4b50d087 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6372,6 +6372,95 @@ fn lzw_streams_are_stored_with_flate_through_tools() {
     assert_eq!(filters("kept.pdf"), (Some(Object::name("LZWDecode")), ops));
 }
 
+/// A one-page PDF drawing a 1-bit scan of text (glyph strokes with ragged edges, as a scanner
+/// leaves them) of 1000 × 400 samples, stored with Flate.
+fn scanned_page() -> Vec<u8> {
+    use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_full};
+    let (w, h) = (1000usize, 400usize);
+    let stride = w.div_ceil(8);
+    let mut data = vec![0xFFu8; stride * h];
+    let mut seed = 0x2545_F491_4F6C_DD1Du64;
+    let mut next = move || {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        seed
+    };
+    for line in (4..h - 20).step_by(24) {
+        let mut x = 8;
+        while x + 12 < w {
+            let wide = 3 + (next() % 5) as usize;
+            let (top, bottom) = (line + (next() % 4) as usize, line + 14);
+            for y in top..bottom {
+                let left = x + usize::from(next() % 8 == 0);
+                let right = x + wide - usize::from(next() % 8 == 0);
+                for xx in left..right {
+                    data[y * stride + xx / 8] &= !(0x80 >> (xx % 8));
+                }
+            }
+            x += wide + 2 + (next() % 4) as usize;
+        }
+    }
+    let mut doc = Document::new_empty();
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("XObject"));
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w as i64));
+    d.set(b"Height".to_vec(), Object::Int(h as i64));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    let image = doc.add(Object::Stream(Stream::flate(d, &data)));
+    let pages = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|d| d.reference(b"Pages"))).unwrap();
+    let mut x = Dict::new();
+    x.set(b"Scan".to_vec(), Object::Ref(image));
+    let mut res = Dict::new();
+    res.set(b"XObject".to_vec(), Object::Dict(x));
+    let content = doc.add(Object::Stream(Stream::from_raw(Dict::new(), b"q 500 0 0 200 50 500 cm /Scan Do Q".to_vec())));
+    let mut p = Dict::new();
+    p.set(b"Type".to_vec(), Object::name("Page"));
+    p.set(b"Parent".to_vec(), Object::Ref(pages));
+    p.set(b"MediaBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 612.into(), 792.into()]));
+    p.set(b"Resources".to_vec(), Object::Dict(res));
+    p.set(b"Contents".to_vec(), Object::Ref(content));
+    let page = doc.add(Object::Dict(p));
+    doc.update_dict(pages, |d| {
+        d.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(page)]));
+        d.set(b"Count".to_vec(), Object::Int(1));
+    })
+    .unwrap();
+    write_full(&doc, &SaveOptions::default()).unwrap()
+}
+
+/// A scan's black-and-white image is stored as CCITT Group 4 by default, and kept as it is with
+/// `mono: { compression: retain }`.
+#[test]
+fn doc_optimize_stores_black_and_white_images_as_ccitt_group_4() {
+    let dir = workdir("optimize-mono");
+    std::fs::write(dir.join("scan.pdf"), scanned_page()).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "scan.pdf" }))["doc"].as_u64().unwrap();
+    let kept = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "kept.pdf", "mono": { "compression": "retain" } }));
+    assert_eq!((kept["images"].as_u64(), kept["images_recompressed"].as_u64()), (Some(1), Some(0)), "{kept}");
+    let r = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "small.pdf" }));
+    assert_eq!((r["images"].as_u64(), r["images_recompressed"].as_u64()), (Some(1), Some(1)), "{r}");
+    assert!(r["image_bytes_after"].as_u64() < r["image_bytes_before"].as_u64(), "{r}");
+    // The copy written stores the image as Group 4.
+    let small = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join("small.pdf")).unwrap())).unwrap();
+    let filters: Vec<Vec<u8>> = small
+        .object_numbers()
+        .into_iter()
+        .filter_map(|num| match &*small.get(pdfcraft_cos::ObjRef { num, generation: small.generation(num) }) {
+            pdfcraft_cos::Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => s.dict.name(b"Filter").map(<[u8]>::to_vec),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(filters, [b"CCITTFaxDecode".to_vec()]);
+    assert!(matches!(
+        a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "mono": { "compression": "jbig2" } })),
+        Err(ToolError::InvalidArgs(_))
+    ));
+}
+
 /// A one-page PDF whose page picture is drawn as `rows` grey images one pixel row high, 600 px
 /// wide on a 72 pt square (600 ppi), as some PDF printers write it.
 fn printed_in_strips(rows: usize) -> Vec<u8> {
diff --git a/crates/filters/Cargo.toml b/crates/filters/Cargo.toml
index 9d2ae34b94..2ed64eb8bd 100644
--- a/crates/filters/Cargo.toml
+++ b/crates/filters/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "pdfcraft-filters"
-description = "PDF stream filters (ISO 32000-2 §7.4): Flate, LZW, predictors, ASCII85, ASCIIHex, RunLength"
+description = "PDF stream filters (ISO 32000-2 §7.4): Flate, LZW, predictors, ASCII85, ASCIIHex, RunLength, CCITT Group 4 encoding"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -11,9 +11,11 @@ repository.workspace = true
 workspace = true
 
 [dependencies]
+fax.workspace = true
 flate2.workspace = true
 thiserror.workspace = true
 
 [dev-dependencies]
+hayro-ccitt.workspace = true
 proptest.workspace = true
 weezl.workspace = true
diff --git a/crates/filters/README.md b/crates/filters/README.md
index 959180d87a..413dff37c1 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -3,7 +3,7 @@
 PDF stream filters: the decoders and encoders behind `/Filter` and `/DecodeParms`.
 
 - **Layer:** L0, standalone. No dependency on any other PdfCraft crate. `cos` depends on it (architecture §3 rule 3).
-- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters).
+- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder.
 - `#![forbid(unsafe_code)]`. Builds for `wasm32-unknown-unknown`.
 
 ## API
@@ -22,6 +22,7 @@ decode_tolerant(chain, data, max_output) -> Result<(Vec<u8>, bool /*partial*/),
 decode_tolerant_counted(chain, data, max_output) -> Result<(Vec<u8>, bool /*partial*/, usize /*decoded*/), (FilterError, usize /*decoded*/)>
 encode(filter, params, data) -> Result<Vec<u8>, FilterError>
 encode_flate(data) -> Vec<u8>   // zlib, level 6
+encode_g4(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as CCITT Group 4; columns <= MAX_G4_COLUMNS
 ```
 
 - `chain` is applied first to last, as in a `/Filter` array.
@@ -40,14 +41,16 @@ encode_flate(data) -> Vec<u8>   // zlib, level 6
 | ASCIIHexDecode | white space ignored, odd digit padded with 0, `>` EOD (optional), other characters → Corrupt | upper case, newline every 64 digits, `>` |
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
+| CCITTFaxDecode | not here (`Unsupported`; renderers decode it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
 
 ## Tests
 
 - Unit tests per filter with hand-computed vectors (the ISO 32000-2 LZW example, RFC 1951 stored blocks, PNG/TIFF rows).
 - LZW is cross-checked against `weezl` (dev-dependency) in both directions for both early-change settings.
 - `tests/proptests.rs`: encode→decode round trips for every encodable filter × predictor × colors × bpc × columns, two-filter chains, output-limit checks, and fuzz-style no-panic tests (random bytes, random/nonsense params, bit-flipped valid streams).
+- `ccitt.rs`: Group 4 output decoded by `hayro-ccitt` (dev-dependency, an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
 - `fuzz/`: a detached cargo-fuzz crate (`cargo +nightly fuzz run decode`, run from `crates/filters/`).
 
 ## Status
 
-M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image codecs (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2, CCITT G3/G4 decode and G4 encode, DCT encode) and Flate encode levels other than 6.
+M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image codecs (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2, CCITT G3/G4 decode, DCT encode), CCITT Group 3 encoding and Flate encode levels other than 6.
diff --git a/crates/filters/src/ccitt.rs b/crates/filters/src/ccitt.rs
new file mode 100644
index 0000000000..3c8018525a
--- /dev/null
+++ b/crates/filters/src/ccitt.rs
@@ -0,0 +1,182 @@
+//! CCITT Group 4 (ITU-T T.6) encoding, for `CCITTFaxDecode` with `/K -1` (ISO 32000-2 §7.4.6).
+//! The coding is the `fax` crate's; this module checks what it is given.
+
+use fax::encoder::Encoder;
+use fax::{Color, VecWriter};
+
+use crate::FilterError;
+
+/// The widest row [`encode_g4`] encodes. The encoder counts the positions in a row in 16 bits
+/// and adds two of them, so a row stays within half that range.
+pub const MAX_G4_COLUMNS: u32 = 32_767;
+
+/// `rows` rows of `columns` 1-bit samples, most significant bit first, each row starting on a new
+/// byte (as a PDF image's samples are packed), encoded as CCITT Group 4 with an end-of-block mark.
+///
+/// A 0 bit is coded black and a 1 bit white, so the stream decodes to the same bits with
+/// `/BlackIs1 false`, the default: an image keeps its colour space and decode array. Bytes after
+/// the last row are ignored, as are the bits that pad a row to a whole byte.
+///
+/// Errors: no rows or columns, or rows wider than [`MAX_G4_COLUMNS`] ([`FilterError::Unsupported`]);
+/// fewer bytes than the rows need ([`FilterError::Corrupt`]).
+pub fn encode_g4(data: &[u8], columns: u32, rows: u32) -> Result<Vec<u8>, FilterError> {
+    let width = match u16::try_from(columns) {
+        Ok(w) if w > 0 && columns <= MAX_G4_COLUMNS => w,
+        _ => return Err(FilterError::Unsupported(format!("CCITT Group 4 encoding of rows {columns} samples wide"))),
+    };
+    if rows == 0 {
+        return Err(FilterError::Unsupported("CCITT Group 4 encoding of an image without rows".into()));
+    }
+    let stride = usize::from(width).div_ceil(8);
+    let samples = usize::try_from(rows).ok().and_then(|r| r.checked_mul(stride)).and_then(|n| data.get(..n)).ok_or_else(|| FilterError::Corrupt {
+        filter: "CCITTFaxDecode",
+        detail: format!("{} bytes for {rows} rows of {columns} samples", data.len()),
+    })?;
+    let mut encoder = Encoder::new(VecWriter::new());
+    for row in samples.chunks_exact(stride) {
+        let pels = (0..usize::from(width)).map(|x| {
+            let white = row.get(x / 8).is_some_and(|b| b & (0x80 >> (x % 8)) != 0);
+            if white { Color::White } else { Color::Black }
+        });
+        // `VecWriter` writes to memory: its error type has no values.
+        if let Err(never) = encoder.encode_line(pels, width) {
+            match never {}
+        }
+    }
+    match encoder.finish() {
+        Ok(writer) => Ok(writer.finish()),
+        Err(never) => match never {},
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The rows decoded by an independent decoder (`hayro-ccitt`), as 1 for white and 0 for black.
+    pub(crate) fn decode(data: &[u8], columns: u32, rows: u32) -> Vec<Vec<bool>> {
+        struct Rows(Vec<Vec<bool>>, Vec<bool>, usize);
+        impl hayro_ccitt::Decoder for Rows {
+            fn push_pixel(&mut self, white: bool) {
+                self.1.push(white);
+            }
+            fn push_pixel_chunk(&mut self, white: bool, chunks: u32) {
+                self.1.extend(std::iter::repeat_n(white, chunks as usize * 8));
+            }
+            fn next_line(&mut self) {
+                let mut row = std::mem::take(&mut self.1);
+                row.truncate(self.2);
+                self.0.push(row);
+            }
+        }
+        let settings = hayro_ccitt::DecodeSettings {
+            columns,
+            rows,
+            end_of_block: true,
+            end_of_line: false,
+            rows_are_byte_aligned: false,
+            encoding: hayro_ccitt::EncodingMode::Group4,
+            invert_black: false,
+        };
+        let mut out = Rows(Vec::new(), Vec::new(), columns as usize);
+        hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings)).unwrap();
+        out.0
+    }
+
+    /// The rows of packed samples `data`, as 1 for a 1 bit.
+    pub(crate) fn unpack(data: &[u8], columns: u32, rows: u32) -> Vec<Vec<bool>> {
+        let stride = (columns as usize).div_ceil(8);
+        (0..rows as usize).map(|y| (0..columns as usize).map(|x| data[y * stride + x / 8] & (0x80 >> (x % 8)) != 0).collect()).collect()
+    }
+
+    #[test]
+    fn a_page_of_text_like_marks_round_trips_and_shrinks() {
+        let (w, h) = (1700u32, 220u32);
+        let stride = (w as usize).div_ceil(8);
+        let mut data = vec![0xFF; stride * h as usize];
+        // Short black strokes in lines, like glyphs on a white page.
+        for y in (20..h as usize).step_by(40) {
+            for dy in 0..12 {
+                for x in (100..1600).step_by(9) {
+                    if (x / 9 + dy) % 5 != 0 {
+                        data[(y + dy) * stride + x / 8] &= !(0x80 >> (x % 8));
+                    }
+                }
+            }
+        }
+        let g4 = encode_g4(&data, w, h).unwrap();
+        assert_eq!(decode(&g4, w, h), unpack(&data, w, h));
+        assert!(g4.len() * 4 < data.len(), "{} bytes from {}", g4.len(), data.len());
+    }
+
+    #[test]
+    fn padding_bits_and_trailing_bytes_are_ignored() {
+        // 3 columns: the last 5 bits of each byte pad the row; set them to anything.
+        let data = [0b1010_1111, 0b0101_0000, 0b1110_1010, 0xAB, 0xCD];
+        let g4 = encode_g4(&data, 3, 3).unwrap();
+        assert_eq!(decode(&g4, 3, 3), [[true, false, true], [false, true, false], [true, true, true]]);
+    }
+
+    #[test]
+    fn what_it_cannot_encode_is_an_error() {
+        assert!(matches!(encode_g4(&[0; 8], 0, 1), Err(FilterError::Unsupported(_))));
+        assert!(matches!(encode_g4(&[0; 8], 8, 0), Err(FilterError::Unsupported(_))));
+        assert!(matches!(encode_g4(&vec![0; 4097], MAX_G4_COLUMNS + 1, 1), Err(FilterError::Unsupported(_))));
+        assert!(matches!(encode_g4(&[0; 3], 16, 2), Err(FilterError::Corrupt { .. })), "two rows of 16 need 4 bytes");
+        assert!(matches!(encode_g4(&[], 1, u32::MAX), Err(FilterError::Corrupt { .. })));
+        let widest = vec![0x55; (MAX_G4_COLUMNS as usize).div_ceil(8) * 2];
+        let g4 = encode_g4(&widest, MAX_G4_COLUMNS, 2).unwrap();
+        assert_eq!(decode(&g4, MAX_G4_COLUMNS, 2), unpack(&widest, MAX_G4_COLUMNS, 2));
+    }
+
+    /// Rows of `columns` samples built from `runs`: alternating white and black runs one longer
+    /// than those values (so never empty, even when shrinking makes them all 0), repeated until the
+    /// rows are full; or, with `noise`, the bytes of `runs` as they are.
+    fn bitmap(columns: u32, rows: u32, runs: &[u8], noise: bool) -> Vec<u8> {
+        let stride = (columns as usize).div_ceil(8);
+        let mut data = vec![0u8; stride * rows as usize];
+        if runs.is_empty() {
+            return data;
+        }
+        if noise {
+            data.iter_mut().zip(runs.iter().cycle()).for_each(|(d, r)| *d = *r);
+            return data;
+        }
+        let (mut white, mut left, mut next) = (true, 1 + usize::from(runs[0]), 1);
+        for y in 0..rows as usize {
+            for x in 0..columns as usize {
+                if left == 0 {
+                    white = !white;
+                    left = 1 + usize::from(runs[next % runs.len()]);
+                    next += 1;
+                }
+                if white {
+                    data[y * stride + x / 8] |= 0x80 >> (x % 8);
+                }
+                left -= 1;
+            }
+        }
+        data
+    }
+
+    proptest::proptest! {
+        /// Any bitmap, of noise or of runs, decodes to its own bits through an independent decoder.
+        #[test]
+        fn bitmaps_round_trip(
+            columns in 1u32..400,
+            rows in 1u32..24,
+            runs in proptest::collection::vec(0u8..=255, 1..48),
+            noise in proptest::bool::ANY,
+        ) {
+            let data = bitmap(columns, rows, &runs, noise);
+            let g4 = encode_g4(&data, columns, rows).unwrap();
+            proptest::prop_assert_eq!(decode(&g4, columns, rows), unpack(&data, columns, rows));
+        }
+
+        /// Whatever it is given, it returns.
+        #[test]
+        fn any_input_returns(data in proptest::collection::vec(0u8..=255, 0..600), columns in 0u32..40_000, rows in 0u32..80) {
+            let _ = encode_g4(&data, columns, rows);
+        }
+    }
+}
diff --git a/crates/filters/src/lib.rs b/crates/filters/src/lib.rs
index 22a78aefdb..b9461435eb 100644
--- a/crates/filters/src/lib.rs
+++ b/crates/filters/src/lib.rs
@@ -6,7 +6,8 @@
 //! TIFF/PNG predictors, `ASCIIHexDecode`, `ASCII85Decode`, `RunLengthDecode`).
 //! Image codecs (`DCTDecode`, `JPXDecode`, `JBIG2Decode`, `CCITTFaxDecode`),
 //! `Crypt` and unknown filters are reported as [`FilterError::Unsupported`] so
-//! callers keep such data encoded.
+//! callers keep such data encoded. 1-bit samples can be encoded as CCITT Group 4
+//! ([`encode_g4`]).
 //!
 //! Every decoder is bounded by a caller-supplied `max_output` (decompression-bomb
 //! defence) and never panics on malformed input.
@@ -15,6 +16,7 @@
 
 mod ascii85;
 mod asciihex;
+mod ccitt;
 mod flate;
 mod lzw;
 mod predictor;
@@ -22,6 +24,8 @@ mod runlength;
 
 use std::borrow::Cow;
 
+pub use ccitt::{MAX_G4_COLUMNS, encode_g4};
+
 /// A PDF stream filter, identified by its `/Filter` name.
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub enum Filter {
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index cbe37f6b7b..6b4d04b071 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -32,6 +32,14 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   its colour transform (an Adobe marker's, else `/ColorTransform`, ISO 32000-2 §7.4.8), so one
   stored untransformed keeps its colours; one whose marker and `/ColorTransform` disagree is left
   alone, since readers differ on which wins.
+- **Monochrome images** (`Settings::mono`, CCITT Group 4 by default): a 1-bit image with one
+  colour component (grey, indexed, a separation) or an image mask, stored with no filter or with
+  general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
+  that is smaller as stored. It is lossless: the samples decode to the same bits, so the colour
+  space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
+  on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
+  JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
+  than 32,767 samples.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index b9761b85fc..0a157b8c33 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -5,7 +5,7 @@ use std::collections::{HashMap, HashSet};
 use pdfcraft_content::{Matrix, Pieces};
 use pdfcraft_cos::{DecodeBudget, Dict, Document, ObjRef, Object, Stream};
 
-use crate::{Compression, ImageSettings, OptimizeError, Report, Settings, Stage};
+use crate::{Compression, ImageSettings, MonoCompression, OptimizeError, Report, Settings, Stage};
 
 /// Images with more pixels than this are left alone (memory).
 const MAX_PIXELS: u64 = 80_000_000;
@@ -532,6 +532,61 @@ fn process(doc: &Document, s: &Stream, ppi: f64, settings: &ImageSettings, n: us
     (after < before).then_some((new, smask))
 }
 
+/// Whether colour space `cs` has one colour component, so a 1-bit image in it has one bit per
+/// pixel: grey, a separation, an indexed space or a DeviceN of one colourant.
+fn one_component(doc: &Document, cs: &Object) -> bool {
+    let cs = doc.resolve(cs);
+    match &*cs {
+        Object::Name(n) => matches!(n.as_slice(), b"DeviceGray" | b"G" | b"CalGray" | b"Indexed" | b"I"),
+        Object::Array(a) => match a.first().and_then(Object::as_name) {
+            Some(b"CalGray" | b"Separation" | b"Indexed" | b"I") => true,
+            Some(b"ICCBased") => a.get(1).is_some_and(|icc| matches!(&*doc.resolve(icc), Object::Stream(s) if s.dict.int(b"N") == Some(1))),
+            Some(b"DeviceN") => a.get(1).is_some_and(|names| doc.resolve(names).as_array().is_some_and(|n| n.len() == 1)),
+            _ => false,
+        },
+        _ => false,
+    }
+}
+
+/// A black-and-white image (one bit per pixel, or an image mask) stored again as CCITT Group 4,
+/// if `compression` asks for that and the result is smaller as stored. Only images whose samples
+/// PdfCraft decodes (no filter, or general-purpose filters: image codecs don't decode here)
+/// qualify. The samples decode to the same bits, so the colour space, decode array and masks stay
+/// as they are.
+fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stream> {
+    if compression != MonoCompression::CcittG4 {
+        return None;
+    }
+    let d = &s.dict;
+    let bits = d.int(b"BitsPerComponent");
+    let qualifies = if matches!(d.get(b"ImageMask"), Some(Object::Bool(true))) {
+        bits.is_none_or(|b| b == 1)
+    } else {
+        bits == Some(1) && d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs))
+    };
+    if !qualifies {
+        return None;
+    }
+    let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
+    if w == 0 || h == 0 || w > pdfcraft_filters::MAX_G4_COLUMNS || u64::from(w) * u64::from(h) > MAX_PIXELS {
+        return None;
+    }
+    let g4 = pdfcraft_filters::encode_g4(&s.decoded().ok()?, w, h).ok()?;
+    let mut new = d.clone();
+    for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
+        new.remove(k);
+    }
+    let mut parms = Dict::new();
+    parms.set(b"K".to_vec(), Object::Int(-1));
+    parms.set(b"Columns".to_vec(), Object::Int(i64::from(w)));
+    parms.set(b"Rows".to_vec(), Object::Int(i64::from(h)));
+    new.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+    new.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+    let new = Stream::from_raw(new, g4);
+    // Smaller as stored, counting the larger dictionary: a tiny image can lose by it.
+    (crate::stored_len(&new)? < crate::stored_len(s)?).then_some(new)
+}
+
 pub(crate) fn run(
     doc: &mut Document,
     pages: &[ObjRef],
@@ -558,6 +613,13 @@ pub(crate) fn run(
         let obj = doc.get(r);
         let Object::Stream(s) = &*obj else { continue };
         report.images += 1;
+        if let Some(new) = mono(doc, s, settings.mono) {
+            report.image_bytes_before += s.raw.len();
+            report.image_bytes_after += new.raw.len();
+            report.images_recompressed += 1;
+            doc.set(r, Object::Stream(new));
+            continue;
+        }
         let Some(n) = s.dict.get(b"ColorSpace").and_then(|cs| components(doc, cs)) else { continue };
         let st = if n == 1 { &settings.gray } else { &settings.color };
         let Some((new, smask)) = process(doc, s, ppi, st, n) else { continue };
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index 9f9fcdf2be..f4f7baf988 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -10,7 +10,8 @@
 //!   A new image replaces the old one only if it is smaller. Images PdfCraft can't decode
 //!   faithfully (CMYK and other colour spaces, masks, decode arrays other than the default,
 //!   JPEG 2000, JBIG2, CCITT, other than 8 bits, JPEGs whose Adobe marker and `/ColorTransform`
-//!   disagree) are left alone.
+//!   disagree) are left alone. Black-and-white (1-bit) images are stored again as CCITT Group 4,
+//!   losslessly, when that is smaller.
 //! - **Discard objects:** page thumbnails, alternate images, document tags (structure tree),
 //!   print settings.
 //! - **Clean up:** drop images and forms that pages list but never draw (such as a deleted
@@ -118,6 +119,15 @@ pub enum Compression {
     Retain,
 }
 
+/// How black-and-white (1-bit) images are stored.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum MonoCompression {
+    /// CCITT Group 4 (lossless), when smaller than the image as it is.
+    CcittG4,
+    /// Keep each image's own compression.
+    Retain,
+}
+
 /// Acrobat's JPEG quality steps.
 pub const QUALITIES: [(&str, u8); 5] = [("Minimum", 25), ("Low", 45), ("Medium", 60), ("High", 80), ("Maximum", 95)];
 
@@ -147,6 +157,8 @@ pub struct Settings {
     pub merge_fragments: bool,
     pub color: ImageSettings,
     pub gray: ImageSettings,
+    /// Black-and-white (1-bit) images, and image masks.
+    pub mono: MonoCompression,
     pub discard_thumbnails: bool,
     pub discard_alternate_images: bool,
     pub discard_tags: bool,
@@ -181,6 +193,7 @@ impl Default for Settings {
             merge_fragments: true,
             color: ImageSettings::REDUCE,
             gray: ImageSettings::REDUCE,
+            mono: MonoCompression::CcittG4,
             discard_thumbnails: true,
             discard_alternate_images: true,
             discard_tags: false,
@@ -539,7 +552,7 @@ fn strip_ascii_wrapper(s: &Stream) -> Option<Stream> {
 
 /// Bytes the stream object takes in the file: its dictionary with `/Length` set as the writer
 /// sets it, then its data.
-fn stored_len(s: &Stream) -> Option<usize> {
+pub(crate) fn stored_len(s: &Stream) -> Option<usize> {
     let mut dict = s.dict.clone();
     dict.set(b"Length".to_vec(), Object::Int(i64::try_from(s.raw.len()).ok()?));
     let mut out = Vec::new();
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 3e69e27cb9..8c0afe89e7 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -5,7 +5,7 @@ use std::sync::Arc;
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, SaveOptions, Stream, write_full};
 use pdfcraft_filters::{Filter, Params};
 use pdfcraft_optimize::{
-    Compatibility, Compression, ImageSettings, OptimizeError, Settings, SpaceCategory, audit_space, effective_resolutions, optimize,
+    Compatibility, Compression, ImageSettings, MonoCompression, OptimizeError, Settings, SpaceCategory, audit_space, effective_resolutions, optimize,
 };
 
 fn image(doc: &mut Document, w: u32, h: u32, n: usize, jpeg: bool, smask: Option<ObjRef>) -> ObjRef {
@@ -218,6 +218,189 @@ fn an_identity_decode_array_does_not_stop_reduce() {
     assert_eq!(stream(&doc, odd).dict.int(b"Width"), Some(900));
 }
 
+/// Rows of `w` 1-bit samples (1 white, 0 black), each starting on a byte: lines of text-like
+/// glyphs; or, with `noise`, random bits.
+fn bilevel(w: u32, h: u32, noise: bool) -> Vec<u8> {
+    let stride = (w as usize).div_ceil(8);
+    let mut data = vec![0xFF; stride * h as usize];
+    let mut seed = 0x9E37_79B9_7F4A_7C15u64;
+    let mut next = move || {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        seed
+    };
+    let mut black = |x: usize, y: usize| {
+        if x < w as usize && y < h as usize {
+            data[y * stride + x / 8] &= !(0x80 >> (x % 8));
+        }
+    };
+    if noise {
+        for y in 0..h as usize {
+            for x in 0..w as usize {
+                if next() & 1 == 0 {
+                    black(x, y);
+                }
+            }
+        }
+        return data;
+    }
+    // Lines 24 rows apart, of glyphs drawn from a few shapes (a stem, a bowl, an arch, a dotted
+    // stem) at any column, 1–3 columns apart with a wider gap between words: text as a scanner
+    // sees it. Clean, identical rows would favour Flate; a scan's ragged edges favour Group 4.
+    for line in (4..h as usize).step_by(24) {
+        let mut x = 8;
+        while x + 16 < w as usize {
+            let wide = 5 + (next() % 4) as usize;
+            let shape = next() % 4;
+            // Now and then a row of a stroke is a column wider or narrower at an edge, as a scan's
+            // edges are.
+            let mut ragged = || match next() % 8 {
+                0 => 0,
+                1 => 2,
+                _ => 1,
+            };
+            let mut fill = |x0: usize, x1: usize, y0: usize, y1: usize| {
+                for y in line + y0..line + y1 {
+                    let (left, right) = ((x + x0 + 1).saturating_sub(ragged()), x + x1 + ragged());
+                    for xx in left..right.saturating_sub(1) {
+                        black(xx, y);
+                    }
+                }
+            };
+            match shape {
+                0 => fill(0, 2, 0, 14),
+                1 => {
+                    fill(0, wide, 4, 6);
+                    fill(0, wide, 12, 14);
+                    fill(0, 2, 4, 14);
+                    fill(wide - 2, wide, 4, 14);
+                }
+                2 => {
+                    fill(0, 2, 4, 14);
+                    fill(wide - 2, wide, 6, 14);
+                    fill(0, wide - 1, 4, 6);
+                }
+                _ => {
+                    fill(0, 2, 7, 14);
+                    fill(0, 2, 2, 4);
+                }
+            }
+            x += wide + 2 + (next() % 2) as usize + if next() % 6 == 0 { 7 } else { 0 };
+        }
+    }
+    data
+}
+
+/// A 1-bit image of `data`, Flate-compressed (with `predictor`, a PNG predictor, if any), with
+/// `entries` added to its dictionary.
+fn mono_image(doc: &mut Document, w: u32, h: u32, data: &[u8], predictor: Option<i64>, entries: &[(&str, Object)]) -> ObjRef {
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("XObject"));
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w as i64));
+    d.set(b"Height".to_vec(), Object::Int(h as i64));
+    for (k, v) in entries {
+        d.set(k.as_bytes().to_vec(), v.clone());
+    }
+    let s = match predictor {
+        None => Stream::flate(d, data),
+        Some(predictor) => {
+            let params = pdfcraft_filters::Params { predictor, colors: 1, bits_per_component: 1, columns: w as i64, early_change: 1 };
+            let mut parms = Dict::new();
+            parms.set(b"Predictor".to_vec(), Object::Int(predictor));
+            parms.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+            parms.set(b"Columns".to_vec(), Object::Int(w as i64));
+            d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+            d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+            Stream::from_raw(d, pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, data).unwrap())
+        }
+    };
+    doc.add(Object::Stream(s))
+}
+
+fn render(doc: &Document) -> Vec<u8> {
+    let bytes = write_full(doc, &SaveOptions::default()).unwrap();
+    let mut r = pdfcraft_render::PageRenderer::new(Arc::new(bytes), pdfcraft_render::RenderConfig::default());
+    let out = r.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+    assert!(out.error.is_none(), "{:?}", out.error);
+    out.rgba.to_vec()
+}
+
+/// Black-and-white images become CCITT Group 4, losslessly: the page looks the same to the pixel.
+/// Grey, an image mask (with a decode array that inverts it), an indexed image of two colours and
+/// one stored with a PNG predictor qualify; noise (bigger as G4), a 1-bit RGB image, one wider
+/// than Group 4 encodes and a tiny one (bigger as stored) are left alone, as is everything with
+/// `mono: Retain`.
+#[test]
+fn black_and_white_images_become_ccitt_group_4() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200, 480);
+    let text = bilevel(w, h, false);
+    let gray = mono_image(&mut doc, w, h, &text, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let decode = Object::Array(vec![1.into(), 0.into()]);
+    let mask = mono_image(&mut doc, w, h, &text, None, &[("ImageMask", Object::Bool(true)), ("Decode", decode.clone())]);
+    let indexed_cs = Object::Array(vec![
+        Object::name("Indexed"),
+        Object::name("DeviceRGB"),
+        1.into(),
+        Object::String(pdfcraft_cos::PdfString::literal(vec![0xC0, 0x10, 0x10, 0xF8, 0xF0, 0xE0])),
+    ]);
+    let indexed = mono_image(&mut doc, w, h, &text, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", indexed_cs.clone())]);
+    let predicted = mono_image(&mut doc, w, h, &text, Some(15), &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let noise =
+        mono_image(&mut doc, 400, 200, &bilevel(400, 200, true), None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let rgb = mono_image(
+        &mut doc,
+        400,
+        160,
+        &bilevel(1200, 160, false),
+        None,
+        &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceRGB"))],
+    );
+    let wide = mono_image(
+        &mut doc,
+        40_000,
+        2,
+        &bilevel(40_000, 2, false),
+        None,
+        &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))],
+    );
+    // 64 × 8 white: its Group 4 data is smaller than its Flate data, but not by the longer
+    // dictionary Group 4 needs.
+    let tiny = mono_image(&mut doc, 64, 8, &[0xFF; 64], None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let tiny_g4 = pdfcraft_filters::encode_g4(&[0xFF; 64], 64, 8).unwrap();
+    assert!(tiny_g4.len() < stream(&doc, tiny).raw.len(), "{} against {}", tiny_g4.len(), stream(&doc, tiny).raw.len());
+    page(
+        &mut doc,
+        &[("G", gray), ("M", mask), ("I", indexed), ("P", predicted), ("N", noise), ("R", rgb), ("W", wide), ("T", tiny)],
+        "q 300 0 0 120 20 660 cm /G Do Q q 0 0.4 0.8 rg 300 0 0 120 320 660 cm /M Do Q q 300 0 0 120 20 520 cm /I Do Q \
+         q 300 0 0 120 320 520 cm /P Do Q q 200 0 0 100 20 400 cm /N Do Q q 200 0 0 80 240 400 cm /R Do Q q 560 0 0 4 20 380 cm /W Do Q q 64 0 0 8 460 400 cm /T Do Q",
+    );
+    let before = render(&doc);
+    let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
+    let untouched = [noise, rgb, wide, tiny].map(|r| raw(&doc, r));
+
+    let mut kept = doc.clone();
+    let r = optimize(&mut kept, &Settings { mono: MonoCompression::Retain, ..Settings::default() }).unwrap();
+    assert_eq!(r.images_recompressed, 0, "Retain keeps every image as it is");
+    assert!([gray, mask, indexed, predicted].iter().all(|i| raw(&kept, *i) == raw(&doc, *i)));
+
+    let r = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(r.images_recompressed, 4);
+    assert!(r.image_bytes_after < r.image_bytes_before, "{} → {}", r.image_bytes_before, r.image_bytes_after);
+    for i in [gray, mask, indexed, predicted] {
+        let s = stream(&doc, i);
+        assert_eq!(s.dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]));
+        let parms = s.dict.get(b"DecodeParms").and_then(Object::as_dict).cloned().unwrap();
+        assert_eq!((parms.int(b"K"), parms.int(b"Columns"), parms.int(b"Rows")), (Some(-1), Some(w as i64), Some(h as i64)));
+    }
+    assert_eq!(stream(&doc, mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");
+    assert_eq!(stream(&doc, indexed).dict.get(b"ColorSpace"), Some(&indexed_cs), "the colour space stays");
+    assert_eq!([noise, rgb, wide, tiny].map(|r| raw(&doc, r)), untouched);
+    assert!(render(&doc) == before, "the page looks the same");
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 3e6d735523..4f43912938 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -597,6 +597,8 @@
 	Clean Up	تنظيف
 	Color Images	الصور الملونة
 	Grayscale Images	الصور الرمادية
+	Monochrome Images	الصور أحادية اللون
+	CCITT Group 4	CCITT المجموعة 4
 	Bicubic downsampling to	تقليل العينات بطريقة Bicubic إلى
 	for images above	للصور التي تتجاوز
 	Compression	الضغط
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index ec0339f18a..9464683b36 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -259,6 +259,8 @@
 	Clean Up	Почистване
 	Color Images	Цветни изображения
 	Grayscale Images	Изображения в сива скала
+	Monochrome Images	Монохромни изображения
+	CCITT Group 4	CCITT група 4
 	Bicubic downsampling to	Бикубично понижаване на резолюцията до
 	for images above	за изображения над
 	Compression	Компресия
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 0cacae3c2c..c7d351ac13 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -560,6 +560,8 @@
 	Clean Up	Neteja
 	Color Images	Imatges en color
 	Grayscale Images	Imatges en escala de grisos
+	Monochrome Images	Imatges monocromes
+	CCITT Group 4	CCITT grup 4
 	Bicubic downsampling to	Reducció bicúbica de resolució a
 	for images above	per a imatges de més de
 	Compression	Compressió
diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index 71c0c62869..c5fa4b6967 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -567,6 +567,8 @@
 	Clean Up	پاککردنەوە
 	Color Images	وێنە ڕەنگاوڕەنگەکان
 	Grayscale Images	وێنە خۆڵەمێشییەکان
+	Monochrome Images	وێنە یەکڕەنگەکان
+	CCITT Group 4	CCITT گرووپی 4
 	Bicubic downsampling to	کەمکردنەوەی نموونە بە شێوازی Bicubic بۆ
 	for images above	بۆ ئەو وێنانەی سەرووی
 	Compression	پەستاندن
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index ed6d051b57..342f762378 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -681,6 +681,8 @@ key	Space	Mezerník
 	Clean Up	Vyčištění
 	Color Images	Barevné obrázky
 	Grayscale Images	Obrázky ve stupních šedi
+	Monochrome Images	Monochromatické obrázky
+	CCITT Group 4	CCITT skupina 4
 	Bicubic downsampling to	Bikubické převzorkování na
 	for images above	u obrázků nad
 	Compression	Komprese
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 8586a21d43..71163b6b96 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -570,6 +570,8 @@
 	Clean Up	Aufräumen
 	Color Images	Farbbilder
 	Grayscale Images	Graustufenbilder
+	Monochrome Images	Monochrome Bilder
+	CCITT Group 4	CCITT Gruppe 4
 	Bicubic downsampling to	Bikubische Neuberechnung auf
 	for images above	für Bilder über
 	Compression	Komprimierung
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index e3eac77caa..13f762d6ca 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -1906,6 +1906,8 @@
 	Clean Up	Εκκαθάριση
 	Color Images	Έγχρωμες εικόνες
 	Grayscale Images	Εικόνες σε κλίμακα του γκρι
+	Monochrome Images	Μονόχρωμες εικόνες
+	CCITT Group 4	CCITT Ομάδα 4
 	Bicubic downsampling to	Δικυβική μείωση ανάλυσης σε
 	for images above	για εικόνες πάνω από
 	ZIP	ZIP
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 0d4e505a70..0457264377 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -593,6 +593,8 @@
 	Clean Up	Limpieza
 	Color Images	Imágenes en color
 	Grayscale Images	Imágenes en escala de grises
+	Monochrome Images	Imágenes monocromas
+	CCITT Group 4	CCITT grupo 4
 	Bicubic downsampling to	Reducción de resolución bicúbica a
 	for images above	para imágenes por encima de
 	Compression	Compresión
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index a542ee9b91..5bd26bff11 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -560,6 +560,8 @@
 	Clean Up	Siivoa
 	Color Images	Värikuvat
 	Grayscale Images	Harmaasävykuvat
+	Monochrome Images	Mustavalkokuvat
+	CCITT Group 4	CCITT ryhmä 4
 	Bicubic downsampling to	Bikuubinen alinäytteistys tarkkuuteen
 	for images above	kuville, joiden tarkkuus yli
 	Compression	Pakkaus
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 61c8b5171d..b5434915af 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -570,6 +570,8 @@
 	Clean Up	Nettoyer
 	Color Images	Images couleur
 	Grayscale Images	Images en niveaux de gris
+	Monochrome Images	Images monochromes
+	CCITT Group 4	CCITT groupe 4
 	Bicubic downsampling to	Sous-échantillonnage bicubique à
 	for images above	pour les images au-dessus de
 	Compression	Compression
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index e9d627aca9..30aa915af7 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -544,6 +544,8 @@
 	Clean Up	सफ़ाई
 	Color Images	रंगीन छवियाँ
 	Grayscale Images	ग्रेस्केल छवियाँ
+	Monochrome Images	मोनोक्रोम छवियाँ
+	CCITT Group 4	CCITT समूह 4
 	Bicubic downsampling to	बाइक्यूबिक डाउनसैंपलिंग तक
 	for images above	इससे बड़ी छवियों के लिए
 	Compression	संपीड़न
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 6b37b9169b..b7e494ab0c 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -568,6 +568,8 @@
 	Clean Up	Tisztítás
 	Color Images	Színes képek
 	Grayscale Images	Szürkeárnyalatos képek
+	Monochrome Images	Monokróm képek
+	CCITT Group 4	CCITT 4. csoport
 	Bicubic downsampling to	Kettős köbös újramintázás erre
 	for images above	az ennél nagyobb képeknél
 	Compression	Tömörítés
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 292b336e10..c87527fee3 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -2055,6 +2055,8 @@ comment menu	Edit	Edit
 	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Rumus dan elemen non-teks serupa memerlukan teks alternatif. Tambahkan teks alternatif ke elemen tersebut.
 	Gray	Abu-abu
 	Grayscale Images	Gambar Skala Abu-abu
+	Monochrome Images	Gambar Monokrom
+	CCITT Group 4	CCITT Grup 4
 	Green	Hijau
 	Green on black	Hijau di atas hitam
 	H / Space (hold)	H / Space (tahan)
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 20729bae6a..62b012f091 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -594,6 +594,8 @@
 	Clean Up	Pulizia
 	Color Images	Immagini a colori
 	Grayscale Images	Immagini in scala di grigi
+	Monochrome Images	Immagini monocromatiche
+	CCITT Group 4	CCITT gruppo 4
 	Bicubic downsampling to	Sottocampionamento bicubico a
 	for images above	per immagini oltre
 	Compression	Compressione
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 1ed4d43b6c..beb3002eb6 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -597,6 +597,8 @@
 	Clean Up	クリーンアップ
 	Color Images	カラー画像
 	Grayscale Images	グレースケール画像
+	Monochrome Images	白黒画像
+	CCITT Group 4	CCITT グループ 4
 	Bicubic downsampling to	バイキュービック法でダウンサンプル:
 	for images above	対象画像の解像度:
 	Compression	圧縮
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 9022c3591c..08a390dade 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -557,6 +557,8 @@
 	Clean Up	Тазалау
 	Color Images	Түсті кескіндер
 	Grayscale Images	Сұр реңкті кескіндер
+	Monochrome Images	Монохромды кескіндер
+	CCITT Group 4	CCITT 4-топ
 	Bicubic downsampling to	Бикубтық төмендету
 	for images above	мұнан асатын кескіндер үшін
 	Compression	Сығымдау
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 09b9cad9fa..1b6dcc99ee 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -544,6 +544,8 @@
 	Clean Up	정리
 	Color Images	컬러 이미지
 	Grayscale Images	회색조 이미지
+	Monochrome Images	흑백 이미지
+	CCITT Group 4	CCITT 그룹 4
 	Bicubic downsampling to	다음 값으로 바이큐빅 다운샘플링
 	for images above	다음 값을 초과하는 이미지에 적용
 	Compression	압축
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index 964467d823..168fccb36e 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -565,6 +565,8 @@
 	Clean Up	ອະນາໄມ
 	Color Images	ຮູບພາບສີ
 	Grayscale Images	ຮູບພາບລະດັບສີເທົາ
+	Monochrome Images	ຮູບພາບຂາວດຳ
+	CCITT Group 4	CCITT ກຸ່ມ 4
 	Bicubic downsampling to	ຫຼຸດຄວາມລະອຽດແບບ Bicubic ລົງເປັນ:
 	for images above	ສຳລັບຮູບພາບທີ່ເກີນ:
 	Compression	ການບີບອັດ
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 43749f4ec8..33ffe03418 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -2123,6 +2123,8 @@ comment menu	Edit	Redaguoti
 	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Formulėms ir panašiems netekstiniams elementams reikia alternatyviojo teksto. Pridėkite jį.
 	Gray	Pilka
 	Grayscale Images	Pilkų atspalvių paveikslėliai
+	Monochrome Images	Vienspalviai paveikslėliai
+	CCITT Group 4	CCITT 4 grupė
 	Green	Žalia
 	Green on black	Žalia juodame fone
 	H / Space (hold)	H / tarpo klavišas (laikyti)
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index 6f1739974a..f3f37a1afa 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -2060,6 +2060,8 @@
 	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Formler og lignende elementer som ikke er tekst, trenger alternativ tekst. Legg til alternativ tekst på dem.
 	Gray	Grå
 	Grayscale Images	Gråtonebilder
+	Monochrome Images	Svart-hvitt-bilder
+	CCITT Group 4	CCITT gruppe 4
 	Green	Grønn
 	Green on black	Grønn på svart
 	H / Space (hold)	H / Mellomrom (hold)
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 963d717584..0dd3604189 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -592,6 +592,8 @@
 	Clean Up	Porządkowanie
 	Color Images	Obrazy kolorowe
 	Grayscale Images	Obrazy w skali szarości
+	Monochrome Images	Obrazy monochromatyczne
+	CCITT Group 4	CCITT grupa 4
 	Bicubic downsampling to	Zmniejsz rozdzielczość metodą dwusześcienną do
 	for images above	dla obrazów powyżej
 	Compression	Kompresja
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index c34ae83bc5..6ab4ec9d85 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -216,6 +216,8 @@
 	Clean Up	Limpar
 	Color Images	Imagens coloridas
 	Grayscale Images	Imagens em escala de cinza
+	Monochrome Images	Imagens monocromáticas
+	CCITT Group 4	CCITT grupo 4
 	Bicubic downsampling to	Redução bicúbica de amostragem para
 	for images above	para imagens acima de
 	Compression	Compactação
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index 78d2298b93..0b0050a4f1 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -2066,6 +2066,8 @@ comment menu	Edit	Editare
 	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Formulele și alte elemente non-text similare au nevoie de text alternativ. Adăugați-le text alternativ.
 	Gray	Gri
 	Grayscale Images	Imagini în tonuri de gri
+	Monochrome Images	Imagini monocrome
+	CCITT Group 4	CCITT grupa 4
 	Green	Verde
 	Green on black	Verde pe negru
 	H / Space (hold)	H / Spațiu (ținut apăsat)
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 274232d586..f9a17709ba 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -590,6 +590,8 @@
 	Clean Up	Очистить
 	Color Images	Цветные изображения
 	Grayscale Images	Изображения в оттенках серого
+	Monochrome Images	Монохромные изображения
+	CCITT Group 4	CCITT группа 4
 	Bicubic downsampling to	Бикубическое уменьшение до
 	for images above	для изображений выше
 	Compression	Сжатие
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 420e6a5996..83790b055e 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -891,6 +891,8 @@
 	Grab bag	Razno
 	Gray	Siva
 	Grayscale Images	Sivinske slike
+	Monochrome Images	Enobarvne slike
+	CCITT Group 4	CCITT skupina 4
 	Green	Zelena
 	H / Space (hold)	H / preslednica (drži)
 	HTML web page	Spletna stran HTML
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index ba7c9dc5b3..cc899a668a 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -880,6 +880,8 @@
 	Grab bag	Të ndryshme
 	Gray	Gri
 	Grayscale Images	Imazhe në nuanca gri
+	Monochrome Images	Imazhe bardhezi
+	CCITT Group 4	CCITT grupi 4
 	Green	Jeshile
 	H / Space (hold)	H / Hapësira (mbaje shtypur)
 	HTML web page	Faqe interneti HTML
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 7f339989ee..43a2782674 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -574,6 +574,8 @@ comment menu	Edit	సవరించు
 	Clean Up	చక్కదిద్దడం
 	Color Images	రంగు చిత్రాలు
 	Grayscale Images	గ్రేస్కేల్ చిత్రాలు
+	Monochrome Images	మోనోక్రోమ్ చిత్రాలు
+	CCITT Group 4	CCITT గ్రూప్ 4
 	Bicubic downsampling to	బైక్యూబిక్ డౌన్‌శాంప్లింగ్, లక్ష్యం:
 	for images above	ఈ రిజల్యూషన్ మించిన చిత్రాలకు:
 	Compression	కుదింపు
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index 2c9b892ed7..4eeeb6f951 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -554,6 +554,8 @@
 	Clean Up	ล้างข้อมูล
 	Color Images	รูปภาพสี
 	Grayscale Images	รูปภาพระดับสีเทา
+	Monochrome Images	รูปภาพขาวดำ
+	CCITT Group 4	CCITT กลุ่ม 4
 	Bicubic downsampling to	ลดความละเอียดแบบ Bicubic เป็น
 	for images above	สำหรับรูปภาพที่สูงกว่า
 	Compression	การบีบอัด
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index a2ecaea179..d5124513cf 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -555,6 +555,8 @@
 	Clean Up	Temizle
 	Color Images	Renkli Resimler
 	Grayscale Images	Gri Tonlamalı Resimler
+	Monochrome Images	Tek Renkli Resimler
+	CCITT Group 4	CCITT Grup 4
 	Bicubic downsampling to	Şu değere bikübik alt örnekleme:
 	for images above	bundan büyük resimler için:
 	Compression	Sıkıştırma
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 9c76868839..8051e42f82 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -595,6 +595,8 @@
 	Clean Up	Очищення
 	Color Images	Кольорові зображення
 	Grayscale Images	Зображення у відтінках сірого
+	Monochrome Images	Монохромні зображення
+	CCITT Group 4	CCITT група 4
 	Bicubic downsampling to	Бікубічне зниження роздільної здатності до
 	for images above	для зображень із роздільною здатністю понад
 	Compression	Стиснення
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 973ba870ea..8703b4c8ee 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -2111,6 +2111,8 @@ comment menu	Edit	Sửa
 	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Công thức và các phần tử không phải văn bản tương tự cần có văn bản thay thế. Hãy thêm văn bản thay thế cho chúng.
 	Gray	Xám
 	Grayscale Images	Ảnh thang xám
+	Monochrome Images	Ảnh đơn sắc
+	CCITT Group 4	CCITT nhóm 4
 	Green	Xanh lá
 	Green on black	Xanh lá trên nền đen
 	H / Space (hold)	H / Space (giữ)
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index d77c8f6425..da2722c7fa 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -265,6 +265,8 @@
 	Clean Up	清理
 	Color Images	彩色图像
 	Grayscale Images	灰度图像
+	Monochrome Images	单色图像
+	CCITT Group 4	CCITT 第 4 组
 	Bicubic downsampling to	双三次降采样至
 	for images above	（高于此分辨率的图像）
 	Compression	压缩
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index ce3b939f1d..8f42d9da3b 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -221,6 +221,8 @@
 	Clean Up	清理
 	Color Images	彩色圖片
 	Grayscale Images	灰階圖片
+	Monochrome Images	單色圖片
+	CCITT Group 4	CCITT 第 4 組
 	Bicubic downsampling to	雙三次降取樣至
 	for images above	（高於此解析度的圖片）
 	Compression	壓縮
diff --git a/crates/ui-egui/src/workflows/optimize_ui.rs b/crates/ui-egui/src/workflows/optimize_ui.rs
index 3bb80ac439..d3a5cfd4a1 100644
--- a/crates/ui-egui/src/workflows/optimize_ui.rs
+++ b/crates/ui-egui/src/workflows/optimize_ui.rs
@@ -8,7 +8,7 @@
 use std::sync::{Arc, Mutex};
 
 use egui::{Align, Layout, RichText};
-use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, Preset, QUALITIES, Settings};
+use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, MonoCompression, Preset, QUALITIES, Settings};
 use pdfcraft_engine::optimizer::{OptimizeStage, Optimized};
 use pdfcraft_engine::{DocId, EditError, Hidden, OptimizeReport};
 
@@ -143,6 +143,23 @@ fn image_row(ui: &mut egui::Ui, id: &str, title: &str, s: &mut ImageSettings) {
     ui.add_space(8.0);
 }
 
+/// Monochrome Images: how 1-bit images and image masks are stored.
+fn mono_row(ui: &mut egui::Ui, m: &mut MonoCompression) {
+    ui.label(egui::RichText::new(tl!("Monochrome Images")).font(theme::semibold(13.0)));
+    ui.horizontal(|ui| {
+        ui.label(tl!("Compression"));
+        let label = match m {
+            MonoCompression::CcittG4 => tl!("CCITT Group 4"),
+            MonoCompression::Retain => tl!("Retain existing"),
+        };
+        craft_ui::ComboBox::from_id_salt(("mono", "compression")).selected_text(label).show_ui(ui, |ui| {
+            ui.selectable_value(m, MonoCompression::CcittG4, tl!("CCITT Group 4"));
+            ui.selectable_value(m, MonoCompression::Retain, tl!("Retain existing"));
+        });
+    });
+    ui.add_space(8.0);
+}
+
 fn discard_box(ui: &mut egui::Ui, list: &mut Vec<Hidden>, h: Hidden, label: &str) {
     let mut on = list.contains(&h);
     if ui.add(widgets::checkbox(&mut on, tl!(label))).changed() {
@@ -205,6 +222,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut OptimizeDraft, t: &Tokens) -> (boo
             ui.add(widgets::checkbox(&mut s.merge_fragments, tl!("Merge image fragments")));
             image_row(ui, "color", "Color Images", &mut s.color);
             image_row(ui, "gray", "Grayscale Images", &mut s.gray);
+            mono_row(ui, &mut s.mono);
             ui.label(
                 egui::RichText::new(tl!("Each image is measured where pages draw it; an image is replaced only if the result is smaller."))
                     .small()
diff --git a/crates/ui-egui/tests/it/create.rs b/crates/ui-egui/tests/it/create.rs
index a1f368922d..22ac8503e7 100644
--- a/crates/ui-egui/tests/it/create.rs
+++ b/crates/ui-egui/tests/it/create.rs
@@ -187,6 +187,8 @@ fn the_pdf_optimizer_dialog_saves_an_optimized_copy() {
     h.run_steps(2);
     h.get_by_label("PDF Optimizer");
     h.get_by_label("Color Images");
+    h.get_by_label("Monochrome Images");
+    assert_eq!(h.state().optimize_draft.settings.mono, pdfcraft_engine::optimize::MonoCompression::CcittG4);
     h.get_by_label("Discard Objects").click();
     h.run_steps(2);
     h.get_by_label("Discard document tags").click();
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 25205e92c1..9a2a42dacc 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,6 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
+> **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
 
@@ -255,6 +256,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
 | 2026-10-23 | minor | M8, #3205 follow-up: phone-pattern redaction includes the +39 country code on labelled Italian geographic numbers with a slash; dates, protocol identifiers and whole-run guards remain. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 3b8dba920c..daffc88188 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7325,7 +7325,7 @@ status = "shipped"
 commands = ["optimize.reduce"]
 tools = ["doc_reduce"]
 evidence = ["crates/ui-egui/tests/it/create.rs::reduce_file_size_writes_a_compact_copy", "crates/ui-egui/tests/it/create.rs::reduce_file_size_saves_nothing_when_the_file_is_already_small", "crates/engine/src/tests.rs::create_and_reduce", "crates/automation/tests/it/automation.rs::creating_and_reducing_through_tools", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::an_identity_decode_array_does_not_stop_reduce"]
-notes = "images above 225 ppi to 150 ppi JPEG medium (after merging page pictures printed as one-pixel strips into one image), thumbnails dropped, resources merged, object streams; scanner images with the default decode array are included; a copy that isn't smaller is not saved (\"already as small as it can be made\"); runs in the background with a progress bar and Cancel"
+notes = "images above 225 ppi to 150 ppi JPEG medium (after merging page pictures printed as one-pixel strips into one image), black-and-white images to CCITT Group 4 when that is smaller, thumbnails dropped, resources merged, object streams; scanner images with the default decode array are included; a copy that isn't smaller is not saved (\"already as small as it can be made\"); runs in the background with a progress bar and Cancel"
 
 [[feature]]
 id = "optimize.compatibility-level"
@@ -7381,11 +7381,11 @@ title = "Monochrome compression (JBIG2, CCITT G4)"
 area = "K"
 tier = "P1"
 milestone = "M11"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["optimize.advanced", "optimize.reduce"]
+tools = ["doc_optimize", "doc_reduce"]
+evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 0a5f8bce2d22b32dbb57cab17cbd9fd53c9063d1 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Fri, 23 Oct 2026 21:57:34 +0200
Subject: [PATCH 142/270] M11: black-and-white images: only DeviceGray counts
 as a one-component name; refuse a malformed mono

A bare /Indexed, /I or /CalGray is no colour space on its own, so it can
only name a resource, which might be RGB: such an image is now left
alone instead of being read as one bit per pixel. doc_optimize refuses a
mono that isn't an object or a compression that isn't a known name,
instead of reading it as the default (from CodeRabbit's review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/automation/src/documents.rs       | 16 +++++++++-----
 crates/automation/tests/it/automation.rs |  9 ++++----
 crates/optimize/src/images.rs            |  6 +++--
 crates/optimize/tests/optimize.rs        | 28 +++++++++++++++++-------
 4 files changed, 39 insertions(+), 20 deletions(-)

diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
index 1b26dec7f1..6e2c0a83f5 100644
--- a/crates/automation/src/documents.rs
+++ b/crates/automation/src/documents.rs
@@ -317,12 +317,16 @@ impl Automation {
         };
         settings.color = images("color", settings.color)?;
         settings.gray = images("gray", settings.gray)?;
-        if let Some(c) = a.get("mono").and_then(|m| m.get("compression")).and_then(Value::as_str) {
-            settings.mono = match c {
-                "ccitt_g4" | "ccitt" | "g4" => MonoCompression::CcittG4,
-                "retain" => MonoCompression::Retain,
-                other => return Err(ToolError::InvalidArgs(format!("unknown mono compression {other:?} (ccitt_g4, retain)"))),
-            };
+        if let Some(mono) = a.get("mono") {
+            let unknown = |c: &Value| ToolError::InvalidArgs(format!("unknown mono compression {c} (ccitt_g4, retain)"));
+            let mono = mono.as_object().ok_or_else(|| ToolError::InvalidArgs("mono must be an object: { compression: ccitt_g4|retain }".into()))?;
+            if let Some(c) = mono.get("compression") {
+                settings.mono = match c.as_str() {
+                    Some("ccitt_g4" | "ccitt" | "g4") => MonoCompression::CcittG4,
+                    Some("retain") => MonoCompression::Retain,
+                    _ => return Err(unknown(c)),
+                };
+            }
         }
         for (key, flag) in [
             ("merge_fragments", &mut settings.merge_fragments),
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index aa4b50d087..8392b6722f 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6455,10 +6455,11 @@ fn doc_optimize_stores_black_and_white_images_as_ccitt_group_4() {
         })
         .collect();
     assert_eq!(filters, [b"CCITTFaxDecode".to_vec()]);
-    assert!(matches!(
-        a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "mono": { "compression": "jbig2" } })),
-        Err(ToolError::InvalidArgs(_))
-    ));
+    // An unknown compression, one that isn't a name, or a mono that isn't an object is refused,
+    // not read as the default.
+    for mono in [json!({ "compression": "jbig2" }), json!({ "compression": false }), json!("retain")] {
+        assert!(matches!(a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "mono": mono })), Err(ToolError::InvalidArgs(_))), "{mono}");
+    }
 }
 
 /// A one-page PDF whose page picture is drawn as `rows` grey images one pixel row high, 600 px
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 0a157b8c33..ad76003074 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -533,11 +533,13 @@ fn process(doc: &Document, s: &Stream, ppi: f64, settings: &ImageSettings, n: us
 }
 
 /// Whether colour space `cs` has one colour component, so a 1-bit image in it has one bit per
-/// pixel: grey, a separation, an indexed space or a DeviceN of one colourant.
+/// pixel: grey, a separation, an indexed space or a DeviceN of one colourant. Of names, only
+/// DeviceGray counts: another name is no colour space on its own (`/Indexed` and `/CalGray` need
+/// their parameters), so it can only name a resource, which might be RGB.
 fn one_component(doc: &Document, cs: &Object) -> bool {
     let cs = doc.resolve(cs);
     match &*cs {
-        Object::Name(n) => matches!(n.as_slice(), b"DeviceGray" | b"G" | b"CalGray" | b"Indexed" | b"I"),
+        Object::Name(n) => matches!(n.as_slice(), b"DeviceGray" | b"G"),
         Object::Array(a) => match a.first().and_then(Object::as_name) {
             Some(b"CalGray" | b"Separation" | b"Indexed" | b"I") => true,
             Some(b"ICCBased") => a.get(1).is_some_and(|icc| matches!(&*doc.resolve(icc), Object::Stream(s) if s.dict.int(b"N") == Some(1))),
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 8c0afe89e7..db32ea7ad2 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -329,9 +329,9 @@ fn render(doc: &Document) -> Vec<u8> {
 
 /// Black-and-white images become CCITT Group 4, losslessly: the page looks the same to the pixel.
 /// Grey, an image mask (with a decode array that inverts it), an indexed image of two colours and
-/// one stored with a PNG predictor qualify; noise (bigger as G4), a 1-bit RGB image, one wider
-/// than Group 4 encodes and a tiny one (bigger as stored) are left alone, as is everything with
-/// `mono: Retain`.
+/// one stored with a PNG predictor qualify; noise (bigger as G4), a 1-bit RGB image, one whose
+/// colour space is a resource name, one wider than Group 4 encodes and a tiny one (bigger as
+/// stored) are left alone, as is everything with `mono: Retain`.
 #[test]
 fn black_and_white_images_become_ccitt_group_4() {
     let mut doc = Document::new_empty();
@@ -366,20 +366,32 @@ fn black_and_white_images_become_ccitt_group_4() {
         None,
         &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))],
     );
+    // A bare /Indexed is no colour space on its own: it names the page's resource, here RGB, so
+    // these samples are three to a pixel.
+    let named =
+        mono_image(&mut doc, 400, 160, &bilevel(1200, 160, false), None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("Indexed"))]);
     // 64 × 8 white: its Group 4 data is smaller than its Flate data, but not by the longer
     // dictionary Group 4 needs.
     let tiny = mono_image(&mut doc, 64, 8, &[0xFF; 64], None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
     let tiny_g4 = pdfcraft_filters::encode_g4(&[0xFF; 64], 64, 8).unwrap();
     assert!(tiny_g4.len() < stream(&doc, tiny).raw.len(), "{} against {}", tiny_g4.len(), stream(&doc, tiny).raw.len());
-    page(
+    let p = page(
         &mut doc,
-        &[("G", gray), ("M", mask), ("I", indexed), ("P", predicted), ("N", noise), ("R", rgb), ("W", wide), ("T", tiny)],
+        &[("G", gray), ("M", mask), ("I", indexed), ("P", predicted), ("N", noise), ("R", rgb), ("W", wide), ("T", tiny), ("X", named)],
         "q 300 0 0 120 20 660 cm /G Do Q q 0 0.4 0.8 rg 300 0 0 120 320 660 cm /M Do Q q 300 0 0 120 20 520 cm /I Do Q \
-         q 300 0 0 120 320 520 cm /P Do Q q 200 0 0 100 20 400 cm /N Do Q q 200 0 0 80 240 400 cm /R Do Q q 560 0 0 4 20 380 cm /W Do Q q 64 0 0 8 460 400 cm /T Do Q",
+         q 300 0 0 120 320 520 cm /P Do Q q 200 0 0 100 20 400 cm /N Do Q q 200 0 0 80 240 400 cm /R Do Q q 560 0 0 4 20 380 cm /W Do Q q 64 0 0 8 460 400 cm /T Do Q q 200 0 0 80 240 300 cm /X Do Q",
     );
+    doc.update_dict(p, |d| {
+        if let Some(Object::Dict(res)) = d.get_mut(b"Resources") {
+            let mut cs = Dict::new();
+            cs.set(b"Indexed".to_vec(), Object::name("DeviceRGB"));
+            res.set(b"ColorSpace".to_vec(), Object::Dict(cs));
+        }
+    })
+    .unwrap();
     let before = render(&doc);
     let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
-    let untouched = [noise, rgb, wide, tiny].map(|r| raw(&doc, r));
+    let untouched = [noise, rgb, wide, tiny, named].map(|r| raw(&doc, r));
 
     let mut kept = doc.clone();
     let r = optimize(&mut kept, &Settings { mono: MonoCompression::Retain, ..Settings::default() }).unwrap();
@@ -397,7 +409,7 @@ fn black_and_white_images_become_ccitt_group_4() {
     }
     assert_eq!(stream(&doc, mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");
     assert_eq!(stream(&doc, indexed).dict.get(b"ColorSpace"), Some(&indexed_cs), "the colour space stays");
-    assert_eq!([noise, rgb, wide, tiny].map(|r| raw(&doc, r)), untouched);
+    assert_eq!([noise, rgb, wide, tiny, named].map(|r| raw(&doc, r)), untouched);
     assert!(render(&doc) == before, "the page looks the same");
 }
 

From faa582e7f73a65708cde262e5b5d246e1ff6ca1c Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Fri, 23 Oct 2026 23:48:17 +0200
Subject: [PATCH 143/270] M11: doc_optimize refuses an unknown key in mono

A misspelled key ({"mono": {"compresson": "retain"}}) left the preset's
setting in place unnoticed; it is now InvalidArgs (from CodeRabbit's
review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/automation/src/documents.rs       | 4 ++++
 crates/automation/tests/it/automation.rs | 6 +++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
index 6e2c0a83f5..40aa4ac522 100644
--- a/crates/automation/src/documents.rs
+++ b/crates/automation/src/documents.rs
@@ -320,6 +320,10 @@ impl Automation {
         if let Some(mono) = a.get("mono") {
             let unknown = |c: &Value| ToolError::InvalidArgs(format!("unknown mono compression {c} (ccitt_g4, retain)"));
             let mono = mono.as_object().ok_or_else(|| ToolError::InvalidArgs("mono must be an object: { compression: ccitt_g4|retain }".into()))?;
+            // A misspelled key would otherwise leave the preset's setting in place unnoticed.
+            if let Some(key) = mono.keys().find(|k| *k != "compression") {
+                return Err(ToolError::InvalidArgs(format!("unknown mono key {key:?} (compression)")));
+            }
             if let Some(c) = mono.get("compression") {
                 settings.mono = match c.as_str() {
                     Some("ccitt_g4" | "ccitt" | "g4") => MonoCompression::CcittG4,
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 8392b6722f..dcd321eddb 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6455,9 +6455,9 @@ fn doc_optimize_stores_black_and_white_images_as_ccitt_group_4() {
         })
         .collect();
     assert_eq!(filters, [b"CCITTFaxDecode".to_vec()]);
-    // An unknown compression, one that isn't a name, or a mono that isn't an object is refused,
-    // not read as the default.
-    for mono in [json!({ "compression": "jbig2" }), json!({ "compression": false }), json!("retain")] {
+    // An unknown compression, one that isn't a name, a misspelled key, or a mono that isn't an
+    // object is refused, not read as the default.
+    for mono in [json!({ "compression": "jbig2" }), json!({ "compression": false }), json!({ "compresson": "retain" }), json!("retain")] {
         assert!(matches!(a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "mono": mono })), Err(ToolError::InvalidArgs(_))), "{mono}");
     }
 }

From 7add9b38e3d9979daf05f06fedb9db745e7d540c Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 11:14:54 +0200
Subject: [PATCH 144/270] M11: the optimizer reads images through /DecodeParms
 given by reference

Stream::decoded reads only direct parameter dictionaries, so an image
whose /DecodeParms is a reference (whole, or as array entries) was
decoded without its predictor. For a 1-bit image with a PNG predictor
the rows came out shifted by their tag bytes, Group 4 of that was still
smaller, and the picture was replaced by a skewed one; resampling and
merging image strips read the same way.

pdfcraft_cos::Document::with_direct_parms gives the stream with the
parameters its filters use made direct: only the entries at the
filters' places, and none for a chain longer than any decoder takes,
so at most MAX_CHAIN objects are copied. The optimizer's pixels() and
the Group 4 step decode through it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/cos/README.md               |  1 +
 crates/cos/src/document.rs         |  3 +-
 crates/cos/src/document/objects.rs | 35 +++++++++++++++++++++-
 crates/cos/src/document/tests.rs   | 36 ++++++++++++++++++++++
 crates/optimize/README.md          |  4 ++-
 crates/optimize/src/images.rs      |  9 ++++--
 crates/optimize/tests/optimize.rs  | 48 ++++++++++++++++++++++++++++++
 7 files changed, 130 insertions(+), 6 deletions(-)

diff --git a/crates/cos/README.md b/crates/cos/README.md
index ab382219d5..89b6826a8a 100644
--- a/crates/cos/README.md
+++ b/crates/cos/README.md
@@ -24,6 +24,7 @@ let obj  = doc.get(ObjRef { num: 12, gen: 0 });      // load (and cache): Arc<Ob
 let real = doc.resolve(&obj);                        // follow one indirect reference
 let d    = doc.dict(&obj);                           // Option<Dict>, resolving first
 let data = stream.decoded()?;                        // filters applied on demand
+let data = doc.with_direct_parms(&stream).decoded()?; // /DecodeParms given by reference too
 
 doc.set(r, Object::Dict(d));                         // edit: lands in the overlay
 let r = doc.add(obj);                                // append a new object
diff --git a/crates/cos/src/document.rs b/crates/cos/src/document.rs
index 0fac1591a9..4c7748cc95 100644
--- a/crates/cos/src/document.rs
+++ b/crates/cos/src/document.rs
@@ -5,11 +5,12 @@
 //! Edits never touch the original bytes; the writer appends them (incremental save) or rewrites
 //! the file (full save).
 
+use std::borrow::Cow;
 use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::{Arc, Mutex, Weak};
 
 use crate::CosError;
-use crate::object::{Dict, ObjRef, Object};
+use crate::object::{Dict, ObjRef, Object, Stream};
 use crate::parser::{EndstreamIndex, Lexer, is_whitespace, parse_indirect, parse_indirect_shared};
 
 mod objects;
diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index 8744a3ea3e..039f3dd101 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -1,7 +1,7 @@
 use super::reader::find;
 use super::state::{LENGTHS, LoadGuard, ObjStm, ObjectReader, ReadState, Slot, SourceIdentity, objstm_member, owned_bytes};
 use super::xref::{Revision, XrefEntry};
-use super::{Arc, CosError, Dict, Document, Lexer, ObjRef, Object, is_whitespace, parse_indirect_shared};
+use super::{Arc, CosError, Cow, Dict, Document, Lexer, ObjRef, Object, Stream, is_whitespace, parse_indirect_shared};
 
 impl Document {
     pub fn bytes(&self) -> &Arc<Vec<u8>> {
@@ -158,6 +158,39 @@ impl Document {
         }
     }
 
+    /// `s` with the `/DecodeParms` its filters use made direct, so [`Stream::decoded`] reads them:
+    /// an indirect dictionary resolved, and of an array (itself perhaps indirect), the entries at
+    /// the filters' places (`/Crypt` counts, ISO 32000-2 §7.4.1) resolved, the rest dropped. `s`
+    /// itself when none of those is indirect, or when the chain is longer than any decoder takes
+    /// ([`pdfcraft_filters::MAX_CHAIN`]), so at most that many objects are copied.
+    pub fn with_direct_parms<'s>(&self, s: &'s Stream) -> Cow<'s, Stream> {
+        let Some(p) = s.dict.get(b"DecodeParms") else { return Cow::Borrowed(s) };
+        let filters = match s.dict.get(b"Filter") {
+            Some(Object::Array(a)) => a.len(),
+            Some(_) => 1,
+            None => 0,
+        };
+        if filters > pdfcraft_filters::MAX_CHAIN {
+            return Cow::Borrowed(s);
+        }
+        let whole = matches!(p, Object::Ref(_));
+        let resolved = self.resolve(p);
+        let direct = match &*resolved {
+            Object::Array(a) => {
+                let used = a.get(..filters.min(a.len())).unwrap_or_default();
+                if !whole && !used.iter().any(|e| matches!(e, Object::Ref(_))) {
+                    return Cow::Borrowed(s);
+                }
+                Object::Array(used.iter().map(|e| (*self.resolve(e)).clone()).collect())
+            }
+            other if whole => other.clone(),
+            _ => return Cow::Borrowed(s),
+        };
+        let mut s = s.clone();
+        s.dict.set(b"DecodeParms".to_vec(), direct);
+        Cow::Owned(s)
+    }
+
     /// Resolve and return a dictionary (a stream's dictionary counts).
     pub fn dict(&self, o: &Object) -> Option<Dict> {
         self.resolve(o).as_dict().cloned()
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index bf22f23d76..61a71e24d8 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -1,5 +1,41 @@
 use super::*;
 
+/// /DecodeParms given by reference, whole or as array entries, are read once made direct: here a
+/// Flate predictor, which the stream alone doesn't see. Only the entries the filters use are
+/// resolved, and nothing is for a chain longer than a decoder takes.
+#[test]
+fn decode_parms_given_by_reference_are_read_once_direct() {
+    let rows = [1u8, 2, 3, 4, 5, 6, 7, 8];
+    let params = pdfcraft_filters::Params { predictor: 12, colors: 1, bits_per_component: 8, columns: 4, early_change: 1 };
+    let coded = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &rows).unwrap();
+    let mut parms = Dict::new();
+    parms.set(b"Predictor".to_vec(), Object::Int(12));
+    parms.set(b"Columns".to_vec(), Object::Int(4));
+    let mut doc = Document::new_empty();
+    let r = doc.add(Object::Dict(parms.clone()));
+    let array = doc.add(Object::Array(vec![Object::Ref(r)]));
+    let stream = |filters: usize, p: Object| {
+        let mut d = Dict::new();
+        d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"); filters]));
+        d.set(b"DecodeParms".to_vec(), p);
+        Stream::from_raw(d, coded.clone())
+    };
+    for p in [Object::Ref(r), Object::Array(vec![Object::Ref(r)]), Object::Ref(array)] {
+        let s = stream(1, p.clone());
+        assert_ne!(s.decoded().unwrap(), rows, "{p:?} read as it is");
+        assert_eq!(doc.with_direct_parms(&s).decoded().unwrap(), rows, "{p:?}");
+    }
+    let direct = stream(1, Object::Dict(parms));
+    assert!(matches!(doc.with_direct_parms(&direct), Cow::Borrowed(_)), "nothing to resolve");
+    assert_eq!(direct.decoded().unwrap(), rows);
+    // Entries past the filters' are left out, unresolved; so is everything past the chain limit.
+    let many = stream(1, Object::Array(vec![Object::Ref(r); 1000]));
+    let made = doc.with_direct_parms(&many);
+    assert_eq!(made.dict.get(b"DecodeParms").and_then(Object::as_array).map(Vec::len), Some(1));
+    let long = stream(pdfcraft_filters::MAX_CHAIN + 1, Object::Array(vec![Object::Ref(r); 9]));
+    assert!(matches!(doc.with_direct_parms(&long), Cow::Borrowed(_)));
+}
+
 #[test]
 fn a_read_state_matches_a_clone_and_no_changed_document() {
     let mut doc = Document::new_empty();
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 6b4d04b071..4098adc3b0 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -31,7 +31,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   image masks, decode arrays, more than 8 bits, JPEG 2000, JBIG2 and CCITT. A JPEG is read with
   its colour transform (an Adobe marker's, else `/ColorTransform`, ISO 32000-2 §7.4.8), so one
   stored untransformed keeps its colours; one whose marker and `/ColorTransform` disagree is left
-  alone, since readers differ on which wins.
+  alone, since readers differ on which wins. Samples are read with `/DecodeParms` given by
+  reference too (`Document::with_direct_parms`), here and below: without them a predictor's tag
+  bytes would shift every row of an image written back.
 - **Monochrome images** (`Settings::mono`, CCITT Group 4 by default): a 1-bit image with one
   colour component (grey, indexed, a separation) or an image mask, stored with no filter or with
   general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index ad76003074..59b3b64174 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -258,7 +258,9 @@ fn count_decoded(_n: u64) {
     DECODED_PIXELS.with(|c| c.set(c.get().saturating_add(_n)));
 }
 
-/// 8-bit samples of an image (`n` components), decoded. `None` for a JPEG whose colour transform
+/// 8-bit samples of an image (`n` components), decoded, with `/DecodeParms` given by reference
+/// too ([`Document::with_direct_parms`]): read without them, a predictor's tag bytes would shift
+/// every row, and the image would be written back wrong. `None` for a JPEG whose colour transform
 /// readers may disagree about ([`ycc_encoded`]).
 pub(crate) fn pixels(doc: &Document, s: &Stream, n: usize) -> Option<Vec<u8>> {
     let (w, h) = (u32::try_from(s.dict.int(b"Width")?).ok()?, u32::try_from(s.dict.int(b"Height")?).ok()?);
@@ -275,7 +277,7 @@ pub(crate) fn pixels(doc: &Document, s: &Stream, n: usize) -> Option<Vec<u8>> {
         count_decoded(u64::from(w) * u64::from(h));
         (v.len() == bytes).then_some(v)
     } else {
-        let v = s.decoded().ok()?;
+        let v = doc.with_direct_parms(s).decoded().ok()?;
         Some(v.get(..bytes)?.to_vec())
     }
 }
@@ -573,7 +575,8 @@ fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stre
     if w == 0 || h == 0 || w > pdfcraft_filters::MAX_G4_COLUMNS || u64::from(w) * u64::from(h) > MAX_PIXELS {
         return None;
     }
-    let g4 = pdfcraft_filters::encode_g4(&s.decoded().ok()?, w, h).ok()?;
+    // Through its parameters given by reference too, as `pixels` reads.
+    let g4 = pdfcraft_filters::encode_g4(&doc.with_direct_parms(s).decoded().ok()?, w, h).ok()?;
     let mut new = d.clone();
     for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
         new.remove(k);
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index db32ea7ad2..58699fb521 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -413,6 +413,54 @@ fn black_and_white_images_become_ccitt_group_4() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// An image whose /DecodeParms are a reference is read through them, as one with them direct: a
+/// predictor's tag bytes would otherwise shift every row, and the image would be stored again
+/// wrong. Here a 1-bit image with a PNG predictor (stored again as Group 4) and an eight-bit grey
+/// one with a PNG predictor at 600 ppi (resampled) come out byte for byte as with direct parameters.
+#[test]
+fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
+    let build = |by_reference: bool| {
+        let mut doc = Document::new_empty();
+        let (w, h) = (1200u32, 480u32);
+        let grey = [("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))];
+        let one_bit = mono_image(&mut doc, w, h, &bilevel(w, h, false), Some(15), &grey);
+        let shades: Vec<u8> = (0..w * h).map(|i| ((i % w) * 255 / w) as u8 ^ ((i / w) as u8 & 0x0F)).collect();
+        let params = pdfcraft_filters::Params { predictor: 15, colors: 1, bits_per_component: 8, columns: w as i64, early_change: 1 };
+        let mut parms = Dict::new();
+        parms.set(b"Predictor".to_vec(), Object::Int(15));
+        parms.set(b"Columns".to_vec(), Object::Int(w as i64));
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w as i64));
+        d.set(b"Height".to_vec(), Object::Int(h as i64));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        let coded = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &shades).unwrap();
+        let eight_bit = doc.add(Object::Stream(Stream::from_raw(d, coded)));
+        if by_reference {
+            for r in [one_bit, eight_bit] {
+                let mut s = stream(&doc, r);
+                let parms = s.dict.get(b"DecodeParms").cloned().unwrap();
+                s.dict.set(b"DecodeParms".to_vec(), Object::Ref(doc.add(parms)));
+                doc.set(r, Object::Stream(s));
+            }
+        }
+        // 300 × 120 pt is 288 ppi; 144 × 57.6 pt is 600 ppi.
+        page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
+        let before = [one_bit, eight_bit].map(|r| stream(&doc, r).raw);
+        let r = optimize(&mut doc, &Settings::default()).unwrap();
+        assert_eq!((r.images_resampled, r.images_recompressed), (1, 1), "{r:?}");
+        let after = [one_bit, eight_bit].map(|r| stream(&doc, r));
+        assert!(before.iter().zip(&after).all(|(b, a)| *b != a.raw), "both stored again");
+        assert_eq!(after[0].dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]));
+        after.map(|s| s.raw)
+    };
+    assert_eq!(build(true), build(false));
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();

From 70d6815c6d7d22f850974295df9d5a86026404c9 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 20:03:12 +0100
Subject: [PATCH 145/270] M11: Persian for the PDF Optimizer's black-and-white
 image rows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Persian came to main after these rows were written, so fa.tsv had neither "Monochrome Images"
nor "CCITT Group 4". They go beside "Grayscale Images", worded like the Arabic and Kurdish rows,
with the Persian digit the catalogue uses elsewhere ("AES ۱۲۸-بیتی").

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/ui-egui/src/i18n/fa.tsv | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crates/ui-egui/src/i18n/fa.tsv b/crates/ui-egui/src/i18n/fa.tsv
index 5cfc217533..09a2e21689 100644
--- a/crates/ui-egui/src/i18n/fa.tsv
+++ b/crates/ui-egui/src/i18n/fa.tsv
@@ -594,6 +594,8 @@
 	Clean Up	پاک‌سازی
 	Color Images	تصاویر رنگی
 	Grayscale Images	تصاویر خاکستری
+	Monochrome Images	تصاویر تک‌رنگ
+	CCITT Group 4	CCITT گروه ۴
 	Bicubic downsampling to	نمونه برداری کاهشی دو مکعبی به
 	for images above	برای تصاویر بالا‌تر از
 	Compression	فشرده‌سازی

From 58945d1f5b7db2ef910f5d397171bb6a604ae819 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 15:37:34 +0100
Subject: [PATCH 146/270] M11: the optimizer reads numbers inside /DecodeParms
 given by reference

Document::with_direct_parms resolved an indirect /DecodeParms and its
array entries but not the numbers inside (/Predictor 9 0 R), which
Dict::int doesn't follow. A 1-bit image with such a predictor was
decoded without it, its rows shifted by their tag bytes, and Group 4 of
that stored in its place; resampling read images the same way. It now
keeps, of each parameters dictionary, the numbers and flags the decoders
read, resolved, and /JBIG2Globals as a reference. Only those small
values are copied (an entry that is no dictionary is null), so a file
naming one big object from every key and filter can't have it copied a
hundred times.

The change is #4384's, moved down so that every PR stacked on this one
reads such parameters.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/cos/src/document/objects.rs | 89 +++++++++++++++++++++++++-----
 crates/cos/src/document/tests.rs   | 28 +++++++++-
 crates/optimize/README.md          |  4 +-
 crates/optimize/tests/optimize.rs  | 39 ++++++++-----
 4 files changed, 129 insertions(+), 31 deletions(-)

diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index 039f3dd101..e7d7255306 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -160,9 +160,12 @@ impl Document {
 
     /// `s` with the `/DecodeParms` its filters use made direct, so [`Stream::decoded`] reads them:
     /// an indirect dictionary resolved, and of an array (itself perhaps indirect), the entries at
-    /// the filters' places (`/Crypt` counts, ISO 32000-2 §7.4.1) resolved, the rest dropped. `s`
-    /// itself when none of those is indirect, or when the chain is longer than any decoder takes
-    /// ([`pdfcraft_filters::MAX_CHAIN`]), so at most that many objects are copied.
+    /// the filters' places (`/Crypt` counts, ISO 32000-2 §7.4.1) resolved, the rest dropped. Of
+    /// each dictionary only the entries the decoders read are kept, numbers and flags given by
+    /// reference (`/Predictor 7 0 R`) resolved; `/JBIG2Globals` stays a reference. `s` itself
+    /// when none of those is indirect, or when the chain is longer than any decoder takes
+    /// ([`pdfcraft_filters::MAX_CHAIN`]). Only small values are copied, so a file can't have a
+    /// large object copied once for each key and filter.
     pub fn with_direct_parms<'s>(&self, s: &'s Stream) -> Cow<'s, Stream> {
         let Some(p) = s.dict.get(b"DecodeParms") else { return Cow::Borrowed(s) };
         let filters = match s.dict.get(b"Filter") {
@@ -173,24 +176,45 @@ impl Document {
         if filters > pdfcraft_filters::MAX_CHAIN {
             return Cow::Borrowed(s);
         }
-        let whole = matches!(p, Object::Ref(_));
-        let resolved = self.resolve(p);
-        let direct = match &*resolved {
-            Object::Array(a) => {
-                let used = a.get(..filters.min(a.len())).unwrap_or_default();
-                if !whole && !used.iter().any(|e| matches!(e, Object::Ref(_))) {
-                    return Cow::Borrowed(s);
+        let mut changed = matches!(p, Object::Ref(_));
+        // Its numbers and flags kept, resolved; anything else is no filter's parameters (null).
+        let one = |e: &Object, changed: &mut bool| -> Object {
+            *changed |= matches!(e, Object::Ref(_));
+            let Object::Dict(d) = &*self.held(e) else { return Object::Null };
+            let mut made = Dict::new();
+            for key in DECODE_PARMS_KEYS {
+                let Some(v) = d.get(key) else { continue };
+                *changed |= matches!(v, Object::Ref(_));
+                let v = self.held(v);
+                if matches!(*v, Object::Int(_) | Object::Real(_) | Object::Bool(_)) {
+                    made.set(key.to_vec(), (*v).clone());
                 }
-                Object::Array(used.iter().map(|e| (*self.resolve(e)).clone()).collect())
             }
-            other if whole => other.clone(),
-            _ => return Cow::Borrowed(s),
+            if let Some(g @ Object::Ref(_)) = d.get(b"JBIG2Globals") {
+                made.set(b"JBIG2Globals".to_vec(), g.clone());
+            }
+            Object::Dict(made)
         };
+        let made = match &*self.held(p) {
+            Object::Array(a) => Object::Array(a.get(..filters.min(a.len())).unwrap_or_default().iter().map(|e| one(e, &mut changed)).collect()),
+            _ => one(p, &mut changed),
+        };
+        if !changed {
+            return Cow::Borrowed(s);
+        }
         let mut s = s.clone();
-        s.dict.set(b"DecodeParms".to_vec(), direct);
+        s.dict.set(b"DecodeParms".to_vec(), made);
         Cow::Owned(s)
     }
 
+    /// `o`, or the object it refers to, without copying either.
+    fn held<'o>(&self, o: &'o Object) -> Held<'o> {
+        match o {
+            Object::Ref(_) => Held::Resolved(self.resolve(o)),
+            o => Held::Direct(o),
+        }
+    }
+
     /// Resolve and return a dictionary (a stream's dictionary counts).
     pub fn dict(&self, o: &Object) -> Option<Dict> {
         self.resolve(o).as_dict().cloned()
@@ -603,3 +627,40 @@ impl Document {
         matches!(self.try_get(r.num).as_deref(), Ok(Object::Dict(d)) if d.name(b"Type") == Some(b"Catalog") || d.contains(b"Pages"))
     }
 }
+
+/// The `/DecodeParms` entries the decoders read (ISO 32000-2 Tables 8, 11 and 13: the Flate and
+/// LZW predictors, CCITT, DCT's colour transform): numbers and flags a file may give by
+/// reference, which [`Dict::int`] doesn't follow.
+const DECODE_PARMS_KEYS: [&[u8]; 13] = [
+    b"Predictor",
+    b"Colors",
+    b"BitsPerComponent",
+    b"Columns",
+    b"EarlyChange",
+    b"K",
+    b"Rows",
+    b"EndOfLine",
+    b"EncodedByteAlign",
+    b"EndOfBlock",
+    b"BlackIs1",
+    b"DamagedRowsBeforeError",
+    b"ColorTransform",
+];
+
+/// An object read in place, or the object a reference names as the document holds it: either way
+/// nothing is copied ([`Document::held`]).
+enum Held<'o> {
+    Direct(&'o Object),
+    Resolved(Arc<Object>),
+}
+
+impl std::ops::Deref for Held<'_> {
+    type Target = Object;
+
+    fn deref(&self) -> &Object {
+        match self {
+            Held::Direct(o) => o,
+            Held::Resolved(o) => o,
+        }
+    }
+}
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index 61a71e24d8..edbd68f562 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -1,7 +1,7 @@
 use super::*;
 
-/// /DecodeParms given by reference, whole or as array entries, are read once made direct: here a
-/// Flate predictor, which the stream alone doesn't see. Only the entries the filters use are
+/// /DecodeParms given by reference, whole, as array entries or as the numbers inside, are read
+/// once made direct: here a Flate predictor, which the stream alone doesn't see. Only the entries the filters use are
 /// resolved, and nothing is for a chain longer than a decoder takes.
 #[test]
 fn decode_parms_given_by_reference_are_read_once_direct() {
@@ -25,6 +25,30 @@ fn decode_parms_given_by_reference_are_read_once_direct() {
         assert_ne!(s.decoded().unwrap(), rows, "{p:?} read as it is");
         assert_eq!(doc.with_direct_parms(&s).decoded().unwrap(), rows, "{p:?}");
     }
+    // A number inside given by reference, which `Dict::int` doesn't follow: in the dictionary
+    // itself, and in an array's entry.
+    let twelve = doc.add(Object::Int(12));
+    let mut inner = parms.clone();
+    inner.set(b"Predictor".to_vec(), Object::Ref(twelve));
+    for p in [Object::Dict(inner.clone()), Object::Array(vec![Object::Dict(inner)])] {
+        let s = stream(1, p.clone());
+        assert_ne!(s.decoded().unwrap(), rows, "{p:?} read as it is");
+        assert_eq!(doc.with_direct_parms(&s).decoded().unwrap(), rows, "{p:?}");
+    }
+    // Only numbers and flags are copied: a key naming a big array, or an entry that is no
+    // dictionary, is left out (a file could name one big object from every key and filter).
+    let big = doc.add(Object::Array(vec![Object::Int(1); 100_000]));
+    let mut hostile = Dict::new();
+    hostile.set(b"Predictor".to_vec(), Object::Ref(big));
+    hostile.set(b"Columns".to_vec(), Object::Ref(big));
+    hostile.set(b"Colors".to_vec(), Object::Ref(twelve));
+    let entry = doc.add(Object::Dict(hostile));
+    let two = stream(2, Object::Array(vec![Object::Ref(entry), Object::Ref(big)]));
+    let made = doc.with_direct_parms(&two);
+    let made = made.dict.get(b"DecodeParms").and_then(Object::as_array).unwrap();
+    let first = made[0].as_dict().unwrap();
+    assert_eq!((first.contains(b"Predictor"), first.contains(b"Columns"), first.int(b"Colors")), (false, false, Some(12)));
+    assert!(matches!(made[1], Object::Null), "{:?}", made[1]);
     let direct = stream(1, Object::Dict(parms));
     assert!(matches!(doc.with_direct_parms(&direct), Cow::Borrowed(_)), "nothing to resolve");
     assert_eq!(direct.decoded().unwrap(), rows);
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 4098adc3b0..3bb09038c6 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -32,8 +32,8 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   its colour transform (an Adobe marker's, else `/ColorTransform`, ISO 32000-2 §7.4.8), so one
   stored untransformed keeps its colours; one whose marker and `/ColorTransform` disagree is left
   alone, since readers differ on which wins. Samples are read with `/DecodeParms` given by
-  reference too (`Document::with_direct_parms`), here and below: without them a predictor's tag
-  bytes would shift every row of an image written back.
+  reference too, the numbers inside included (`Document::with_direct_parms`), here and below:
+  without them a predictor's tag bytes would shift every row of an image written back.
 - **Monochrome images** (`Settings::mono`, CCITT Group 4 by default): a 1-bit image with one
   colour component (grey, indexed, a separation) or an image mask, stored with no filter or with
   general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 58699fb521..0336d73e9d 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -413,13 +413,15 @@ fn black_and_white_images_become_ccitt_group_4() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
-/// An image whose /DecodeParms are a reference is read through them, as one with them direct: a
-/// predictor's tag bytes would otherwise shift every row, and the image would be stored again
-/// wrong. Here a 1-bit image with a PNG predictor (stored again as Group 4) and an eight-bit grey
-/// one with a PNG predictor at 600 ppi (resampled) come out byte for byte as with direct parameters.
+/// An image whose /DecodeParms are a reference, or hold numbers given by reference
+/// (`/Predictor 9 0 R`, which `Dict::int` doesn't follow), is read through them, as one with them
+/// direct: a predictor's tag bytes would otherwise shift every row, and the image would be stored
+/// again wrong. Here a 1-bit image with a PNG predictor (stored again as Group 4) and an eight-bit
+/// grey one with a PNG predictor at 600 ppi (resampled) come out byte for byte as with direct
+/// parameters.
 #[test]
 fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
-    let build = |by_reference: bool| {
+    let build = |how: &str| {
         let mut doc = Document::new_empty();
         let (w, h) = (1200u32, 480u32);
         let grey = [("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))];
@@ -440,13 +442,22 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
         d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
         let coded = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &shades).unwrap();
         let eight_bit = doc.add(Object::Stream(Stream::from_raw(d, coded)));
-        if by_reference {
-            for r in [one_bit, eight_bit] {
-                let mut s = stream(&doc, r);
-                let parms = s.dict.get(b"DecodeParms").cloned().unwrap();
-                s.dict.set(b"DecodeParms".to_vec(), Object::Ref(doc.add(parms)));
-                doc.set(r, Object::Stream(s));
-            }
+        for r in [one_bit, eight_bit] {
+            let mut s = stream(&doc, r);
+            let Some(Object::Dict(mut parms)) = s.dict.get(b"DecodeParms").cloned() else { panic!("{:?}", s.dict) };
+            let made = match how {
+                "whole" => Object::Ref(doc.add(Object::Dict(parms))),
+                "numbers" => {
+                    for k in [&b"Predictor"[..], b"Columns"] {
+                        let v = parms.get(k).cloned().unwrap();
+                        parms.set(k.to_vec(), Object::Ref(doc.add(v)));
+                    }
+                    Object::Dict(parms)
+                }
+                _ => continue,
+            };
+            s.dict.set(b"DecodeParms".to_vec(), made);
+            doc.set(r, Object::Stream(s));
         }
         // 300 × 120 pt is 288 ppi; 144 × 57.6 pt is 600 ppi.
         page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
@@ -458,7 +469,9 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
         assert_eq!(after[0].dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]));
         after.map(|s| s.raw)
     };
-    assert_eq!(build(true), build(false));
+    let direct = build("direct");
+    assert_eq!(build("whole"), direct, "the dictionary by reference");
+    assert_eq!(build("numbers"), direct, "the numbers inside by reference");
 }
 
 #[test]

From e6fddf155b996f099d4b24d9ae3b79e2c7397068 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 16:49:31 +0100
Subject: [PATCH 147/270] M11: /Crypt doesn't count against with_direct_parms'
 chain limit

The decoders leave /Crypt out wherever it stands (Stream::filters), so
a chain of /Crypt and eight other filters decodes, but with_direct_parms
counted nine and left its parameters as they were: a predictor given by
reference was then skipped. Only the other filters count now, and a
/Crypt entry is null in the copy, as no decoder reads it. Tests cover
that chain and one exactly as long as a decoder takes.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/cos/src/document/objects.rs | 20 ++++++++++++--------
 crates/cos/src/document/tests.rs   | 19 +++++++++++++++++++
 2 files changed, 31 insertions(+), 8 deletions(-)

diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index e7d7255306..fb20b50cf1 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -162,18 +162,20 @@ impl Document {
     /// an indirect dictionary resolved, and of an array (itself perhaps indirect), the entries at
     /// the filters' places (`/Crypt` counts, ISO 32000-2 §7.4.1) resolved, the rest dropped. Of
     /// each dictionary only the entries the decoders read are kept, numbers and flags given by
-    /// reference (`/Predictor 7 0 R`) resolved; `/JBIG2Globals` stays a reference. `s` itself
-    /// when none of those is indirect, or when the chain is longer than any decoder takes
+    /// reference (`/Predictor 7 0 R`) resolved; `/JBIG2Globals` stays a reference. A `/Crypt`
+    /// entry, which no decoder reads ([`Stream::filters`] leaves it out), is null. `s` itself
+    /// when none of those is indirect, or when the other filters are more than any decoder takes
     /// ([`pdfcraft_filters::MAX_CHAIN`]). Only small values are copied, so a file can't have a
     /// large object copied once for each key and filter.
     pub fn with_direct_parms<'s>(&self, s: &'s Stream) -> Cow<'s, Stream> {
         let Some(p) = s.dict.get(b"DecodeParms") else { return Cow::Borrowed(s) };
-        let filters = match s.dict.get(b"Filter") {
-            Some(Object::Array(a)) => a.len(),
-            Some(_) => 1,
-            None => 0,
+        let crypt = |f: &Object| matches!(f.as_name(), Some(b"Crypt"));
+        let filters: Vec<bool> = match s.dict.get(b"Filter") {
+            Some(Object::Array(a)) => a.iter().map(crypt).collect(),
+            Some(f) => vec![crypt(f)],
+            None => Vec::new(),
         };
-        if filters > pdfcraft_filters::MAX_CHAIN {
+        if filters.iter().filter(|c| !**c).count() > pdfcraft_filters::MAX_CHAIN {
             return Cow::Borrowed(s);
         }
         let mut changed = matches!(p, Object::Ref(_));
@@ -196,7 +198,9 @@ impl Document {
             Object::Dict(made)
         };
         let made = match &*self.held(p) {
-            Object::Array(a) => Object::Array(a.get(..filters.min(a.len())).unwrap_or_default().iter().map(|e| one(e, &mut changed)).collect()),
+            Object::Array(a) => {
+                Object::Array(a.iter().zip(&filters).map(|(e, crypt)| if *crypt { Object::Null } else { one(e, &mut changed) }).collect())
+            }
             _ => one(p, &mut changed),
         };
         if !changed {
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index edbd68f562..d8d75c4af1 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -58,6 +58,25 @@ fn decode_parms_given_by_reference_are_read_once_direct() {
     assert_eq!(made.dict.get(b"DecodeParms").and_then(Object::as_array).map(Vec::len), Some(1));
     let long = stream(pdfcraft_filters::MAX_CHAIN + 1, Object::Array(vec![Object::Ref(r); 9]));
     assert!(matches!(doc.with_direct_parms(&long), Cow::Borrowed(_)));
+    // A chain as long as a decoder takes is resolved, and a `/Crypt` in it doesn't count, as
+    // the decoders leave it out: ASCIIHex as often as the limit allows, then the predictor's
+    // Flate, its parameters by reference.
+    let hex = |b: &[u8]| b.iter().flat_map(|x| format!("{x:02X}").into_bytes()).chain(*b">").collect::<Vec<u8>>();
+    let wrapped = (1..pdfcraft_filters::MAX_CHAIN).fold(coded.clone(), |data, _| hex(&data));
+    for crypt in [false, true] {
+        let mut names = vec![Object::name("ASCIIHexDecode"); pdfcraft_filters::MAX_CHAIN - 1];
+        names.push(Object::name("FlateDecode"));
+        if crypt {
+            names.insert(0, Object::name("Crypt"));
+        }
+        let mut entries = vec![Object::Null; names.len() - 1];
+        entries.push(Object::Ref(r));
+        let mut d = Dict::new();
+        d.set(b"Filter".to_vec(), Object::Array(names));
+        d.set(b"DecodeParms".to_vec(), Object::Array(entries));
+        let s = Stream::from_raw(d, wrapped.clone());
+        assert_eq!(doc.with_direct_parms(&s).decoded().unwrap(), rows, "with /Crypt: {crypt}");
+    }
 }
 
 #[test]

From 88c089bd2931500b3b1481de9b7e508eed345447 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 16:49:31 +0100
Subject: [PATCH 148/270] M11: the optimizer decodes an image no further than
 its samples can need

A 1-bit image was decoded for Group 4 up to MAX_DECODED (1 GiB), so a
few kilobytes of Flate could cost a gigabyte, and the same held for the
samples of a colour or grey image read to resample it (pixels). Both now
stop at twice the samples plus a byte a row and 4 KiB, as redaction
does; data past that can only be a decompression bomb, and the image is
left alone.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/src/images.rs     | 18 ++++++++++++++----
 crates/optimize/tests/optimize.rs | 28 ++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 59b3b64174..6eb0ddaa79 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -261,7 +261,8 @@ fn count_decoded(_n: u64) {
 /// 8-bit samples of an image (`n` components), decoded, with `/DecodeParms` given by reference
 /// too ([`Document::with_direct_parms`]): read without them, a predictor's tag bytes would shift
 /// every row, and the image would be written back wrong. `None` for a JPEG whose colour transform
-/// readers may disagree about ([`ycc_encoded`]).
+/// readers may disagree about ([`ycc_encoded`]), and for data that decodes past what the samples
+/// can need ([`allowance`]).
 pub(crate) fn pixels(doc: &Document, s: &Stream, n: usize) -> Option<Vec<u8>> {
     let (w, h) = (u32::try_from(s.dict.int(b"Width")?).ok()?, u32::try_from(s.dict.int(b"Height")?).ok()?);
     if w == 0 || h == 0 || u64::from(w) * u64::from(h) > MAX_PIXELS {
@@ -277,11 +278,18 @@ pub(crate) fn pixels(doc: &Document, s: &Stream, n: usize) -> Option<Vec<u8>> {
         count_decoded(u64::from(w) * u64::from(h));
         (v.len() == bytes).then_some(v)
     } else {
-        let v = doc.with_direct_parms(s).decoded().ok()?;
+        let v = doc.with_direct_parms(s).decoded_within(allowance(bytes, h)?).ok()?;
         Some(v.get(..bytes)?.to_vec())
     }
 }
 
+/// How far an image of `bytes` samples in `rows` rows is decoded: a filter stage may produce up
+/// to twice them (ASCIIHex text under Flate) plus a PNG predictor's byte a row. More can only be a
+/// decompression bomb, and the image is left alone.
+fn allowance(bytes: usize, rows: u32) -> Option<usize> {
+    bytes.checked_add(usize::try_from(rows).ok()?)?.checked_mul(2)?.checked_add(4096)
+}
+
 /// Whether the samples of a three-component JPEG are YCbCr, to be converted to RGB (ISO 32000-2
 /// §7.4.8). An Adobe APP14 marker's transform flag says so, overriding the filter's
 /// /ColorTransform; without a marker /ColorTransform does, 1 (YCbCr) by default.
@@ -575,8 +583,10 @@ fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stre
     if w == 0 || h == 0 || w > pdfcraft_filters::MAX_G4_COLUMNS || u64::from(w) * u64::from(h) > MAX_PIXELS {
         return None;
     }
-    // Through its parameters given by reference too, as `pixels` reads.
-    let g4 = pdfcraft_filters::encode_g4(&doc.with_direct_parms(s).decoded().ok()?, w, h).ok()?;
+    // Through its parameters given by reference too, as `pixels` reads, and no further than its
+    // rows can need.
+    let bytes = usize::try_from(w).ok()?.div_ceil(8).checked_mul(usize::try_from(h).ok()?)?;
+    let g4 = pdfcraft_filters::encode_g4(&doc.with_direct_parms(s).decoded_within(allowance(bytes, h)?).ok()?, w, h).ok()?;
     let mut new = d.clone();
     for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
         new.remove(k);
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 0336d73e9d..62e3b5a156 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -474,6 +474,34 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
     assert_eq!(build("numbers"), direct, "the numbers inside by reference");
 }
 
+/// An image whose data decodes far past what its samples can need (a decompression bomb) is left
+/// alone rather than decoded up to the 1 GiB limit: a 1-bit one that would become Group 4, and an
+/// eight-bit one that would be resampled, each with a megabyte of zeros after its samples.
+#[test]
+fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
+    let (w, h) = (1200u32, 480u32);
+    let text = bilevel(w, h, false);
+    let shades: Vec<u8> = (0..w * h).map(|i| ((i % w) * 255 / w) as u8 ^ ((i / w) as u8 & 0x0F)).collect();
+    for padding in [0, 1 << 20] {
+        let mut doc = Document::new_empty();
+        let padded = |data: &[u8]| data.iter().copied().chain(std::iter::repeat_n(0, padding)).collect::<Vec<u8>>();
+        let grey = |bits: i64| [("BitsPerComponent", bits.into()), ("ColorSpace", Object::name("DeviceGray"))];
+        let one_bit = mono_image(&mut doc, w, h, &padded(&text), None, &grey(1));
+        let eight_bit = mono_image(&mut doc, w, h, &padded(&shades), None, &grey(8));
+        // 300 × 120 pt is 288 ppi; 144 × 57.6 pt is 600 ppi.
+        page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
+        let before = [one_bit, eight_bit].map(|r| stream(&doc, r).raw);
+        let r = optimize(&mut doc, &Settings::default()).unwrap();
+        let after = [one_bit, eight_bit].map(|r| stream(&doc, r).raw);
+        if padding == 0 {
+            assert_eq!((r.images_resampled, r.images_recompressed), (1, 1), "{r:?}");
+        } else {
+            assert_eq!((r.images_resampled, r.images_recompressed), (0, 0), "{r:?}");
+            assert_eq!(after, before);
+        }
+    }
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();

From 3143c4a04430e56dda7646ea2bf466af6da2c469 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 16:56:27 +0100
Subject: [PATCH 149/270] M11: tests for which 1-bit images become Group 4, and
 the byte totals

A test now covers what qualifies and what doesn't: an ICC profile of
one component and a DeviceN of one colourant convert, three components
and two colourants (more than a bit a pixel) don't; an image mask
converts with /BitsPerComponent 1 given, not with 8; an image of exactly
80 million pixels converts, one row more doesn't. The byte totals are
checked exactly. Each of those rules could be broken before with no
test failing (cargo mutants). one_component's comment now says /G
counts with DeviceGray, as the code does.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/src/images.rs     |  5 +--
 crates/optimize/tests/optimize.rs | 59 +++++++++++++++++++++++++++++++
 2 files changed, 62 insertions(+), 2 deletions(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 6eb0ddaa79..f516af7319 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -544,8 +544,9 @@ fn process(doc: &Document, s: &Stream, ppi: f64, settings: &ImageSettings, n: us
 
 /// Whether colour space `cs` has one colour component, so a 1-bit image in it has one bit per
 /// pixel: grey, a separation, an indexed space or a DeviceN of one colourant. Of names, only
-/// DeviceGray counts: another name is no colour space on its own (`/Indexed` and `/CalGray` need
-/// their parameters), so it can only name a resource, which might be RGB.
+/// DeviceGray counts, with `/G`, its abbreviation, which readers take as grey too: another name
+/// is no colour space on its own (`/Indexed` and `/CalGray` need their parameters), so it can only
+/// name a resource, which might be RGB.
 fn one_component(doc: &Document, cs: &Object) -> bool {
     let cs = doc.resolve(cs);
     match &*cs {
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 62e3b5a156..e1a088b561 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -413,6 +413,65 @@ fn black_and_white_images_become_ccitt_group_4() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// Which 1-bit images qualify for Group 4: those of one colour component, an ICC profile of one
+/// component and a DeviceN of one colourant among them, but not one of three components or two
+/// colourants (more than a bit a pixel); image masks of one bit, as `/BitsPerComponent 1` says or
+/// by default, but not one that says 8; and images of up to 80 million pixels, not one row more.
+/// The byte totals count exactly the images stored again.
+#[test]
+fn group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200u32, 480u32);
+    let text = bilevel(w, h, false);
+    let icc = |doc: &mut Document, n: i64| {
+        let mut d = Dict::new();
+        d.set(b"N".to_vec(), Object::Int(n));
+        Object::Array(vec![Object::name("ICCBased"), Object::Ref(doc.add(Object::Stream(Stream::from_raw(d, Vec::new()))))])
+    };
+    let device_n = |colourants: &[&str]| {
+        let mut tint = Dict::new();
+        tint.set(b"FunctionType".to_vec(), Object::Int(2));
+        tint.set(b"Domain".to_vec(), Object::Array(vec![0.into(), 1.into()]));
+        tint.set(b"N".to_vec(), Object::Int(1));
+        Object::Array(vec![
+            Object::name("DeviceN"),
+            Object::Array(colourants.iter().map(|c| Object::name(c)).collect()),
+            Object::name("DeviceGray"),
+            Object::Dict(tint),
+        ])
+    };
+    let one_bit = |cs: Object| [("BitsPerComponent", 1.into()), ("ColorSpace", cs)];
+    let icc_1 = icc(&mut doc, 1);
+    let icc_1 = mono_image(&mut doc, w, h, &text, None, &one_bit(icc_1));
+    let icc_3 = icc(&mut doc, 3);
+    let icc_3 = mono_image(&mut doc, w, h, &bilevel(3 * w, h, false), None, &one_bit(icc_3));
+    let spot = mono_image(&mut doc, w, h, &text, None, &one_bit(device_n(&["Spot"])));
+    let two_spots = mono_image(&mut doc, w, h, &bilevel(2 * w, h, false), None, &one_bit(device_n(&["Spot", "Other"])));
+    let mask = |bits: i64| [("ImageMask", Object::Bool(true)), ("BitsPerComponent", bits.into())];
+    let mask_1 = mono_image(&mut doc, w, h, &text, None, &mask(1));
+    let mask_8 = mono_image(&mut doc, w, h, &bilevel(8 * w, h, false), None, &mask(8));
+    // 10,000 × 8,000 is the limit itself.
+    let grey = one_bit(Object::name("DeviceGray"));
+    let at_limit = mono_image(&mut doc, 10_000, 8_000, &bilevel(10_000, 8_000, false), None, &grey);
+    let past_limit = mono_image(&mut doc, 10_000, 8_001, &bilevel(10_000, 8_001, false), None, &grey);
+    let all = [icc_1, icc_3, spot, two_spots, mask_1, mask_8, at_limit, past_limit];
+    let names: Vec<String> = (0..all.len()).map(|i| format!("Im{i}")).collect();
+    let content: String = (0..all.len()).map(|i| format!("q 200 0 0 80 {} {} cm /Im{i} Do Q ", 6 + 200 * (i % 3), 690 - 100 * (i / 3))).collect();
+    page(&mut doc, &names.iter().map(String::as_str).zip(all).collect::<Vec<_>>(), &content);
+    let converted = [icc_1, spot, mask_1, at_limit];
+    let left = [icc_3, two_spots, mask_8, past_limit];
+    let before = |doc: &Document, refs: &[ObjRef]| refs.iter().map(|r| stream(doc, *r).raw).collect::<Vec<_>>();
+    let (old, untouched) = (before(&doc, &converted), before(&doc, &left));
+    let r = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(r.images_recompressed, converted.len(), "{r:?}");
+    for i in converted {
+        assert_eq!(stream(&doc, i).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "{i:?}");
+    }
+    assert_eq!(before(&doc, &left), untouched);
+    let new = before(&doc, &converted);
+    assert_eq!((r.image_bytes_before, r.image_bytes_after), (old.iter().map(|b| b.len()).sum(), new.iter().map(|b| b.len()).sum()));
+}
+
 /// An image whose /DecodeParms are a reference, or hold numbers given by reference
 /// (`/Predictor 9 0 R`, which `Dict::int` doesn't follow), is read through them, as one with them
 /// direct: a predictor's tag bytes would otherwise shift every row, and the image would be stored

From 4543bae3bfd00cd17183fe63f2540f56831fd2ac Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 16:56:27 +0100
Subject: [PATCH 150/270] M11: say redaction and export don't read Group 4 yet;
 Reduce File Size's descriptions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Redaction doesn't decode CCITT, so a mark over part of an image the
  optimizer stored as Group 4 removes the whole image (nothing leaks),
  and Export ▸ Images refuses it. The optimize README and the
  mono-compression parity note say so. Later PRs of this stack add both
  (#4335 export, #4384 redaction).
- doc_reduce's description, Engine::reduced_bytes and docs/cli-batch.md
  now list the black-and-white step; docs/target-app-parity.md's
  optimize row gives the measured counts and no longer lists CCITT as
  missing; the M11 milestone row lists it as done.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/automation/src/tools.rs     | 2 +-
 crates/engine/src/session/files.rs | 9 +++++----
 crates/optimize/README.md          | 3 ++-
 docs/cli-batch.md                  | 3 ++-
 docs/roadmap.md                    | 2 +-
 docs/target-app-parity.md          | 2 +-
 parity/acrobat-features.toml       | 2 +-
 7 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index c4a9f283b5..2760be9298 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1332,7 +1332,7 @@ pub fn tools() -> Vec<ToolDef> {
             }),
             &["from"],
         )),
-        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
+        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images stored as CCITT Group 4 whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
             .cmd("optimize.reduce")
             .with(schema(json!({ "doc": doc(), "path": { "type": "string" } }), &["doc", "path"])),
         t("doc_initial_view", "Initial view", "Read or change how the document opens (Document Properties ▸ Initial View) and its reading options: navigation (page, bookmarks, pages, attachments, layers), layout (default, single, continuous, two_up, two_up_continuous, two_up_cover, two_up_continuous_cover), magnification (default, actual, fit_page, fit_width, fit_height, fit_visible, or a percentage), page, window options (fit_window, center_window, full_screen, display_title), interface options (hide_menubar, hide_toolbar, hide_window_ui), language and binding (left, right). Only the given ones change; returns the result. Undoable.").with(schema(
diff --git a/crates/engine/src/session/files.rs b/crates/engine/src/session/files.rs
index 1e8cd9b08a..5453163aca 100644
--- a/crates/engine/src/session/files.rs
+++ b/crates/engine/src/session/files.rs
@@ -68,10 +68,11 @@ impl Session {
         if pdf { Ok(bytes.clone()) } else { self.convert_to_pdf(name, bytes).map(|(_, pdf)| pdf) }
     }
 
-    /// Reduce File Size: Acrobat's defaults (images above 225 ppi to 150 ppi, JPEG medium
-    /// quality; thumbnails dropped), identical resources merged, unused objects dropped, objects
-    /// packed into compressed object streams. Returns the bytes and how many objects were
-    /// merged. The open document is not changed (Acrobat saves the reduced copy as a new file).
+    /// Reduce File Size: Acrobat's defaults (colour and grey images above 225 ppi to 150 ppi,
+    /// JPEG medium quality; black-and-white stored as CCITT Group 4 whenever smaller; thumbnails
+    /// dropped), identical resources merged, unused objects dropped, objects packed into
+    /// compressed object streams. Returns the bytes and how many objects were merged. The open
+    /// document is not changed (Acrobat saves the reduced copy as a new file).
     pub fn reduced_bytes(&self, id: DocId) -> Result<(Arc<Vec<u8>>, usize), EditError> {
         let (bytes, report) = self.optimized_bytes(id, &optimize::Settings::default(), &[])?;
         Ok((bytes, report.merged))
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 3bb09038c6..e153de7af0 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -41,7 +41,8 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
   JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
-  than 32,767 samples.
+  than 32,767 samples. Redaction doesn't decode Group 4 yet: a mark over part of an image stored
+  this way removes the whole image (nothing leaks), and Export ▸ Images can't export one.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/docs/cli-batch.md b/docs/cli-batch.md
index ffe0356cf5..0892791194 100644
--- a/docs/cli-batch.md
+++ b/docs/cli-batch.md
@@ -27,7 +27,8 @@ new engine importers become available here automatically. Without `convert`,
 only `.pdf` inputs are processed. Unsupported extensions are reported as skipped.
 
 - `optimize` uses Reduce File Size settings: JPEG quality 60, resampling to 150 ppi
-  above 225 ppi, plus the existing document cleanup. `--ppi` (9–1600) sets the target
+  above 225 ppi (black-and-white images stored as CCITT Group 4 when smaller), plus the
+  existing document cleanup. `--ppi` (9–1600) sets the target
   and a threshold of 1.5 times that value; `--quality` (1–100) sets JPEG quality.
   These settings can lose image detail. A candidate that is not smaller retains
   the bytes entering that step. This is not an images-only or lossless preset.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 9a2a42dacc..75be8e3833 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -196,7 +196,7 @@ total matches the parity estimate.
 | M8 | Security + redaction | 100–180 | 68% | 15–30 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize.<br>Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and `redact_mark`). Redaction cleans indirect and form structure references, preserving surviving form tags. Redaction retires inherited resource dictionaries, so a parent `/Pages` can't keep a removed XObject reachable; unredacted pages are left untouched. Image redaction removes alternate images and unsupported masks only on affected images. Changed marked-content spans lose replacement descriptions; untouched spans keep theirs. Hidden-text cleanup retires unused named descriptions across inherited/shared page and form resources (64 focused tests and scoped Rust 1.96 Clippy/wasm checks pass; publication CI pending). The redaction audit counts a filled cover that hides half of any one word of a long line (#2662), applied or not. Phone-pattern redaction also matches labelled Italian geographic numbers with `+39` and a slash after the area code (#3205 follow-up); unlabelled international slash numbers remain unsupported. Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding |
 | M9 | Signatures (PAdES, validation) | 160–280 | 60% | 40–70 | Done: new `sign` crate (DER, X.509, CMS, PKCS #12 on RustCrypto; aws-lc-rs for RSA private keys); PAdES B-B signing (visible, invisible, existing fields, certification with DocMDP); validation with trust store and changes-after-signing classification; self-signed digital IDs; Signatures panel, message bar, sign dialogs; agent tools. Checked with pdfsig and OpenSSL.<br>Done since: macOS Keychain and Windows Current User Personal store signing (software-backed CNG keys), certificate viewer, signed documents protected from rewrites, page validation overlays separate from original signature artwork (baked Not Verified captions remain; #79 open), snapshot tabs that reuse instead of multiplying. Missing: timestamps (B-T), LTV (DSS, OCSP, CRL), FieldMDP, smart cards, PKCS #11 |
 | M10 | OCR, create, export, print | 200–350 | 33% | 120–215 | Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, the CUPS and Windows spoolers, print-ready PDF).<br>Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; architectural/ANSI/large ISO sheet presets, Match page at 100% and PDF-scale preview (#599 follow-up); Create PDF from multiple files (PDFs, images and text, edited as pages in the grid); OCR can also read pictures on pages that have text, without adding that text twice (#1028). Model staging fetches SHA-256-verified ONNX detection/recognition files after the upstream RTEN URL brownout; runtime discovery prefers complete ONNX pairs per directory, then complete legacy RTEN pairs, without mixing formats or changing directory precedence. Done since: Word invoice export uses borderless inferred tables, floating positioned text/artwork only where text overlaps an image or is rotated, and per-page sizes, covered by synthetic invoice automation regressions (#773); printing on the web through the browser's print dialog, sheets drawn by PdfCraft (gap 4). Lossless image export applies per-component Decode, including Indexed mapping (#1201 partial). Existing 16-bit precision and color-management limits remain. #3532 partial: vector printing retains existing appearances with absent Subtype through a print-owned Form copy; source artwork stays unchanged. #3120: Office export reads form XObjects 50 levels deep, as the renderer does, and up to 50 000 a page; pages past that are listed in `truncated_pages`. Word table cells use the grid columns they span, including cells after a merged cell. Done since: text in a table slot covered by another cell's span remains as paragraph text in Word, HTML, RTF and PowerPoint. Missing: OCR languages beyond Latin, editable-text OCR output, full Office layout fidelity/import. Done since: dotted-leader contents entries stay in separate complete paragraphs (#1757) #2156 candidate: last selected print paper persists across sessions; other print preferences unchanged. Image export applies soft-mask Decode opacity intervals before resizing, including indirect entries and inverted ranges. Vector printing gives annotation appearances unoccupied XObject names so existing page artwork survives. |
-| M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Target-version compatibility is partial: newer content is not detected or converted. Content stream boundaries preserve comments, split operands and graphics state when image fragments merge. Image downsampling includes page-local `/UserUnit` scaling when measuring physical resolution. Done since: reject invalid image and soft-mask dimensions with checked sizing (#2178). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
+| M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Target-version compatibility is partial: newer content is not detected or converted. Content stream boundaries preserve comments, split operands and graphics state when image fragments merge. Image downsampling includes page-local `/UserUnit` scaling when measuring physical resolution. Done since: reject invalid image and soft-mask dimensions with checked sizing (#2178); black-and-white images stored losslessly as CCITT Group 4 when smaller. Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds. Character encoding accepts Identity-H/V with Adobe CJK collections and predefined CJK CMaps independently (#3673); per-glyph validation and embedded-font extraction remain separate.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded, text-only auto-tag proposal tool for one page. Marking a figure decorative rewrites only that stream (#1324). An XFA radio item whose value contains a space is written back unchanged (#1319). Done since: #2569: Growable multiline XFA text reflows after edits, with undo/redo, save/reopen and print coverage; oversized fields still become read-only page text. Structured-data synchronization warnings retain accepted whitespace without relayout from stale data. Done since: #2572: Every repeated page-master button resolves its own field to the shared XFA click script, including print buttons. Done since: #2570: Dynamic XFA rich-text fields carry exData/maxLength into AcroForm MaxLen for reported and enforced Unicode character limits, retained after save/reopen. Done since: #2589: Active XFA skips PDF-container fallback scripts while retaining requested messages and saved scripts; ordinary/static/unlaid-out documents and explicit console/field calls keep their existing behavior. Missing: writing proposed tags and parent tree, field autotag, visual Tags/Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA<br>Reading colours: pending page backgrounds follow the configured colour (#2059). |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers<br>Done since: CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. `text_find` also caps the per-page match ranges it materializes at the remaining result limit plus one continuation match. CLI robustness scans visit each directory once through overlapping roots and symlink aliases. |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds. Character encoding accepts Identity-H/V with Adobe CJK collections and predefined CJK CMaps independently (#3673); per-glyph validation and embedded-font extraction remain separate.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded text-only auto-tag proposal tool; text-only Apply writes marked content, paragraph tags and a parent tree, then opens the Tags panel for review. Missing: mixed-content and field autotag, heading/list/table/figure classification, Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA<br>Done since: CLI info, text and render use dynamic XFA layout pages, with synthetic count/text/pixel and copy-permission regressions (#1645).<br>Reading colours: pending page backgrounds follow the configured colour (#2059). |
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 6c7920e33c..7bc4ec71e3 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -208,7 +208,7 @@ full parity in that area.
 | H Digital signatures | 45 | 23 | 10 | 62.2% | 45% | 40–70 | PAdES B-B signing and validation (PKCS #12, macOS Keychain, Windows store with PIN prompts), certification, encrypted documents, certificate usage checks; B-T, LTV, OCSP/CRL with caller-supplied evidence. Missing: PKCS #11 and smart cards outside Windows, timestamp-server preferences, online revocation fetching, FieldMDP and field locking, OS trust store, EU Trusted Lists, compare signed version |
 | I Scan and OCR | 26 | 5 | 2 | 23.1% | 15% | 40–75 | Searchable image (ocrs, Latin script without accents) on pages, ranges and many files. Missing: every other language (#744 Dutch; accents, CJK, Cyrillic, Arabic), editable-text output, deskew, rotation, despeckle, camera images beyond straightening (found or placed corners): orientation, clean-up, MRC compression, scanners |
 | J Create and export | 34 | 12 | 3 | 39.7% | 25% | 55–100 | Create from images, multipage TIFF, text, clipboard, blank, many files at once; export PNG/JPEG/TIFF, text, RTF; Word and HTML partial. Missing: Office/HTML/web/PostScript to PDF, Excel and PowerPoint export, Word layout fidelity (#773), SVG/XML/EPS/PS/JPEG 2000 export, accessible text |
-| K Optimize and standards | 58 | 15 | 10 | 34.5% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2/CCITT |
+| K Optimize and standards | 58 | 17 | 11 | 38.8% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2 and downsampling |
 | L Print | 39 | 15 | 1 | 39.7% | 35% | 30–55 | Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, print-ready PDF, CUPS on macOS/Linux, the Windows spooler (#756) and the browser's print dialog on the web. Missing: print as image, PostScript, all print-production tools (output preview, separations, ink manager, printer marks, colour conversion) |
 | M Accessibility | 61 | 38 | 1 | 63.1% | 30% | 40–70 | Accessibility Checker (all 32 rules, report, fixes), alternate text, title and language. Missing: autotag, Tags/Order/Content panels, Reading Order tool, artifact marking, table editor, Read Out Loud, full keyboard operation of the app, screen-reader audit |
 | N Automation, preferences, misc | 75 | 20 | 5 | 30.0% | 35% | 25–45 | CLI, MCP, UI control channel, 141 automation tools, Action Wizard (run, create), compare (text, visual, report, side by side, Text/Visual filter). Missing: most Preferences pages, Acrobat's finer compare filters, Action Wizard management, custom commands, AI providers, rich media/3D, hosted web app |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index daffc88188..236237e1e9 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks), and Export ▸ Images can't export one."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From b76ffe64f1260383682d3ca87012b93e5d84a09d Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:21:14 +0100
Subject: [PATCH 151/270] M11: the decode allowance takes ASCIIHex text broken
 into lines

The optimizer's images decode no further than twice their samples plus
a byte a row, meant for ASCIIHex text under Flate; but hex text broken
into lines, as it usually is, is a little more than twice, so such an
image was left alone as if it were a decompression bomb (a 300 dpi
letter scan stayed Flate). It is three bytes for each now, a separator
for every two digits, and a test stores both images as hex text in
lines of 64 digits.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/src/images.rs     |  7 ++++---
 crates/optimize/tests/optimize.rs | 31 +++++++++++++++++++++++++++++--
 2 files changed, 33 insertions(+), 5 deletions(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index f516af7319..57e583a078 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -284,10 +284,11 @@ pub(crate) fn pixels(doc: &Document, s: &Stream, n: usize) -> Option<Vec<u8>> {
 }
 
 /// How far an image of `bytes` samples in `rows` rows is decoded: a filter stage may produce up
-/// to twice them (ASCIIHex text under Flate) plus a PNG predictor's byte a row. More can only be a
-/// decompression bomb, and the image is left alone.
+/// to three bytes for each of them and of a PNG predictor's bytes a row (ASCIIHex text under
+/// Flate, its two digits a byte broken into lines or spaced). More can only be a decompression
+/// bomb, and the image is left alone.
 fn allowance(bytes: usize, rows: u32) -> Option<usize> {
-    bytes.checked_add(usize::try_from(rows).ok()?)?.checked_mul(2)?.checked_add(4096)
+    bytes.checked_add(usize::try_from(rows).ok()?)?.checked_mul(3)?.checked_add(4096)
 }
 
 /// Whether the samples of a three-component JPEG are YCbCr, to be converted to RGB (ISO 32000-2
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index e1a088b561..3fce1dadba 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -535,13 +535,14 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
 
 /// An image whose data decodes far past what its samples can need (a decompression bomb) is left
 /// alone rather than decoded up to the 1 GiB limit: a 1-bit one that would become Group 4, and an
-/// eight-bit one that would be resampled, each with a megabyte of zeros after its samples.
+/// eight-bit one that would be resampled, each with four megabytes of zeros after its samples. Stored
+/// as ASCIIHex text under Flate, broken into lines of 64 digits, their samples aren't a bomb.
 #[test]
 fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
     let (w, h) = (1200u32, 480u32);
     let text = bilevel(w, h, false);
     let shades: Vec<u8> = (0..w * h).map(|i| ((i % w) * 255 / w) as u8 ^ ((i / w) as u8 & 0x0F)).collect();
-    for padding in [0, 1 << 20] {
+    for padding in [0, 4 << 20] {
         let mut doc = Document::new_empty();
         let padded = |data: &[u8]| data.iter().copied().chain(std::iter::repeat_n(0, padding)).collect::<Vec<u8>>();
         let grey = |bits: i64| [("BitsPerComponent", bits.into()), ("ColorSpace", Object::name("DeviceGray"))];
@@ -559,6 +560,32 @@ fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
             assert_eq!(after, before);
         }
     }
+    let hex_lines = |data: &[u8]| {
+        let digits: Vec<u8> = data.iter().flat_map(|b| format!("{b:02X}").into_bytes()).collect();
+        let mut text: Vec<u8> = digits.chunks(64).flat_map(|line| line.iter().copied().chain(*b"\n")).collect();
+        text.push(b'>');
+        pdfcraft_filters::encode_flate(&text)
+    };
+    let mut doc = Document::new_empty();
+    let as_hex = |doc: &mut Document, data: &[u8], bits: i64, (w, h): (u32, u32)| {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(bits));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"), Object::name("ASCIIHexDecode")]));
+        doc.add(Object::Stream(Stream::from_raw(d, hex_lines(data))))
+    };
+    // Large enough that its hex text in lines is more than twice its samples and a byte a row
+    // plus 4 KiB: 2560 × 1200, drawn at 400 ppi.
+    let page_scan = bilevel(2560, 1200, false);
+    let one_bit = as_hex(&mut doc, &page_scan, 1, (2560, 1200));
+    let eight_bit = as_hex(&mut doc, &shades, 8, (w, h));
+    page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 460.8 0 0 216 20 500 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
+    optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(stream(&doc, one_bit).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "1-bit hex text in lines: Group 4");
+    assert!(stream(&doc, eight_bit).dict.int(b"Width").is_some_and(|nw| nw < i64::from(w)), "8-bit hex text in lines: resampled");
 }
 
 #[test]

From 656c6ef0f4267277ab72937646c2e64c510849e7 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:21:14 +0100
Subject: [PATCH 152/270] M11: name every reader that doesn't take Group 4 yet;
 count the new partial in the parity tables
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Not only Export ▸ Images refuses a CCITT image until #4335: so does
  everything that exports an image through it. Save Image As refuses
  it, Copy Image fails, and Word, PowerPoint and HTML export leave the
  picture out, with the page not reported. The optimize README and the
  mono-compression parity note name them.
- optimize.mono-compression is partial now, so docs/target-app-parity.md
  counts it on the table's own measurement: K Optimize and standards 15
  shipped and 11 partial of 58 (35.3%), breadth 57.0% (423 + 75 of 808),
  mainstream 63.3% (292 + 45 of 497), with a status line and a revision
  row. ROADMAP.md's breadth rows and its K row say the same.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 ROADMAP.md                   |  6 +++---
 crates/optimize/README.md    |  4 +++-
 docs/target-app-parity.md    | 14 ++++++++------
 parity/acrobat-features.toml |  2 +-
 4 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 42f70325bc..87f5b6705f 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -95,8 +95,8 @@ and add a line to the [progress log](#progress-log); when a gap closes, remove i
 
 | | Value | Kind |
 |---|---|---|
-| **Feature breadth** | **≈ 67%** tier-weighted (56.9% unweighted: 423 shipped + 74 partial of 808; P0 94.2%) | measured, `parity/acrobat-features.toml` |
-| Feature breadth, mainstream practitioner | ≈ 70% tier-weighted (63.2% unweighted; P0 95.3%) | measured ([split](docs/target-app-parity.md#mainstream-practitioner-vs-full-acrobat-pro)) |
+| **Feature breadth** | **≈ 67%** tier-weighted (57.0% unweighted: 423 shipped + 75 partial of 808; P0 94.2%) | measured, `parity/acrobat-features.toml` |
+| Feature breadth, mainstream practitioner | ≈ 70% tier-weighted (63.3% unweighted; P0 95.3%) | measured ([split](docs/target-app-parity.md#mainstream-practitioner-vs-full-acrobat-pro)) |
 | **Ready for real work**, full Acrobat Pro | **≈ 50%** (45–53%) | estimated, weighted sum over [dimensions](#by-dimension) |
 | **Ready for real work**, mainstream practitioner | **≈ 55%** (50–60%) | estimated ([split](docs/target-app-parity.md#mainstream-practitioner-vs-full-acrobat-pro)) |
 | **Ready for real work**, essentials user | **≈ 66%** (60–70%) | estimated ([method](docs/target-app-parity.md#essentials-user)) |
@@ -151,7 +151,7 @@ Hours are calibrated as in [Effort and calibration](docs/target-app-parity.md#ef
 | H Digital signatures | 62.2% | 45% | 40–70 |
 | I Scan and OCR | 23.1% | 15% | 40–75 |
 | J Create and export | 39.7% | 25% | 55–100 |
-| K Optimize and standards | 34.5% | 20% | 65–115 |
+| K Optimize and standards | 35.3% | 20% | 65–115 |
 | L Print | 39.7% | 35% | 30–55 |
 | M Accessibility | 63.1% | 30% | 40–70 |
 | N Automation, preferences, misc | 30.0% | 35% | 25–45 |
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index e153de7af0..c3281f00c4 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -42,7 +42,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
   JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
   than 32,767 samples. Redaction doesn't decode Group 4 yet: a mark over part of an image stored
-  this way removes the whole image (nothing leaks), and Export ▸ Images can't export one.
+  this way removes the whole image (nothing leaks). Nor does anything that exports an image:
+  Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML
+  export leave the picture out.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 7bc4ec71e3..d790e98178 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,5 +1,6 @@
 # PdfCraft parity with Adobe Acrobat Pro
 
+> **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-26 · **Change:** minor (`optimize.mono-compression` partial (CCITT Group 4): K Optimize and standards 15 shipped and 11 partial of 58, 35.3%; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497); estimates unchanged)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-25 · **Change:** minor (localization current state: Arabic logical catalog, explicit RTL direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite. Scores and estimates unchanged)
 
 > **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-13 · **Change:** minor (localization ≈59% → ≈68%; weighted readiness 49.25 → 49.7 ≈ 50%) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -20,9 +21,9 @@ Approved Trust List) are out of scope: 23 such features are tracked as `na` in
 | | Value | Kind |
 |---|---|---|
 | **Feature breadth**, tier-weighted | **≈ 67%** | measured (checklist; weights below) |
-| Feature breadth, unweighted | 56.9% (423 shipped + 74 partial of 808) | measured (`cargo xtask parity` arithmetic) |
+| Feature breadth, unweighted | 57.0% (423 shipped + 75 partial of 808) | measured (`cargo xtask parity` arithmetic) |
 | Must-have (P0) features | 94.2% (226 + 23 partial of 252) | measured |
-| Feature breadth, mainstream practitioner | ≈ 70% tier-weighted (63.2% unweighted: 292 + 44 partial of 497; P0 95.3%) | measured ([split below](#mainstream-practitioner-vs-full-acrobat-pro)) |
+| Feature breadth, mainstream practitioner | ≈ 70% tier-weighted (63.3% unweighted: 292 + 45 partial of 497; P0 95.3%) | measured ([split below](#mainstream-practitioner-vs-full-acrobat-pro)) |
 | **Ready for real work**, full Acrobat Pro | **≈ 50%** (range 45–53%) | estimated (weighted sum over dimensions, [below](#by-dimension)) |
 | **Ready for real work**, mainstream practitioner | **≈ 55%** (range 50–60%) | estimated ([split below](#mainstream-practitioner-vs-full-acrobat-pro)) |
 | **Ready for real work**, essentials user | **≈ 66%** (range 60–70%) | estimated ([below](#essentials-user)) |
@@ -105,9 +106,9 @@ Splitting it (measured from `parity/acrobat-features.toml`):
 
 | Slice | Features | Shipped | Partial | Unweighted | Tier-weighted | P0 |
 |---|---|---|---|---|---|---|
-| Mainstream: view, comment (without measuring), edit, organize, forms (without XFA and JavaScript tooling), protect and redact, OCR, create and export, compress (Reduce File Size, Optimizer), print (without print production) | 497 | 292 | 44 | 63.2% | ≈ 70% | 95.3% (193) |
+| Mainstream: view, comment (without measuring), edit, organize, forms (without XFA and JavaScript tooling), protect and redact, OCR, create and export, compress (Reduce File Size, Optimizer), print (without print production) | 497 | 292 | 45 | 63.3% | ≈ 70% | 95.3% (193) |
 | Specialist: core internals, digital-signature PKI, accessibility remediation, automation and preferences, Preflight and PDF/A/X/UA, print production, measuring, XFA and JavaScript tooling | 311 | 131 | 30 | 46.9% | ≈ 63% | 90.7% (59) |
-| All | 808 | 423 | 74 | 56.9% | ≈ 67% | 94.2% (252) |
+| All | 808 | 423 | 75 | 57.0% | ≈ 67% | 94.2% (252) |
 
 So the checklist is **not** dominated by niche surface (38% of rows), and the P0 tier, which is
 mostly mainstream, is at 94–95% in both slices. What holds the mainstream number down is P1 depth
@@ -208,11 +209,11 @@ full parity in that area.
 | H Digital signatures | 45 | 23 | 10 | 62.2% | 45% | 40–70 | PAdES B-B signing and validation (PKCS #12, macOS Keychain, Windows store with PIN prompts), certification, encrypted documents, certificate usage checks; B-T, LTV, OCSP/CRL with caller-supplied evidence. Missing: PKCS #11 and smart cards outside Windows, timestamp-server preferences, online revocation fetching, FieldMDP and field locking, OS trust store, EU Trusted Lists, compare signed version |
 | I Scan and OCR | 26 | 5 | 2 | 23.1% | 15% | 40–75 | Searchable image (ocrs, Latin script without accents) on pages, ranges and many files. Missing: every other language (#744 Dutch; accents, CJK, Cyrillic, Arabic), editable-text output, deskew, rotation, despeckle, camera images beyond straightening (found or placed corners): orientation, clean-up, MRC compression, scanners |
 | J Create and export | 34 | 12 | 3 | 39.7% | 25% | 55–100 | Create from images, multipage TIFF, text, clipboard, blank, many files at once; export PNG/JPEG/TIFF, text, RTF; Word and HTML partial. Missing: Office/HTML/web/PostScript to PDF, Excel and PowerPoint export, Word layout fidelity (#773), SVG/XML/EPS/PS/JPEG 2000 export, accessible text |
-| K Optimize and standards | 58 | 17 | 11 | 38.8% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2 and downsampling |
+| K Optimize and standards | 58 | 15 | 11 | 35.3% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2 and downsampling |
 | L Print | 39 | 15 | 1 | 39.7% | 35% | 30–55 | Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, print-ready PDF, CUPS on macOS/Linux, the Windows spooler (#756) and the browser's print dialog on the web. Missing: print as image, PostScript, all print-production tools (output preview, separations, ink manager, printer marks, colour conversion) |
 | M Accessibility | 61 | 38 | 1 | 63.1% | 30% | 40–70 | Accessibility Checker (all 32 rules, report, fixes), alternate text, title and language. Missing: autotag, Tags/Order/Content panels, Reading Order tool, artifact marking, table editor, Read Out Loud, full keyboard operation of the app, screen-reader audit |
 | N Automation, preferences, misc | 75 | 20 | 5 | 30.0% | 35% | 25–45 | CLI, MCP, UI control channel, 141 automation tools, Action Wizard (run, create), compare (text, visual, report, side by side, Text/Visual filter). Missing: most Preferences pages, Acrobat's finer compare filters, Action Wizard management, custom commands, AI providers, rich media/3D, hosted web app |
-| **All** | **808** | **423** | **74** | **56.9%** | **≈ 49%** | **610–1,100** | Plus 175–325 h of cross-cutting work (dimension table) |
+| **All** | **808** | **423** | **75** | **57.0%** | **≈ 49%** | **610–1,100** | Plus 175–325 h of cross-cutting work (dimension table) |
 
 Shipped features rest on thin evidence: 141 of 423 cite exactly one test, and only a handful cite
 an external oracle (`pdftotext`, `pdfsig`, OpenSSL, `qpdf --check`, a corpus).
@@ -294,6 +295,7 @@ licensed OCR or AI model.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | `optimize.mono-compression` became partial (CCITT Group 4), counted on the table's own measurement: K Optimize and standards 15 shipped and 11 partial of 58 (35.3%), no longer listing CCITT as missing; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497). Estimates unchanged. |
 | 2026-10-25 | minor | Localization current state: Arabic catalogs stay logical, Arabic/Kurdish labels take an explicit RTL direction, and stock chrome mirrors; native/browser RTL input, IME and complex workflows remain unqualified. Native Simplified Chinese uses LXGW WenKai Lite; the web build has no Hans face. Scores and estimates unchanged. |
 | 2026-10-20 | minor | M12 #3673: the Character encoding rule accepts Identity-H/V fonts with Adobe CJK collections, or a predefined non-Identity CMap, while rejecting unknown names and foreign registries. Synthetic checker and read-only automation regressions passed after failing before the fix; per-glyph mapping validation and embedded-font extraction remain separate. Breadth, readiness and hours unchanged. |
 | 2026-10-12 | minor | Exclusive image crops resize with their pixels across nested states, intervening operators and content streams; shared clips remain fixed. Synthetic engine/tool regressions and private image save/reopen checks; estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 236237e1e9..02d7219aba 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks), and Export ▸ Images can't export one."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks), nor does anything that exports an image: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 1b7164cab1fc187c5385c30f94449542fe284280 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 18:47:31 +0100
Subject: [PATCH 153/270] M11: the spec parity table says the Optimizer encodes
 CCITT Group 4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

docs/pdf-spec-parity.md's §7.4 row still said there was no CCITT
encoding; it names the Optimizer's Group 4 encoder now, with a status
line and a revision row.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 docs/pdf-spec-parity.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index 8cfe4be471..dba04f6c4c 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,6 +1,6 @@
 # PDF specification and standards parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-24 · **Change:** minor (§14.3: custom properties edited in Document Properties) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: CCITT Group 4 encoding in the Optimizer; earlier, §14.3: custom properties edited in Document Properties) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -21,7 +21,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 |---|---|---|---|---|
 | §7.2–7.5 | Syntax, objects, file structure, xref tables and streams, object streams, hybrid files, incremental updates | full | **own**, tolerant, repairs damaged files | `crates/cos`; corpus 958 files; fuzzed nightly |
 | §7.4 | Stream filters: Flate, LZW, ASCII85, ASCIIHex, RunLength, predictors | full | **own** | `crates/filters` |
-| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode only) | `core.image-filters` partial; own codecs M1.1/M1.2; no JBIG2/CCITT encoding (Optimizer) |
+| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; the Optimizer encodes CCITT Group 4 (`pdfcraft_filters::encode_g4`, `optimize.mono-compression`); no JBIG2 encoding |
 | §7.5.8 | Linearization | R W | R only | `core.linearization` planned |
 | §7.6.4 | Standard security handler R2–R6 (RC4 40/128, AES-128, AES-256), crypt filters, `/EncryptMetadata`, SASLprep | full | **own**, read and write | `crates/crypt`; written files open in Acrobat DC since #836 (#774: Acrobat needs the catalog outside object streams) |
 | §7.6.5 | Public-key security handler | full | none | `core.open-public-key`, `protect.certificate-encryption` planned |
@@ -130,6 +130,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | §7.4: CCITT Group 4 encoding (`fax`) in the Optimizer |
 | 2026-10-14 | minor | §12.4.4: `/Trans` and `/Dur` read into `DocInfo::transitions` and reported by `doc_info` |
 | 2026-10-11 | minor | §7.6.4: encrypted files we write open in Acrobat (#774, fixed by #836) |
 | 2026-10-10 | major | Created from the code, `vendor/README.md` and `parity/acrobat-features.toml`, against ISO 32000-2 and Acrobat Pro 26.002.21931's documented capabilities |

From 5c4cadce599e8a605da1f6a4f9e2bd85ecd0ba71 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Fri, 23 Oct 2026 21:48:03 +0200
Subject: [PATCH 154/270] M11: lossless JBIG2 for black-and-white images

pdfcraft_filters::encode_jbig2_generic writes 1-bit rows as a JBIG2
stream for JBIG2Decode (embedded organisation: a page information
segment and an immediate lossless generic region, no globals): template
0 with its nominal AT pixels, typical prediction, and the MQ arithmetic
coder (mq.rs), written from the JBIG committee's ISO/IEC 14492 Final
Committee Draft. The coder reproduces its Annex H.2 test sequence byte
for byte; output round-trips through hayro-jbig2, and Poppler renders
it the same as the original.

The optimizer's Monochrome Images gets JBIG2 (lossless) beside CCITT
Group 4 (still the default), doc_optimize mono jbig2; a document below
PDF 1.4 gets /Version /1.4 in its catalog. On 300 dpi text JBIG2 is
about a third smaller than Group 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 Cargo.lock                                  |   2 +
 Cargo.toml                                  |   3 +-
 ROADMAP.md                                  |   1 +
 crates/automation/src/documents.rs          |   6 +-
 crates/automation/src/tools.rs              |   2 +-
 crates/automation/tests/it/automation.rs    |  26 +-
 crates/filters/Cargo.toml                   |   1 +
 crates/filters/README.md                    |   8 +-
 crates/filters/src/jbig2.rs                 | 313 ++++++++++++++++++++
 crates/filters/src/lib.rs                   |   3 +
 crates/filters/src/mq.rs                    | 209 +++++++++++++
 crates/optimize/README.md                   |  12 +-
 crates/optimize/src/images.rs               |  55 +++-
 crates/optimize/src/lib.rs                  |   7 +-
 crates/optimize/tests/optimize.rs           |  61 ++++
 crates/ui-egui/src/i18n/ar.tsv              |   1 +
 crates/ui-egui/src/i18n/bg.tsv              |   1 +
 crates/ui-egui/src/i18n/ca.tsv              |   1 +
 crates/ui-egui/src/i18n/ckb.tsv             |   1 +
 crates/ui-egui/src/i18n/cs.tsv              |   1 +
 crates/ui-egui/src/i18n/de.tsv              |   1 +
 crates/ui-egui/src/i18n/el.tsv              |   1 +
 crates/ui-egui/src/i18n/es.tsv              |   1 +
 crates/ui-egui/src/i18n/fi.tsv              |   1 +
 crates/ui-egui/src/i18n/fr.tsv              |   1 +
 crates/ui-egui/src/i18n/hi.tsv              |   1 +
 crates/ui-egui/src/i18n/hu.tsv              |   1 +
 crates/ui-egui/src/i18n/id.tsv              |   1 +
 crates/ui-egui/src/i18n/it.tsv              |   1 +
 crates/ui-egui/src/i18n/ja.tsv              |   1 +
 crates/ui-egui/src/i18n/kk.tsv              |   1 +
 crates/ui-egui/src/i18n/ko.tsv              |   1 +
 crates/ui-egui/src/i18n/lo.tsv              |   1 +
 crates/ui-egui/src/i18n/lt.tsv              |   1 +
 crates/ui-egui/src/i18n/nb.tsv              |   1 +
 crates/ui-egui/src/i18n/pl.tsv              |   1 +
 crates/ui-egui/src/i18n/pt-br.tsv           |   1 +
 crates/ui-egui/src/i18n/ro.tsv              |   1 +
 crates/ui-egui/src/i18n/ru.tsv              |   1 +
 crates/ui-egui/src/i18n/sl.tsv              |   1 +
 crates/ui-egui/src/i18n/sq.tsv              |   1 +
 crates/ui-egui/src/i18n/te.tsv              |   1 +
 crates/ui-egui/src/i18n/th.tsv              |   1 +
 crates/ui-egui/src/i18n/tr.tsv              |   1 +
 crates/ui-egui/src/i18n/uk.tsv              |   1 +
 crates/ui-egui/src/i18n/vi.tsv              |   1 +
 crates/ui-egui/src/i18n/zh-hans.tsv         |   1 +
 crates/ui-egui/src/i18n/zh-hant.tsv         |   1 +
 crates/ui-egui/src/workflows/optimize_ui.rs |   2 +
 docs/roadmap.md                             |   2 +
 parity/acrobat-features.toml                |   4 +-
 51 files changed, 720 insertions(+), 30 deletions(-)
 create mode 100644 crates/filters/src/jbig2.rs
 create mode 100644 crates/filters/src/mq.rs

diff --git a/Cargo.lock b/Cargo.lock
index 42426bc688..4b09072f5b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2731,6 +2731,7 @@ version = "0.3.0"
 dependencies = [
  "fearless_simd",
  "hayro-ccitt",
+ "image",
 ]
 
 [[package]]
@@ -4427,6 +4428,7 @@ dependencies = [
  "fax",
  "flate2",
  "hayro-ccitt",
+ "hayro-jbig2",
  "proptest",
  "thiserror 2.0.21",
  "weezl 0.2.1",
diff --git a/Cargo.toml b/Cargo.toml
index 5a92b67475..b0b606c146 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -67,8 +67,9 @@ flate2 = { version = "1.1", default-features = false, features = ["rust_backend"
 weezl = "0.2"
 # CCITT Group 4 encoding (pdfcraft-filters); already in the tree through tiff.
 fax = "0.2.7"
-# An independent CCITT decoder, for round-trip tests; already in the tree through hayro.
+# Independent CCITT and JBIG2 decoders, for round-trip tests; already in the tree through hayro.
 hayro-ccitt = "0.3"
+hayro-jbig2 = "0.3"
 
 # foundation
 thiserror = "2"
diff --git a/ROADMAP.md b/ROADMAP.md
index 87f5b6705f..20c9f06d83 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,6 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
+- **2026-10-23 (M11, JBIG2):** The PDF Optimizer can store black-and-white images as lossless JBIG2 (a generic region, written from the JBIG2 draft standard and checked against its arithmetic-coder test sequence), about a third smaller than Group 4 on 300 dpi text. JBIG2 symbol coding, where its largest gains on text are, is next.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
index 40aa4ac522..880179b1eb 100644
--- a/crates/automation/src/documents.rs
+++ b/crates/automation/src/documents.rs
@@ -318,8 +318,9 @@ impl Automation {
         settings.color = images("color", settings.color)?;
         settings.gray = images("gray", settings.gray)?;
         if let Some(mono) = a.get("mono") {
-            let unknown = |c: &Value| ToolError::InvalidArgs(format!("unknown mono compression {c} (ccitt_g4, retain)"));
-            let mono = mono.as_object().ok_or_else(|| ToolError::InvalidArgs("mono must be an object: { compression: ccitt_g4|retain }".into()))?;
+            let unknown = |c: &Value| ToolError::InvalidArgs(format!("unknown mono compression {c} (ccitt_g4, jbig2, retain)"));
+            let mono =
+                mono.as_object().ok_or_else(|| ToolError::InvalidArgs("mono must be an object: { compression: ccitt_g4|jbig2|retain }".into()))?;
             // A misspelled key would otherwise leave the preset's setting in place unnoticed.
             if let Some(key) = mono.keys().find(|k| *k != "compression") {
                 return Err(ToolError::InvalidArgs(format!("unknown mono key {key:?} (compression)")));
@@ -327,6 +328,7 @@ impl Automation {
             if let Some(c) = mono.get("compression") {
                 settings.mono = match c.as_str() {
                     Some("ccitt_g4" | "ccitt" | "g4") => MonoCompression::CcittG4,
+                    Some("jbig2") => MonoCompression::Jbig2,
                     Some("retain") => MonoCompression::Retain,
                     _ => return Err(unknown(c)),
                 };
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 2760be9298..3233935a59 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1433,7 +1433,7 @@ pub fn tools() -> Vec<ToolDef> {
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
             .with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
-        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { compression: ccitt_g4|retain } (default ccitt_g4: black-and-white images and image masks are stored losslessly as CCITT Group 4 when that is smaller; counted in images_recompressed). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
+        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { compression: ccitt_g4|jbig2|retain } (default ccitt_g4: black-and-white images and image masks are stored losslessly as CCITT Group 4, or with jbig2 as lossless JBIG2, usually smaller still, when that is smaller than the image as it is; counted in images_recompressed). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
             .cmd("optimize.advanced")
             .with(schema(
                 json!({
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index dcd321eddb..c0efb92efd 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6431,6 +6431,30 @@ fn scanned_page() -> Vec<u8> {
     write_full(&doc, &SaveOptions::default()).unwrap()
 }
 
+/// With `mono: { compression: jbig2 }` a scan's black-and-white image is stored as lossless JBIG2,
+/// smaller than as Group 4.
+#[test]
+fn doc_optimize_stores_black_and_white_images_as_jbig2() {
+    let dir = workdir("optimize-jbig2");
+    std::fs::write(dir.join("scan.pdf"), scanned_page()).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "scan.pdf" }))["doc"].as_u64().unwrap();
+    let g4 = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "g4.pdf" }));
+    let r = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "jbig2.pdf", "mono": { "compression": "jbig2" } }));
+    assert_eq!((r["images"].as_u64(), r["images_recompressed"].as_u64()), (Some(1), Some(1)), "{r}");
+    assert!(r["image_bytes_after"].as_u64() < g4["image_bytes_after"].as_u64(), "JBIG2 {r}, Group 4 {g4}");
+    let written = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join("jbig2.pdf")).unwrap())).unwrap();
+    let filters: Vec<Vec<u8>> = written
+        .object_numbers()
+        .into_iter()
+        .filter_map(|num| match &*written.get(pdfcraft_cos::ObjRef { num, generation: written.generation(num) }) {
+            pdfcraft_cos::Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => s.dict.name(b"Filter").map(<[u8]>::to_vec),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(filters, [b"JBIG2Decode".to_vec()]);
+}
+
 /// A scan's black-and-white image is stored as CCITT Group 4 by default, and kept as it is with
 /// `mono: { compression: retain }`.
 #[test]
@@ -6457,7 +6481,7 @@ fn doc_optimize_stores_black_and_white_images_as_ccitt_group_4() {
     assert_eq!(filters, [b"CCITTFaxDecode".to_vec()]);
     // An unknown compression, one that isn't a name, a misspelled key, or a mono that isn't an
     // object is refused, not read as the default.
-    for mono in [json!({ "compression": "jbig2" }), json!({ "compression": false }), json!({ "compresson": "retain" }), json!("retain")] {
+    for mono in [json!({ "compression": "jpeg" }), json!({ "compression": false }), json!({ "compresson": "retain" }), json!("retain")] {
         assert!(matches!(a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "mono": mono })), Err(ToolError::InvalidArgs(_))), "{mono}");
     }
 }
diff --git a/crates/filters/Cargo.toml b/crates/filters/Cargo.toml
index 2ed64eb8bd..876a8c2815 100644
--- a/crates/filters/Cargo.toml
+++ b/crates/filters/Cargo.toml
@@ -17,5 +17,6 @@ thiserror.workspace = true
 
 [dev-dependencies]
 hayro-ccitt.workspace = true
+hayro-jbig2.workspace = true
 proptest.workspace = true
 weezl.workspace = true
diff --git a/crates/filters/README.md b/crates/filters/README.md
index 413dff37c1..aeb082ef0f 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -3,7 +3,7 @@
 PDF stream filters: the decoders and encoders behind `/Filter` and `/DecodeParms`.
 
 - **Layer:** L0, standalone. No dependency on any other PdfCraft crate. `cos` depends on it (architecture §3 rule 3).
-- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder.
+- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder. JBIG2 generic region encoding is written here from the JBIG committee's ISO/IEC 14492 Final Committee Draft (WG1 N1359, 1999), the public draft of ITU-T T.88; its Annex H.2 test sequence checks the arithmetic coder byte for byte.
 - `#![forbid(unsafe_code)]`. Builds for `wasm32-unknown-unknown`.
 
 ## API
@@ -23,6 +23,7 @@ decode_tolerant_counted(chain, data, max_output) -> Result<(Vec<u8>, bool /*part
 encode(filter, params, data) -> Result<Vec<u8>, FilterError>
 encode_flate(data) -> Vec<u8>   // zlib, level 6
 encode_g4(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as CCITT Group 4; columns <= MAX_G4_COLUMNS
+encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as lossless JBIG2 for JBIG2Decode; columns <= MAX_JBIG2_COLUMNS
 ```
 
 - `chain` is applied first to last, as in a `/Filter` array.
@@ -42,6 +43,7 @@ encode_g4(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows a
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
 | CCITTFaxDecode | not here (`Unsupported`; renderers decode it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
+| JBIG2Decode | not here (`Unsupported`; renderers decode it) | `encode_jbig2_generic`: the embedded organisation (D.3) with a page information segment and an immediate lossless generic region (7.4.6), no `/JBIG2Globals`; template 0 with its nominal AT pixels and typical prediction (6.2.5), coded with the MQ arithmetic coder (Annex E, Table E.1) and ended by its 0xFF 0xAC marker. A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, so the stream decodes to the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 1,048,576 samples a row; no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
 
 ## Tests
 
@@ -49,8 +51,10 @@ encode_g4(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows a
 - LZW is cross-checked against `weezl` (dev-dependency) in both directions for both early-change settings.
 - `tests/proptests.rs`: encode→decode round trips for every encodable filter × predictor × colors × bpc × columns, two-filter chains, output-limit checks, and fuzz-style no-panic tests (random bytes, random/nonsense params, bit-flipped valid streams).
 - `ccitt.rs`: Group 4 output decoded by `hayro-ccitt` (dev-dependency, an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
+- `mq.rs`: the arithmetic coder reproduces Annex H.2's 30 bytes from its 256 decisions.
+- `jbig2.rs`: output decoded by `hayro-jbig2` (dev-dependency, an independent decoder) matches the input bits: a text-like page (smaller than Group 4), edges, padding, all-white and all-black regions (typical rows), and property tests over bitmaps of noise and of runs; any input returns rather than panics.
 - `fuzz/`: a detached cargo-fuzz crate (`cargo +nightly fuzz run decode`, run from `crates/filters/`).
 
 ## Status
 
-M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image codecs (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2, CCITT G3/G4 decode, DCT encode), CCITT Group 3 encoding and Flate encode levels other than 6.
+M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image codecs (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2 and CCITT decode, DCT encode), CCITT Group 3 encoding, JBIG2 symbol coding (text regions, symbol dictionaries, lossy) and Flate encode levels other than 6.
diff --git a/crates/filters/src/jbig2.rs b/crates/filters/src/jbig2.rs
new file mode 100644
index 0000000000..8983c335fd
--- /dev/null
+++ b/crates/filters/src/jbig2.rs
@@ -0,0 +1,313 @@
+//! JBIG2 generic region encoding (ITU-T T.88 | ISO/IEC 14492), for `JBIG2Decode`
+//! (ISO 32000-2 §7.4.7): lossless, template 0 with its nominal adaptive pixels, typical prediction
+//! on, MQ arithmetic coding ([`crate::mq`]). Written from the standard's 6.2.5 (coding a generic
+//! region), 7.2 (segment headers), 7.4.1, 7.4.6 and 7.4.8 (the segments) and D.3 (the embedded
+//! organisation PDF uses).
+
+use crate::FilterError;
+use crate::mq::{Context, MqEncoder};
+
+/// The widest row [`encode_jbig2_generic`] encodes. JBIG2 allows 32-bit widths; this keeps a
+/// row's buffers small and its positions in range.
+pub const MAX_JBIG2_COLUMNS: u32 = 1 << 20;
+
+/// Template 0's pixels (Figure 3), as (x, y) offsets from the pixel being coded, each a bit of the
+/// context in this order: the four on the current row, the five fixed ones on the row above, the
+/// three on the row above that, then the adaptive pixels A1–A4 at their nominal places (Table 5).
+const TEMPLATE: [(i32, i32); 16] = [
+    (-1, 0),
+    (-2, 0),
+    (-3, 0),
+    (-4, 0),
+    (-2, -1),
+    (-1, -1),
+    (0, -1),
+    (1, -1),
+    (2, -1),
+    (-1, -2),
+    (0, -2),
+    (1, -2),
+    (3, -1),
+    (-3, -1),
+    (2, -2),
+    (-2, -2),
+];
+
+/// The context that codes SLTP when template 0 is used (Figure 8): those pixel values, in
+/// [`TEMPLATE`]'s order. Figure 8 reads, by row from x = -4: `0 1 0 1` on the current row,
+/// `0 1 1 0 0 1 0` (x = -3 to 3) above it, `1 0 0 1 1` (x = -2 to 2) above that.
+const SLTP: [u8; 16] = [1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 1];
+
+/// Columns of padding either side of a row, so every template pixel of a row's pixels is in it.
+const PAD: usize = 4;
+
+/// `rows` rows of `columns` 1-bit PDF samples (most significant bit first, each row starting on
+/// a new byte), as a JBIG2 stream in the embedded organisation: a page information segment and an
+/// immediate lossless generic region segment, which `JBIG2Decode` decodes to the same bits
+/// without `/JBIG2Globals`.
+///
+/// A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, as a grey image's
+/// samples have it. Bytes after the last row are ignored, as are the bits that pad a row to a whole
+/// byte.
+///
+/// Errors: no rows or columns, or rows wider than [`MAX_JBIG2_COLUMNS`]
+/// ([`FilterError::Unsupported`]); fewer bytes than the rows need ([`FilterError::Corrupt`]).
+pub fn encode_jbig2_generic(data: &[u8], columns: u32, rows: u32) -> Result<Vec<u8>, FilterError> {
+    if columns == 0 || rows == 0 || columns > MAX_JBIG2_COLUMNS {
+        return Err(FilterError::Unsupported(format!("JBIG2 encoding of {columns} × {rows} samples")));
+    }
+    let width = columns as usize;
+    let stride = width.div_ceil(8);
+    let samples = usize::try_from(rows).ok().and_then(|r| r.checked_mul(stride)).and_then(|n| data.get(..n)).ok_or_else(|| FilterError::Corrupt {
+        filter: "JBIG2Decode",
+        detail: format!("{} bytes for {rows} rows of {columns} samples", data.len()),
+    })?;
+    let region = generic_region(samples, width, stride);
+    let mut out = Vec::with_capacity(region.len() + 64);
+    // Page information (7.4.8): the region's size, resolution unknown, eventually lossless,
+    // default pixel 0 (white), OR combination, not striped.
+    let mut page = Vec::with_capacity(19);
+    page.extend_from_slice(&columns.to_be_bytes());
+    page.extend_from_slice(&rows.to_be_bytes());
+    page.extend_from_slice(&[0; 8]);
+    page.push(0x01);
+    page.extend_from_slice(&[0, 0]);
+    segment(&mut out, 0, 48, &page);
+    // Immediate lossless generic region (7.4.6): region information (7.4.1) at (0, 0) with OR,
+    // flags (MMR 0, template 0, TPGDON 1), the AT pixels at their nominal places, then the data.
+    let mut generic = Vec::with_capacity(26 + region.len());
+    generic.extend_from_slice(&columns.to_be_bytes());
+    generic.extend_from_slice(&rows.to_be_bytes());
+    generic.extend_from_slice(&[0; 8]);
+    generic.push(0);
+    generic.push(0x08);
+    for (x, y) in &TEMPLATE[12..] {
+        generic.push(*x as i8 as u8);
+        generic.push(*y as i8 as u8);
+    }
+    generic.extend_from_slice(&region);
+    segment(&mut out, 1, 39, &generic);
+    Ok(out)
+}
+
+/// A segment (7.2): its header (number, type, no referred-to segments, page 1, data length), then
+/// its data.
+fn segment(out: &mut Vec<u8>, number: u32, kind: u8, data: &[u8]) {
+    out.extend_from_slice(&number.to_be_bytes());
+    out.push(kind);
+    out.push(0);
+    out.push(1);
+    // A segment's data never comes near 4 GiB here: a row is at most 1 MiB wide.
+    out.extend_from_slice(&u32::try_from(data.len()).unwrap_or(u32::MAX).to_be_bytes());
+    out.extend_from_slice(data);
+}
+
+/// The arithmetic-coded data of a generic region (6.2.5.7) with template 0, the nominal AT pixels
+/// and typical prediction.
+fn generic_region(samples: &[u8], width: usize, stride: usize) -> Vec<u8> {
+    let mut contexts: Vec<Context> = vec![0; 1 << 16];
+    let mut mq = MqEncoder::new();
+    let sltp = SLTP.iter().enumerate().fold(0usize, |cx, (k, v)| cx | usize::from(*v) << k);
+    // The two rows above the current one and the current one, as JBIG2 pixels (1 black), padded.
+    let blank = vec![0u8; width + 2 * PAD];
+    let (mut above2, mut above1) = (blank.clone(), blank.clone());
+    let mut row = blank;
+    let mut ltp = false;
+    for packed in samples.chunks_exact(stride) {
+        for (x, pixel) in row.iter_mut().skip(PAD).take(width).enumerate() {
+            let sample = packed.get(x / 8).is_some_and(|b| b & (0x80 >> (x % 8)) != 0);
+            *pixel = u8::from(!sample);
+        }
+        // Typical prediction (6.2.5.5): a row the same as the one above is coded as one decision.
+        let typical = row == above1;
+        if let Some(cx) = contexts.get_mut(sltp) {
+            mq.encode(cx, typical != ltp);
+        }
+        ltp = typical;
+        if !typical {
+            for x in 0..width {
+                let at = |dx: i32, dy: i32| {
+                    let line = match dy {
+                        0 => &row,
+                        -1 => &above1,
+                        _ => &above2,
+                    };
+                    let i = (PAD + x).checked_add_signed(dx as isize);
+                    i.and_then(|i| line.get(i)).copied().unwrap_or(0)
+                };
+                let cx = TEMPLATE.iter().enumerate().fold(0usize, |cx, (k, (dx, dy))| cx | usize::from(at(*dx, *dy)) << k);
+                if let Some(state) = contexts.get_mut(cx) {
+                    mq.encode(state, row.get(PAD + x) == Some(&1));
+                }
+            }
+        }
+        std::mem::swap(&mut above2, &mut above1);
+        std::mem::swap(&mut above1, &mut row);
+    }
+    mq.finish()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The rows an independent decoder (`hayro-jbig2`) reads from `data`, as PDF samples: true
+    /// for white (a JBIG2 0).
+    fn decode(data: &[u8]) -> Vec<Vec<bool>> {
+        struct Rows(Vec<Vec<bool>>, Vec<bool>, usize);
+        impl hayro_jbig2::Decoder for Rows {
+            fn push_pixel(&mut self, black: bool) {
+                self.1.push(!black);
+            }
+            fn push_pixel_chunk(&mut self, black: bool, chunks: u32) {
+                self.1.extend(std::iter::repeat_n(!black, chunks as usize * 8));
+            }
+            fn next_line(&mut self) {
+                let mut row = std::mem::take(&mut self.1);
+                row.truncate(self.2);
+                self.0.push(row);
+            }
+        }
+        let image = hayro_jbig2::Image::new_embedded(data, None).unwrap();
+        let mut rows = Rows(Vec::new(), Vec::new(), image.width() as usize);
+        image.decode(&mut rows).unwrap();
+        rows.0
+    }
+
+    /// The rows of packed samples `data`, true for a 1 bit.
+    fn unpack(data: &[u8], columns: u32, rows: u32) -> Vec<Vec<bool>> {
+        let stride = (columns as usize).div_ceil(8);
+        (0..rows as usize).map(|y| (0..columns as usize).map(|x| data[y * stride + x / 8] & (0x80 >> (x % 8)) != 0).collect()).collect()
+    }
+
+    /// Rows of `columns` samples from `runs`: alternating white and black runs one longer than
+    /// those values (never empty, even when shrinking makes them all 0), until the rows are full;
+    /// or, with `noise`, the bytes of `runs` as they are.
+    fn bitmap(columns: u32, rows: u32, runs: &[u8], noise: bool) -> Vec<u8> {
+        let stride = (columns as usize).div_ceil(8);
+        let mut data = vec![0u8; stride * rows as usize];
+        if runs.is_empty() {
+            return data;
+        }
+        if noise {
+            data.iter_mut().zip(runs.iter().cycle()).for_each(|(d, r)| *d = *r);
+            return data;
+        }
+        let (mut white, mut left, mut next) = (true, 1 + usize::from(runs[0]), 1);
+        for y in 0..rows as usize {
+            for x in 0..columns as usize {
+                if left == 0 {
+                    white = !white;
+                    left = 1 + usize::from(runs[next % runs.len()]);
+                    next += 1;
+                }
+                if white {
+                    data[y * stride + x / 8] |= 0x80 >> (x % 8);
+                }
+                left -= 1;
+            }
+        }
+        data
+    }
+
+    #[test]
+    fn a_page_of_text_like_marks_round_trips_and_shrinks() {
+        let (w, h) = (1700u32, 220u32);
+        let stride = (w as usize).div_ceil(8);
+        let mut data = vec![0xFF; stride * h as usize];
+        for y in (20..h as usize).step_by(40) {
+            for dy in 0..12 {
+                for x in (100..1600).step_by(9) {
+                    if (x / 9 + dy) % 5 != 0 {
+                        data[(y + dy) * stride + x / 8] &= !(0x80 >> (x % 8));
+                    }
+                }
+            }
+        }
+        let jbig2 = encode_jbig2_generic(&data, w, h).unwrap();
+        assert_eq!(decode(&jbig2), unpack(&data, w, h));
+        let g4 = crate::encode_g4(&data, w, h).unwrap();
+        assert!(jbig2.len() < g4.len(), "JBIG2 {} bytes, Group 4 {}", jbig2.len(), g4.len());
+    }
+
+    #[test]
+    fn edges_padding_and_typical_rows_round_trip() {
+        // 3 columns: the last 5 bits of each byte pad the row; set them to anything.
+        let data = [0b1010_1111, 0b0101_0000, 0b1110_1010, 0xAB, 0xCD];
+        assert_eq!(decode(&encode_jbig2_generic(&data, 3, 3).unwrap()), [[true, false, true], [false, true, false], [true, true, true]]);
+        for (w, h, fill) in [(1, 1, 0x00), (1, 1, 0xFF), (13, 9, 0x00), (13, 9, 0xFF), (64, 40, 0x5A)] {
+            let data = vec![fill; (w as usize).div_ceil(8) * h as usize];
+            assert_eq!(decode(&encode_jbig2_generic(&data, w, h).unwrap()), unpack(&data, w, h), "{w} × {h} of {fill:#04x}");
+        }
+    }
+
+    /// Packed samples from JBIG2 pixels (1 black): a 0 sample for each 1.
+    fn samples(pixels: &[Vec<u8>]) -> Vec<u8> {
+        let width = pixels.first().map_or(0, Vec::len);
+        let stride = width.div_ceil(8);
+        let mut data = vec![0xFF; stride * pixels.len()];
+        for (y, row) in pixels.iter().enumerate() {
+            for (x, p) in row.iter().enumerate() {
+                if *p == 1 {
+                    data[y * stride + x / 8] &= !(0x80 >> (x % 8));
+                }
+            }
+        }
+        data
+    }
+
+    /// A row the same as the one above is typical (6.2.5.5): one decision, not a row of pixels.
+    #[test]
+    fn a_repeated_row_is_one_decision() {
+        let row: Vec<u8> = (0..800u32).map(|x| u8::from((x * 7919 + x / 3) % 5 < 2)).collect();
+        let pixels = vec![row; 1000];
+        let data = samples(&pixels);
+        crate::mq::DECISIONS.with(|n| n.set(0));
+        let jbig2 = encode_jbig2_generic(&data, 800, 1000).unwrap();
+        // The first row's 800 pixels, and one typical-row decision for each of the 1000 rows.
+        assert_eq!(crate::mq::DECISIONS.with(|n| n.get()), 800 + 1000);
+        assert_eq!(decode(&jbig2), unpack(&data, 800, 1000));
+    }
+
+    /// SLTP is coded in the context Figure 8 shows, which ordinary pixels can share: an image
+    /// tiled with that very neighbourhood decodes only if both coders use the same context.
+    #[test]
+    fn the_typical_row_flag_shares_figure_8s_context() {
+        // Figure 8, around a pixel at x = 4 of an 8-column tile: two rows up x = 2..6, one row up
+        // x = 1..7, the pixel's own row x = 0..3.
+        let tile = [[0, 0, 1, 0, 0, 1, 1, 0], [0, 0, 1, 1, 0, 0, 1, 0], [0, 1, 0, 1, 1, 0, 0, 0]];
+        let pixels: Vec<Vec<u8>> = (0..90).map(|y| (0..400).map(|x| tile[y % 3][x % 8]).collect()).collect();
+        let data = samples(&pixels);
+        assert_eq!(decode(&encode_jbig2_generic(&data, 400, 90).unwrap()), unpack(&data, 400, 90));
+    }
+
+    #[test]
+    fn what_it_cannot_encode_is_an_error() {
+        assert!(matches!(encode_jbig2_generic(&[0; 8], 0, 1), Err(FilterError::Unsupported(_))));
+        assert!(matches!(encode_jbig2_generic(&[0; 8], 8, 0), Err(FilterError::Unsupported(_))));
+        assert!(matches!(encode_jbig2_generic(&[0; 8], MAX_JBIG2_COLUMNS + 1, 1), Err(FilterError::Unsupported(_))));
+        assert!(matches!(encode_jbig2_generic(&[0; 3], 16, 2), Err(FilterError::Corrupt { .. })), "two rows of 16 need 4 bytes");
+        assert!(matches!(encode_jbig2_generic(&[], 1, u32::MAX), Err(FilterError::Corrupt { .. })));
+    }
+
+    proptest::proptest! {
+        /// Any bitmap, of noise or of runs, decodes to its own bits through an independent decoder.
+        #[test]
+        fn bitmaps_round_trip(
+            columns in 1u32..300,
+            rows in 1u32..24,
+            runs in proptest::collection::vec(0u8..=255, 1..48),
+            noise in proptest::bool::ANY,
+        ) {
+            let data = bitmap(columns, rows, &runs, noise);
+            let jbig2 = encode_jbig2_generic(&data, columns, rows).unwrap();
+            proptest::prop_assert_eq!(decode(&jbig2), unpack(&data, columns, rows));
+        }
+
+        /// Whatever it is given, it returns.
+        #[test]
+        fn any_input_returns(data in proptest::collection::vec(0u8..=255, 0..600), columns in 0u32..5000, rows in 0u32..80) {
+            let _ = encode_jbig2_generic(&data, columns, rows);
+        }
+    }
+}
diff --git a/crates/filters/src/lib.rs b/crates/filters/src/lib.rs
index b9461435eb..da675a024b 100644
--- a/crates/filters/src/lib.rs
+++ b/crates/filters/src/lib.rs
@@ -18,13 +18,16 @@ mod ascii85;
 mod asciihex;
 mod ccitt;
 mod flate;
+mod jbig2;
 mod lzw;
+mod mq;
 mod predictor;
 mod runlength;
 
 use std::borrow::Cow;
 
 pub use ccitt::{MAX_G4_COLUMNS, encode_g4};
+pub use jbig2::{MAX_JBIG2_COLUMNS, encode_jbig2_generic};
 
 /// A PDF stream filter, identified by its `/Filter` name.
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
diff --git a/crates/filters/src/mq.rs b/crates/filters/src/mq.rs
new file mode 100644
index 0000000000..04dda2bd9a
--- /dev/null
+++ b/crates/filters/src/mq.rs
@@ -0,0 +1,209 @@
+//! The MQ arithmetic encoder of JBIG2 (ITU-T T.88 | ISO/IEC 14492, Annex E), written from the
+//! procedures in its Figures E.2–E.12 and the probability estimates of Table E.1.
+
+/// Table E.1: for each index, the LPS probability estimate Qe, the next index after an MPS and
+/// after an LPS renormalisation, and whether an LPS switches the MPS sense.
+const STATES: [(u32, u8, u8, bool); 47] = [
+    (0x5601, 1, 1, true),
+    (0x3401, 2, 6, false),
+    (0x1801, 3, 9, false),
+    (0x0AC1, 4, 12, false),
+    (0x0521, 5, 29, false),
+    (0x0221, 38, 33, false),
+    (0x5601, 7, 6, true),
+    (0x5401, 8, 14, false),
+    (0x4801, 9, 14, false),
+    (0x3801, 10, 14, false),
+    (0x3001, 11, 17, false),
+    (0x2401, 12, 18, false),
+    (0x1C01, 13, 20, false),
+    (0x1601, 29, 21, false),
+    (0x5601, 15, 14, true),
+    (0x5401, 16, 14, false),
+    (0x5101, 17, 15, false),
+    (0x4801, 18, 16, false),
+    (0x3801, 19, 17, false),
+    (0x3401, 20, 18, false),
+    (0x3001, 21, 19, false),
+    (0x2801, 22, 19, false),
+    (0x2401, 23, 20, false),
+    (0x2201, 24, 21, false),
+    (0x1C01, 25, 22, false),
+    (0x1801, 26, 23, false),
+    (0x1601, 27, 24, false),
+    (0x1401, 28, 25, false),
+    (0x1201, 29, 26, false),
+    (0x1101, 30, 27, false),
+    (0x0AC1, 31, 28, false),
+    (0x09C1, 32, 29, false),
+    (0x08A1, 33, 30, false),
+    (0x0521, 34, 31, false),
+    (0x0441, 35, 32, false),
+    (0x02A1, 36, 33, false),
+    (0x0221, 37, 34, false),
+    (0x0141, 38, 35, false),
+    (0x0111, 39, 36, false),
+    (0x0085, 40, 37, false),
+    (0x0049, 41, 38, false),
+    (0x0025, 42, 39, false),
+    (0x0015, 43, 40, false),
+    (0x0009, 44, 41, false),
+    (0x0005, 45, 42, false),
+    (0x0001, 45, 43, false),
+    (0x5601, 46, 46, false),
+];
+
+#[cfg(test)]
+thread_local! {
+    /// Decisions coded on this thread.
+    pub(crate) static DECISIONS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+/// A context's adaptive state: the index into [`STATES`] (low 7 bits) and the MPS sense (bit 7).
+/// 0, the initial value, is index 0 with MPS 0 (E.2.8).
+pub(crate) type Context = u8;
+
+/// The encoder's registers (E.2.1) and the bytes written so far.
+pub(crate) struct MqEncoder {
+    a: u32,
+    c: u32,
+    ct: u32,
+    /// The output, after the byte before the first one (B at INITENC), which is 0x00 and is
+    /// dropped by [`MqEncoder::finish`]: a carry can't reach it before the first byte is out.
+    out: Vec<u8>,
+}
+
+impl MqEncoder {
+    /// INITENC (Figure E.10). The byte before the first is 0x00, not 0xFF, so CT starts at 12.
+    pub(crate) fn new() -> Self {
+        MqEncoder { a: 0x8000, c: 0, ct: 12, out: vec![0] }
+    }
+
+    /// The byte B, the last one written (or the one before the first).
+    fn b(&self) -> u8 {
+        self.out.last().copied().unwrap_or(0)
+    }
+
+    /// ENCODE (Figures E.3–E.7): code decision `d` in context `cx`, updating its state.
+    pub(crate) fn encode(&mut self, cx: &mut Context, d: bool) {
+        #[cfg(test)]
+        DECISIONS.with(|n| n.set(n.get() + 1));
+        let (index, mps) = (usize::from(*cx & 0x7F), *cx >> 7 == 1);
+        let Some(&(qe, nmps, nlps, switch)) = STATES.get(index) else { return };
+        self.a -= qe;
+        if d == mps {
+            // CODEMPS.
+            if self.a & 0x8000 != 0 {
+                self.c += qe;
+                return;
+            }
+            if self.a < qe {
+                self.a = qe;
+            } else {
+                self.c += qe;
+            }
+            *cx = nmps | (*cx & 0x80);
+        } else {
+            // CODELPS.
+            if self.a < qe {
+                self.c += qe;
+            } else {
+                self.a = qe;
+            }
+            let mps = mps != switch;
+            *cx = nlps | (u8::from(mps) << 7);
+        }
+        self.renorm();
+    }
+
+    /// RENORME (Figure E.8).
+    fn renorm(&mut self) {
+        loop {
+            self.a <<= 1;
+            self.c <<= 1;
+            self.ct -= 1;
+            if self.ct == 0 {
+                self.byte_out();
+            }
+            if self.a & 0x8000 != 0 {
+                break;
+            }
+        }
+    }
+
+    /// BYTEOUT (Figure E.9), with bit stuffing after 0xFF and carry into the byte before.
+    fn byte_out(&mut self) {
+        if self.b() == 0xFF {
+            self.stuffed();
+        } else if self.c < 0x800_0000 {
+            self.plain();
+        } else {
+            let b = self.b().wrapping_add(1);
+            if let Some(last) = self.out.last_mut() {
+                *last = b;
+            }
+            if b == 0xFF {
+                self.c &= 0x7FF_FFFF;
+                self.stuffed();
+            } else {
+                self.plain();
+            }
+        }
+    }
+
+    fn plain(&mut self) {
+        self.out.push(((self.c >> 19) & 0xFF) as u8);
+        self.c &= 0x7_FFFF;
+        self.ct = 8;
+    }
+
+    fn stuffed(&mut self) {
+        self.out.push(((self.c >> 20) & 0xFF) as u8);
+        self.c &= 0xF_FFFF;
+        self.ct = 7;
+    }
+
+    /// FLUSH (Figures E.11 and E.12): the final bytes, then the 0xFF 0xAC marker.
+    pub(crate) fn finish(mut self) -> Vec<u8> {
+        let top = self.c + self.a;
+        self.c |= 0xFFFF;
+        if self.c >= top {
+            self.c -= 0x8000;
+        }
+        self.c <<= self.ct;
+        self.byte_out();
+        self.c <<= self.ct;
+        self.byte_out();
+        if self.b() != 0xFF {
+            self.out.push(0xFF);
+        }
+        self.out.push(0xAC);
+        self.out.split_off(1)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Annex H.2's test sequence: 256 decisions in one context give these 30 bytes.
+    #[test]
+    fn the_annex_h_test_sequence_encodes_to_its_bytes() {
+        let decisions = [
+            0x00, 0x02, 0x00, 0x51, 0x00, 0x00, 0x00, 0xC0, 0x03, 0x52, 0x87, 0x2A, 0xAA, 0xAA, 0xAA, 0xAA, 0x82, 0xC0, 0x20, 0x00, 0xFC, 0xD7, 0x9E,
+            0xF6, 0xBF, 0x7F, 0xED, 0x90, 0x4F, 0x46, 0xA3, 0xBF,
+        ];
+        let mut mq = MqEncoder::new();
+        let mut cx = 0;
+        for byte in decisions {
+            for bit in (0..8).rev() {
+                mq.encode(&mut cx, byte >> bit & 1 == 1);
+            }
+        }
+        let expected = [
+            0x84, 0xC7, 0x3B, 0xFC, 0xE1, 0xA1, 0x43, 0x04, 0x02, 0x20, 0x00, 0x00, 0x41, 0x0D, 0xBB, 0x86, 0xF4, 0x31, 0x7F, 0xFF, 0x88, 0xFF, 0x37,
+            0x47, 0x1A, 0xDB, 0x6A, 0xDF, 0xFF, 0xAC,
+        ];
+        assert_eq!(mq.finish(), expected);
+    }
+}
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index c3281f00c4..5162cdbbaf 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -34,13 +34,15 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   alone, since readers differ on which wins. Samples are read with `/DecodeParms` given by
   reference too, the numbers inside included (`Document::with_direct_parms`), here and below:
   without them a predictor's tag bytes would shift every row of an image written back.
-- **Monochrome images** (`Settings::mono`, CCITT Group 4 by default): a 1-bit image with one
-  colour component (grey, indexed, a separation) or an image mask, stored with no filter or with
-  general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
-  that is smaller as stored. It is lossless: the samples decode to the same bits, so the colour
+- **Monochrome images** (`Settings::mono`, CCITT Group 4 by default, or JBIG2): a 1-bit image
+  with one colour component (grey, indexed, a separation) or an image mask, stored with no filter
+  or with general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`)
+  or lossless JBIG2 (`encode_jbig2_generic`; a document below PDF 1.4 gets `/Version /1.4` in
+  its catalog) when that is smaller as stored. On 300 dpi text JBIG2 is about a third smaller
+  than Group 4. It is lossless: the samples decode to the same bits, so the colour
   space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
-  JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
+  JBIG2 symbol coding (lossy or lossless), monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
   than 32,767 samples. Redaction doesn't decode Group 4 yet: a mark over part of an image stored
   this way removes the whole image (nothing leaks). Nor does anything that exports an image:
   Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 57e583a078..8b2f30a8f0 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -562,15 +562,17 @@ fn one_component(doc: &Document, cs: &Object) -> bool {
     }
 }
 
-/// A black-and-white image (one bit per pixel, or an image mask) stored again as CCITT Group 4,
-/// if `compression` asks for that and the result is smaller as stored. Only images whose samples
+/// A black-and-white image (one bit per pixel, or an image mask) stored again as `compression`
+/// asks (CCITT Group 4 or JBIG2), if the result is smaller as stored. Only images whose samples
 /// PdfCraft decodes (no filter, or general-purpose filters: image codecs don't decode here)
 /// qualify. The samples decode to the same bits, so the colour space, decode array and masks stay
 /// as they are.
 fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stream> {
-    if compression != MonoCompression::CcittG4 {
-        return None;
-    }
+    let widest = match compression {
+        MonoCompression::CcittG4 => pdfcraft_filters::MAX_G4_COLUMNS,
+        MonoCompression::Jbig2 => pdfcraft_filters::MAX_JBIG2_COLUMNS,
+        MonoCompression::Retain => return None,
+    };
     let d = &s.dict;
     let bits = d.int(b"BitsPerComponent");
     let qualifies = if matches!(d.get(b"ImageMask"), Some(Object::Bool(true))) {
@@ -582,24 +584,31 @@ fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stre
         return None;
     }
     let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
-    if w == 0 || h == 0 || w > pdfcraft_filters::MAX_G4_COLUMNS || u64::from(w) * u64::from(h) > MAX_PIXELS {
+    if w == 0 || h == 0 || w > widest || u64::from(w) * u64::from(h) > MAX_PIXELS {
         return None;
     }
     // Through its parameters given by reference too, as `pixels` reads, and no further than its
     // rows can need.
     let bytes = usize::try_from(w).ok()?.div_ceil(8).checked_mul(usize::try_from(h).ok()?)?;
-    let g4 = pdfcraft_filters::encode_g4(&doc.with_direct_parms(s).decoded_within(allowance(bytes, h)?).ok()?, w, h).ok()?;
+    let samples = doc.with_direct_parms(s).decoded_within(allowance(bytes, h)?).ok()?;
     let mut new = d.clone();
     for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
         new.remove(k);
     }
-    let mut parms = Dict::new();
-    parms.set(b"K".to_vec(), Object::Int(-1));
-    parms.set(b"Columns".to_vec(), Object::Int(i64::from(w)));
-    parms.set(b"Rows".to_vec(), Object::Int(i64::from(h)));
-    new.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
-    new.set(b"DecodeParms".to_vec(), Object::Dict(parms));
-    let new = Stream::from_raw(new, g4);
+    let data = if compression == MonoCompression::Jbig2 {
+        // One embedded JBIG2 stream with its own page; no /JBIG2Globals.
+        new.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+        pdfcraft_filters::encode_jbig2_generic(&samples, w, h).ok()?
+    } else {
+        let mut parms = Dict::new();
+        parms.set(b"K".to_vec(), Object::Int(-1));
+        parms.set(b"Columns".to_vec(), Object::Int(i64::from(w)));
+        parms.set(b"Rows".to_vec(), Object::Int(i64::from(h)));
+        new.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+        new.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        pdfcraft_filters::encode_g4(&samples, w, h).ok()?
+    };
+    let new = Stream::from_raw(new, data);
     // Smaller as stored, counting the larger dictionary: a tiny image can lose by it.
     (crate::stored_len(&new)? < crate::stored_len(s)?).then_some(new)
 }
@@ -623,6 +632,7 @@ pub(crate) fn run(
     let mut refs: Vec<(ObjRef, f64)> = ppi.into_iter().filter(|(r, _)| !masks.contains(r)).collect();
     refs.sort_by_key(|(r, _)| r.num);
     let total = refs.len();
+    let mut jbig2 = false;
     for (done, (r, ppi)) in refs.into_iter().enumerate() {
         if !progress(Stage::Images { done, total }) {
             return Err(OptimizeError::Cancelled);
@@ -634,6 +644,7 @@ pub(crate) fn run(
             report.image_bytes_before += s.raw.len();
             report.image_bytes_after += new.raw.len();
             report.images_recompressed += 1;
+            jbig2 |= new.dict.name(b"Filter") == Some(b"JBIG2Decode");
             doc.set(r, Object::Stream(new));
             continue;
         }
@@ -656,6 +667,22 @@ pub(crate) fn run(
     if !progress(Stage::Images { done: total, total }) {
         return Err(OptimizeError::Cancelled);
     }
+    if jbig2 {
+        at_least_pdf_1_4(doc)?;
+    }
+    Ok(())
+}
+
+/// JBIG2Decode is PDF 1.4: a document whose header says less, and whose catalog doesn't say 1.4
+/// or more already, gets `/Version /1.4` in its catalog (ISO 32000-2 §7.7.2). A full save with
+/// object streams writes a 1.5 header anyway.
+fn at_least_pdf_1_4(doc: &mut Document) -> Result<(), OptimizeError> {
+    let below = |v: &[u8]| v.len() < 3 || v < &b"1.4"[..];
+    let Some(root) = doc.root() else { return Ok(()) };
+    let catalog = doc.get(root).as_dict().and_then(|c| c.name(b"Version").map(<[u8]>::to_vec));
+    if below(doc.version().as_bytes()) && catalog.as_deref().is_none_or(below) {
+        doc.update_dict(root, |c| c.set(b"Version".to_vec(), Object::name("1.4")))?;
+    }
     Ok(())
 }
 
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index f4f7baf988..09c487989e 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -10,8 +10,8 @@
 //!   A new image replaces the old one only if it is smaller. Images PdfCraft can't decode
 //!   faithfully (CMYK and other colour spaces, masks, decode arrays other than the default,
 //!   JPEG 2000, JBIG2, CCITT, other than 8 bits, JPEGs whose Adobe marker and `/ColorTransform`
-//!   disagree) are left alone. Black-and-white (1-bit) images are stored again as CCITT Group 4,
-//!   losslessly, when that is smaller.
+//!   disagree) are left alone. Black-and-white (1-bit) images are stored again as CCITT Group 4
+//!   or JBIG2, losslessly, when that is smaller.
 //! - **Discard objects:** page thumbnails, alternate images, document tags (structure tree),
 //!   print settings.
 //! - **Clean up:** drop images and forms that pages list but never draw (such as a deleted
@@ -124,6 +124,9 @@ pub enum Compression {
 pub enum MonoCompression {
     /// CCITT Group 4 (lossless), when smaller than the image as it is.
     CcittG4,
+    /// JBIG2, lossless (a generic region), when smaller than the image as it is. JBIG2Decode is
+    /// PDF 1.4: an older document gets `/Version /1.4` in its catalog.
+    Jbig2,
     /// Keep each image's own compression.
     Retain,
 }
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 3fce1dadba..aaebc5f4f5 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -588,6 +588,67 @@ fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
     assert!(stream(&doc, eight_bit).dict.int(b"Width").is_some_and(|nw| nw < i64::from(w)), "8-bit hex text in lines: resampled");
 }
 
+/// The images of a document that are images, by object number.
+fn image_refs(doc: &Document) -> Vec<ObjRef> {
+    doc.object_numbers()
+        .into_iter()
+        .map(|num| ObjRef { num, generation: doc.generation(num) })
+        .filter(|r| matches!(&*doc.get(*r), Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image")))
+        .collect()
+}
+
+/// Black-and-white images as lossless JBIG2: the page looks the same to the pixel (so
+/// JBIG2Decode gives black as 0, as the encoder assumes), and scan-like text comes out smaller
+/// than as Group 4. JBIG2Decode is PDF 1.4, so a PDF 1.3 document gets `/Version /1.4` in its
+/// catalog.
+#[test]
+fn black_and_white_images_become_jbig2() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200, 480);
+    let text = bilevel(w, h, false);
+    let gray = mono_image(&mut doc, w, h, &text, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let decode = Object::Array(vec![1.into(), 0.into()]);
+    let mask = mono_image(&mut doc, w, h, &text, None, &[("ImageMask", Object::Bool(true)), ("Decode", decode.clone())]);
+    let indexed_cs = Object::Array(vec![
+        Object::name("Indexed"),
+        Object::name("DeviceRGB"),
+        1.into(),
+        Object::String(pdfcraft_cos::PdfString::literal(vec![0xC0, 0x10, 0x10, 0xF8, 0xF0, 0xE0])),
+    ]);
+    let indexed = mono_image(&mut doc, w, h, &text, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", indexed_cs.clone())]);
+    page(
+        &mut doc,
+        &[("G", gray), ("M", mask), ("I", indexed)],
+        "q 300 0 0 120 20 660 cm /G Do Q q 0 0.4 0.8 rg 300 0 0 120 320 660 cm /M Do Q q 300 0 0 120 20 520 cm /I Do Q",
+    );
+    // The same document, as PDF 1.3.
+    let mut bytes = write_full(&doc, &SaveOptions { object_streams: false, ..SaveOptions::default() }).unwrap();
+    bytes[..8].copy_from_slice(b"%PDF-1.3");
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert_eq!(doc.version(), "1.3");
+    let before = render(&doc);
+
+    let mut g4 = doc.clone();
+    let as_g4 = optimize(&mut g4, &Settings::default()).unwrap();
+    let mut jbig2 = doc.clone();
+    let r = optimize(&mut jbig2, &Settings { mono: MonoCompression::Jbig2, ..Settings::default() }).unwrap();
+    assert_eq!(r.images_recompressed, 3);
+    assert!(r.image_bytes_after < as_g4.image_bytes_after, "JBIG2 {} bytes, Group 4 {}", r.image_bytes_after, as_g4.image_bytes_after);
+    let images: Vec<Stream> = image_refs(&jbig2).into_iter().map(|i| stream(&jbig2, i)).collect();
+    assert_eq!(images.len(), 3);
+    for s in &images {
+        assert_eq!((s.dict.name(b"Filter"), s.dict.contains(b"DecodeParms")), (Some(&b"JBIG2Decode"[..]), false));
+    }
+    assert!(images.iter().any(|s| s.dict.get(b"Decode") == Some(&decode)), "the decode array stays");
+    let indexed_kept =
+        |s: &Stream| s.dict.get(b"ColorSpace").and_then(Object::as_array).and_then(|a| a.first()).and_then(Object::as_name) == Some(b"Indexed");
+    assert!(images.iter().any(indexed_kept), "the colour space stays");
+    let catalog = jbig2.root().and_then(|r| jbig2.get(r).as_dict().cloned()).unwrap();
+    assert_eq!(catalog.name(b"Version"), Some(&b"1.4"[..]));
+    assert!(g4.root().and_then(|r| g4.get(r).as_dict().cloned()).is_some_and(|c| !c.contains(b"Version")), "Group 4 is PDF 1.0");
+    assert!(render(&jbig2) == before, "the page looks the same");
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 4f43912938..65432242f3 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -599,6 +599,7 @@
 	Grayscale Images	الصور الرمادية
 	Monochrome Images	الصور أحادية اللون
 	CCITT Group 4	CCITT المجموعة 4
+	JBIG2 (lossless)	JBIG2 (بدون فقدان)
 	Bicubic downsampling to	تقليل العينات بطريقة Bicubic إلى
 	for images above	للصور التي تتجاوز
 	Compression	الضغط
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 9464683b36..7c3d6ca605 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -261,6 +261,7 @@
 	Grayscale Images	Изображения в сива скала
 	Monochrome Images	Монохромни изображения
 	CCITT Group 4	CCITT група 4
+	JBIG2 (lossless)	JBIG2 (без загуби)
 	Bicubic downsampling to	Бикубично понижаване на резолюцията до
 	for images above	за изображения над
 	Compression	Компресия
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index c7d351ac13..0b6b545f2d 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -562,6 +562,7 @@
 	Grayscale Images	Imatges en escala de grisos
 	Monochrome Images	Imatges monocromes
 	CCITT Group 4	CCITT grup 4
+	JBIG2 (lossless)	JBIG2 (sense pèrdua)
 	Bicubic downsampling to	Reducció bicúbica de resolució a
 	for images above	per a imatges de més de
 	Compression	Compressió
diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index c5fa4b6967..0b9135240a 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -569,6 +569,7 @@
 	Grayscale Images	وێنە خۆڵەمێشییەکان
 	Monochrome Images	وێنە یەکڕەنگەکان
 	CCITT Group 4	CCITT گرووپی 4
+	JBIG2 (lossless)	JBIG2 (بێ لەدەستدان)
 	Bicubic downsampling to	کەمکردنەوەی نموونە بە شێوازی Bicubic بۆ
 	for images above	بۆ ئەو وێنانەی سەرووی
 	Compression	پەستاندن
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 342f762378..2b50b6a948 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -683,6 +683,7 @@ key	Space	Mezerník
 	Grayscale Images	Obrázky ve stupních šedi
 	Monochrome Images	Monochromatické obrázky
 	CCITT Group 4	CCITT skupina 4
+	JBIG2 (lossless)	JBIG2 (bezeztrátová)
 	Bicubic downsampling to	Bikubické převzorkování na
 	for images above	u obrázků nad
 	Compression	Komprese
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 71163b6b96..69d8030d3d 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -572,6 +572,7 @@
 	Grayscale Images	Graustufenbilder
 	Monochrome Images	Monochrome Bilder
 	CCITT Group 4	CCITT Gruppe 4
+	JBIG2 (lossless)	JBIG2 (verlustfrei)
 	Bicubic downsampling to	Bikubische Neuberechnung auf
 	for images above	für Bilder über
 	Compression	Komprimierung
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 13f762d6ca..3599744eb8 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -1908,6 +1908,7 @@
 	Grayscale Images	Εικόνες σε κλίμακα του γκρι
 	Monochrome Images	Μονόχρωμες εικόνες
 	CCITT Group 4	CCITT Ομάδα 4
+	JBIG2 (lossless)	JBIG2 (χωρίς απώλειες)
 	Bicubic downsampling to	Δικυβική μείωση ανάλυσης σε
 	for images above	για εικόνες πάνω από
 	ZIP	ZIP
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 0457264377..1665279bce 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -595,6 +595,7 @@
 	Grayscale Images	Imágenes en escala de grises
 	Monochrome Images	Imágenes monocromas
 	CCITT Group 4	CCITT grupo 4
+	JBIG2 (lossless)	JBIG2 (sin pérdida)
 	Bicubic downsampling to	Reducción de resolución bicúbica a
 	for images above	para imágenes por encima de
 	Compression	Compresión
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index 5bd26bff11..94e7fe0119 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -562,6 +562,7 @@
 	Grayscale Images	Harmaasävykuvat
 	Monochrome Images	Mustavalkokuvat
 	CCITT Group 4	CCITT ryhmä 4
+	JBIG2 (lossless)	JBIG2 (häviötön)
 	Bicubic downsampling to	Bikuubinen alinäytteistys tarkkuuteen
 	for images above	kuville, joiden tarkkuus yli
 	Compression	Pakkaus
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index b5434915af..7e6ca64aef 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -572,6 +572,7 @@
 	Grayscale Images	Images en niveaux de gris
 	Monochrome Images	Images monochromes
 	CCITT Group 4	CCITT groupe 4
+	JBIG2 (lossless)	JBIG2 (sans perte)
 	Bicubic downsampling to	Sous-échantillonnage bicubique à
 	for images above	pour les images au-dessus de
 	Compression	Compression
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index 30aa915af7..fadf4fbade 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -546,6 +546,7 @@
 	Grayscale Images	ग्रेस्केल छवियाँ
 	Monochrome Images	मोनोक्रोम छवियाँ
 	CCITT Group 4	CCITT समूह 4
+	JBIG2 (lossless)	JBIG2 (हानिरहित)
 	Bicubic downsampling to	बाइक्यूबिक डाउनसैंपलिंग तक
 	for images above	इससे बड़ी छवियों के लिए
 	Compression	संपीड़न
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index b7e494ab0c..d16aa23dc9 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -570,6 +570,7 @@
 	Grayscale Images	Szürkeárnyalatos képek
 	Monochrome Images	Monokróm képek
 	CCITT Group 4	CCITT 4. csoport
+	JBIG2 (lossless)	JBIG2 (veszteségmentes)
 	Bicubic downsampling to	Kettős köbös újramintázás erre
 	for images above	az ennél nagyobb képeknél
 	Compression	Tömörítés
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index c87527fee3..1783118fff 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -2057,6 +2057,7 @@ comment menu	Edit	Edit
 	Grayscale Images	Gambar Skala Abu-abu
 	Monochrome Images	Gambar Monokrom
 	CCITT Group 4	CCITT Grup 4
+	JBIG2 (lossless)	JBIG2 (lossless)
 	Green	Hijau
 	Green on black	Hijau di atas hitam
 	H / Space (hold)	H / Space (tahan)
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 62b012f091..95b83f1a3a 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -596,6 +596,7 @@
 	Grayscale Images	Immagini in scala di grigi
 	Monochrome Images	Immagini monocromatiche
 	CCITT Group 4	CCITT gruppo 4
+	JBIG2 (lossless)	JBIG2 (senza perdita)
 	Bicubic downsampling to	Sottocampionamento bicubico a
 	for images above	per immagini oltre
 	Compression	Compressione
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index beb3002eb6..92b78ef14c 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -599,6 +599,7 @@
 	Grayscale Images	グレースケール画像
 	Monochrome Images	白黒画像
 	CCITT Group 4	CCITT グループ 4
+	JBIG2 (lossless)	JBIG2（可逆）
 	Bicubic downsampling to	バイキュービック法でダウンサンプル:
 	for images above	対象画像の解像度:
 	Compression	圧縮
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 08a390dade..f5147c8b48 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -559,6 +559,7 @@
 	Grayscale Images	Сұр реңкті кескіндер
 	Monochrome Images	Монохромды кескіндер
 	CCITT Group 4	CCITT 4-топ
+	JBIG2 (lossless)	JBIG2 (шығынсыз)
 	Bicubic downsampling to	Бикубтық төмендету
 	for images above	мұнан асатын кескіндер үшін
 	Compression	Сығымдау
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 1b6dcc99ee..3807c0a387 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -546,6 +546,7 @@
 	Grayscale Images	회색조 이미지
 	Monochrome Images	흑백 이미지
 	CCITT Group 4	CCITT 그룹 4
+	JBIG2 (lossless)	JBIG2(무손실)
 	Bicubic downsampling to	다음 값으로 바이큐빅 다운샘플링
 	for images above	다음 값을 초과하는 이미지에 적용
 	Compression	압축
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index 168fccb36e..270464b875 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -567,6 +567,7 @@
 	Grayscale Images	ຮູບພາບລະດັບສີເທົາ
 	Monochrome Images	ຮູບພາບຂາວດຳ
 	CCITT Group 4	CCITT ກຸ່ມ 4
+	JBIG2 (lossless)	JBIG2 (ບໍ່ສູນເສຍ)
 	Bicubic downsampling to	ຫຼຸດຄວາມລະອຽດແບບ Bicubic ລົງເປັນ:
 	for images above	ສຳລັບຮູບພາບທີ່ເກີນ:
 	Compression	ການບີບອັດ
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 33ffe03418..75ed169130 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -2125,6 +2125,7 @@ comment menu	Edit	Redaguoti
 	Grayscale Images	Pilkų atspalvių paveikslėliai
 	Monochrome Images	Vienspalviai paveikslėliai
 	CCITT Group 4	CCITT 4 grupė
+	JBIG2 (lossless)	JBIG2 (be nuostolių)
 	Green	Žalia
 	Green on black	Žalia juodame fone
 	H / Space (hold)	H / tarpo klavišas (laikyti)
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index f3f37a1afa..bceb1d1e85 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -2062,6 +2062,7 @@
 	Grayscale Images	Gråtonebilder
 	Monochrome Images	Svart-hvitt-bilder
 	CCITT Group 4	CCITT gruppe 4
+	JBIG2 (lossless)	JBIG2 (tapsfri)
 	Green	Grønn
 	Green on black	Grønn på svart
 	H / Space (hold)	H / Mellomrom (hold)
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 0dd3604189..480c584c19 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -594,6 +594,7 @@
 	Grayscale Images	Obrazy w skali szarości
 	Monochrome Images	Obrazy monochromatyczne
 	CCITT Group 4	CCITT grupa 4
+	JBIG2 (lossless)	JBIG2 (bezstratna)
 	Bicubic downsampling to	Zmniejsz rozdzielczość metodą dwusześcienną do
 	for images above	dla obrazów powyżej
 	Compression	Kompresja
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 6ab4ec9d85..da198aa840 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -218,6 +218,7 @@
 	Grayscale Images	Imagens em escala de cinza
 	Monochrome Images	Imagens monocromáticas
 	CCITT Group 4	CCITT grupo 4
+	JBIG2 (lossless)	JBIG2 (sem perdas)
 	Bicubic downsampling to	Redução bicúbica de amostragem para
 	for images above	para imagens acima de
 	Compression	Compactação
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index 0b0050a4f1..e371d5746b 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -2068,6 +2068,7 @@ comment menu	Edit	Editare
 	Grayscale Images	Imagini în tonuri de gri
 	Monochrome Images	Imagini monocrome
 	CCITT Group 4	CCITT grupa 4
+	JBIG2 (lossless)	JBIG2 (fără pierderi)
 	Green	Verde
 	Green on black	Verde pe negru
 	H / Space (hold)	H / Spațiu (ținut apăsat)
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index f9a17709ba..43314090b4 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -592,6 +592,7 @@
 	Grayscale Images	Изображения в оттенках серого
 	Monochrome Images	Монохромные изображения
 	CCITT Group 4	CCITT группа 4
+	JBIG2 (lossless)	JBIG2 (без потерь)
 	Bicubic downsampling to	Бикубическое уменьшение до
 	for images above	для изображений выше
 	Compression	Сжатие
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 83790b055e..0cbb9fca3d 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -893,6 +893,7 @@
 	Grayscale Images	Sivinske slike
 	Monochrome Images	Enobarvne slike
 	CCITT Group 4	CCITT skupina 4
+	JBIG2 (lossless)	JBIG2 (brez izgub)
 	Green	Zelena
 	H / Space (hold)	H / preslednica (drži)
 	HTML web page	Spletna stran HTML
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index cc899a668a..ef0d3e5719 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -882,6 +882,7 @@
 	Grayscale Images	Imazhe në nuanca gri
 	Monochrome Images	Imazhe bardhezi
 	CCITT Group 4	CCITT grupi 4
+	JBIG2 (lossless)	JBIG2 (pa humbje)
 	Green	Jeshile
 	H / Space (hold)	H / Hapësira (mbaje shtypur)
 	HTML web page	Faqe interneti HTML
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 43a2782674..a42f6947b2 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -576,6 +576,7 @@ comment menu	Edit	సవరించు
 	Grayscale Images	గ్రేస్కేల్ చిత్రాలు
 	Monochrome Images	మోనోక్రోమ్ చిత్రాలు
 	CCITT Group 4	CCITT గ్రూప్ 4
+	JBIG2 (lossless)	JBIG2 (నష్టరహితం)
 	Bicubic downsampling to	బైక్యూబిక్ డౌన్‌శాంప్లింగ్, లక్ష్యం:
 	for images above	ఈ రిజల్యూషన్ మించిన చిత్రాలకు:
 	Compression	కుదింపు
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index 4eeeb6f951..49b81aee50 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -556,6 +556,7 @@
 	Grayscale Images	รูปภาพระดับสีเทา
 	Monochrome Images	รูปภาพขาวดำ
 	CCITT Group 4	CCITT กลุ่ม 4
+	JBIG2 (lossless)	JBIG2 (ไม่สูญเสียข้อมูล)
 	Bicubic downsampling to	ลดความละเอียดแบบ Bicubic เป็น
 	for images above	สำหรับรูปภาพที่สูงกว่า
 	Compression	การบีบอัด
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index d5124513cf..42548981e8 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -557,6 +557,7 @@
 	Grayscale Images	Gri Tonlamalı Resimler
 	Monochrome Images	Tek Renkli Resimler
 	CCITT Group 4	CCITT Grup 4
+	JBIG2 (lossless)	JBIG2 (kayıpsız)
 	Bicubic downsampling to	Şu değere bikübik alt örnekleme:
 	for images above	bundan büyük resimler için:
 	Compression	Sıkıştırma
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 8051e42f82..83f25e0b36 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -597,6 +597,7 @@
 	Grayscale Images	Зображення у відтінках сірого
 	Monochrome Images	Монохромні зображення
 	CCITT Group 4	CCITT група 4
+	JBIG2 (lossless)	JBIG2 (без втрат)
 	Bicubic downsampling to	Бікубічне зниження роздільної здатності до
 	for images above	для зображень із роздільною здатністю понад
 	Compression	Стиснення
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 8703b4c8ee..9201a1feb7 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -2113,6 +2113,7 @@ comment menu	Edit	Sửa
 	Grayscale Images	Ảnh thang xám
 	Monochrome Images	Ảnh đơn sắc
 	CCITT Group 4	CCITT nhóm 4
+	JBIG2 (lossless)	JBIG2 (không mất dữ liệu)
 	Green	Xanh lá
 	Green on black	Xanh lá trên nền đen
 	H / Space (hold)	H / Space (giữ)
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index da2722c7fa..0d670e5984 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -267,6 +267,7 @@
 	Grayscale Images	灰度图像
 	Monochrome Images	单色图像
 	CCITT Group 4	CCITT 第 4 组
+	JBIG2 (lossless)	JBIG2（无损）
 	Bicubic downsampling to	双三次降采样至
 	for images above	（高于此分辨率的图像）
 	Compression	压缩
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 8f42d9da3b..11db509b86 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -223,6 +223,7 @@
 	Grayscale Images	灰階圖片
 	Monochrome Images	單色圖片
 	CCITT Group 4	CCITT 第 4 組
+	JBIG2 (lossless)	JBIG2（無損）
 	Bicubic downsampling to	雙三次降取樣至
 	for images above	（高於此解析度的圖片）
 	Compression	壓縮
diff --git a/crates/ui-egui/src/workflows/optimize_ui.rs b/crates/ui-egui/src/workflows/optimize_ui.rs
index d3a5cfd4a1..32052eb1f7 100644
--- a/crates/ui-egui/src/workflows/optimize_ui.rs
+++ b/crates/ui-egui/src/workflows/optimize_ui.rs
@@ -150,10 +150,12 @@ fn mono_row(ui: &mut egui::Ui, m: &mut MonoCompression) {
         ui.label(tl!("Compression"));
         let label = match m {
             MonoCompression::CcittG4 => tl!("CCITT Group 4"),
+            MonoCompression::Jbig2 => tl!("JBIG2 (lossless)"),
             MonoCompression::Retain => tl!("Retain existing"),
         };
         craft_ui::ComboBox::from_id_salt(("mono", "compression")).selected_text(label).show_ui(ui, |ui| {
             ui.selectable_value(m, MonoCompression::CcittG4, tl!("CCITT Group 4"));
+            ui.selectable_value(m, MonoCompression::Jbig2, tl!("JBIG2 (lossless)"));
             ui.selectable_value(m, MonoCompression::Retain, tl!("Retain existing"));
         });
     });
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 75be8e3833..872c524870 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,6 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
+> **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer can store black-and-white images as lossless JBIG2; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
@@ -256,6 +257,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-23 | minor | M11: lossless JBIG2 for black-and-white images (`pdfcraft_filters::encode_jbig2_generic`, a generic region coded with the MQ coder, written from the JBIG2 draft standard), as Monochrome Images ▸ JBIG2 (lossless) and `doc_optimize` `mono: jbig2`; about a third smaller than Group 4 on 300 dpi text. Symbol coding not yet. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 02d7219aba..be8c1b904e 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7384,8 +7384,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
-evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks), nor does anything that exports an image: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
+evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/filters/src/mq.rs::the_annex_h_test_sequence_encodes_to_its_bytes", "crates/filters/src/jbig2.rs::bitmaps_round_trip", "crates/filters/src/jbig2.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/optimize/tests/optimize.rs::black_and_white_images_become_jbig2", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "CCITT Group 4 (the default, so Reduce File Size does it too) or JBIG2, both lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. JBIG2 is a generic region (template 0, typical prediction), about a third smaller than Group 4 on 300 dpi text; a document below PDF 1.4 gets /Version 1.4. Not yet: JBIG2 symbol coding (text regions with symbol dictionaries, where JBIG2's larger gains on text come from, and its lossy mode), JBIG2Globals, monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks), nor does anything that exports an image: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From a0690037825edac730e2dba0f54b06b174eaae34 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 01:34:48 +0200
Subject: [PATCH 155/270] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20de?=
 =?UTF-8?q?codes=20JBIG2=20images?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

JBIG2 images, and JBIG2 stencil masks, were reported as "can't be exported
yet", so an image the Optimizer stores as JBIG2 would stop exporting. They
are now decoded with hayro-jbig2 (already in the tree through hayro), with
their /JBIG2Globals from a DecodeParms dictionary or array, as JBIG2Decode
gives them: black as 0 (ISO 32000-2 §7.4.7). Unreadable globals, a JBIG2
page of another width, or fewer rows than the image skip the image; rows
past its height are dropped, so the output is bounded by the checked size.

docs/pdf-spec-parity.md §7.4 no longer says there is no JBIG2 encoding.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 Cargo.lock                               |   2 +
 Cargo.toml                               |   3 +-
 ROADMAP.md                               |   2 +-
 crates/automation/src/tools.rs           |   2 +-
 crates/automation/tests/it/automation.rs |  11 ++-
 crates/create/Cargo.toml                 |   3 +
 crates/create/README.md                  |   2 +
 crates/create/src/extract.rs             | 107 +++++++++++++++++++++--
 crates/create/src/tests.rs               |  79 +++++++++++++++++
 crates/filters/README.md                 |   2 +-
 docs/pdf-spec-parity.md                  |   5 +-
 docs/roadmap.md                          |   4 +-
 parity/acrobat-features.toml             |   4 +-
 13 files changed, 209 insertions(+), 17 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 4b09072f5b..efe448b11a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4334,9 +4334,11 @@ name = "pdfcraft-create"
 version = "0.15.0"
 dependencies = [
  "encoding_rs",
+ "hayro-jbig2",
  "hayro-syntax",
  "image",
  "pdfcraft-cos",
+ "pdfcraft-filters",
  "pdfcraft-fonts",
  "pdfcraft-model",
  "pdfcraft-xfa",
diff --git a/Cargo.toml b/Cargo.toml
index b0b606c146..6dafba9eeb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -67,7 +67,8 @@ flate2 = { version = "1.1", default-features = false, features = ["rust_backend"
 weezl = "0.2"
 # CCITT Group 4 encoding (pdfcraft-filters); already in the tree through tiff.
 fax = "0.2.7"
-# Independent CCITT and JBIG2 decoders, for round-trip tests; already in the tree through hayro.
+# CCITT and JBIG2 decoders, already in the tree through hayro: independent decoders for round-trip
+# tests, and JBIG2 for Export ▸ Images.
 hayro-ccitt = "0.3"
 hayro-jbig2 = "0.3"
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 20c9f06d83..f2fa3e25a6 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,7 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
-- **2026-10-23 (M11, JBIG2):** The PDF Optimizer can store black-and-white images as lossless JBIG2 (a generic region, written from the JBIG2 draft standard and checked against its arithmetic-coder test sequence), about a third smaller than Group 4 on 300 dpi text. JBIG2 symbol coding, where its largest gains on text are, is next.
+- **2026-10-23 (M11, JBIG2):** The PDF Optimizer can store black-and-white images as lossless JBIG2 (a generic region, written from the JBIG2 draft standard and checked against its arithmetic-coder test sequence), about a third smaller than Group 4 on 300 dpi text, and Export ▸ Images reads JBIG2 images. JBIG2 symbol coding, where its largest gains on text are, is next.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 3233935a59..ffc17cb457 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1274,7 +1274,7 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("ocr.recognize")
             .with(schema(json!({}), &[])),
-        t("doc_export_all_images", "Export all images", "Write the images that pages use into a folder (`<name>_Page_<n>_Image_<k>.jpg|png`, n zero-padded to the page count's digits), each once: JPEG images unchanged, others as PNG with their soft mask as alpha. min_size skips images with fewer pixels on their shorter side. Images that can't be decoded yet (JPEG 2000, JBIG2, CCITT, separations) are listed under skipped. Includes unsaved edits.")
+        t("doc_export_all_images", "Export all images", "Write the images that pages use into a folder (`<name>_Page_<n>_Image_<k>.jpg|png`, n zero-padded to the page count's digits), each once: JPEG images unchanged, others as PNG with their soft mask as alpha. min_size skips images with fewer pixels on their shorter side. Images that can't be decoded yet (JPEG 2000, CCITT, separations) are listed under skipped. Includes unsaved edits.")
             .cmd("export.all_images")
             .with(schema(
                 json!({
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index c0efb92efd..835db4c755 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6432,7 +6432,7 @@ fn scanned_page() -> Vec<u8> {
 }
 
 /// With `mono: { compression: jbig2 }` a scan's black-and-white image is stored as lossless JBIG2,
-/// smaller than as Group 4.
+/// smaller than as Group 4, and exports as the same picture.
 #[test]
 fn doc_optimize_stores_black_and_white_images_as_jbig2() {
     let dir = workdir("optimize-jbig2");
@@ -6453,6 +6453,15 @@ fn doc_optimize_stores_black_and_white_images_as_jbig2() {
         })
         .collect();
     assert_eq!(filters, [b"JBIG2Decode".to_vec()]);
+    // Export ▸ Images gives the copy's picture back as it gives the scan's.
+    let copy = ok(&mut a, "doc_open", json!({ "path": "jbig2.pdf" }))["doc"].as_u64().unwrap();
+    let mut exported = |doc: u64, folder: &str| {
+        let r = ok(&mut a, "doc_export_all_images", json!({ "doc": doc, "folder": folder }));
+        let files = r["files"].as_array().unwrap();
+        assert_eq!(files.len(), 1, "{r}");
+        std::fs::read(files[0]["path"].as_str().unwrap()).unwrap()
+    };
+    assert_eq!(exported(copy, "from-jbig2"), exported(doc, "from-scan"));
 }
 
 /// A scan's black-and-white image is stored as CCITT Group 4 by default, and kept as it is with
diff --git a/crates/create/Cargo.toml b/crates/create/Cargo.toml
index 12daad621c..a7f3df0de6 100644
--- a/crates/create/Cargo.toml
+++ b/crates/create/Cargo.toml
@@ -14,6 +14,8 @@ pdfcraft-model = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 # For `image::bmp_with_pixel_offset`, shared with XFA pictures.
 pdfcraft-xfa = { workspace = true }
+# Already in the graph through hayro: decodes JBIG2 images for Export ▸ Images.
+hayro-jbig2.workspace = true
 png = "0.18"
 tiff = "0.11"
 image = { version = "0.25", default-features = false, features = ["bmp", "gif", "jpeg"] }
@@ -26,3 +28,4 @@ encoding_rs = "0.8"
 [dev-dependencies]
 image = { version = "0.25", default-features = false, features = ["bmp", "gif", "jpeg"] }
 hayro-syntax = { workspace = true }
+pdfcraft-filters = { workspace = true }
diff --git a/crates/create/README.md b/crates/create/README.md
index d1561a6333..f49e53dad4 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -25,6 +25,8 @@ Layer L4. Create a PDF (Acrobat's Create a PDF tool), execution plan M10.2:
 Every function returns a `pdfcraft_cos::Document`; the caller writes it.
 
 Image export and Save Image As apply each lossless image's Decode pair before converting its color components.
+JBIG2 images and masks (JBIG2 as their only filter) are decoded with `hayro-jbig2`, their `/JBIG2Globals` included,
+as `JBIG2Decode` gives them: black as 0. A JBIG2 page of another width than the image is skipped.
 Indexed Decode values select palette entries after rounding and clipping. Color-key masks compare the original samples.
 Missing, null or malformed Decode arrays keep the default mapping.
 Soft-mask Decode intervals map samples to opacity before the mask is resized, including reversed ranges and indirect entries.
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 7828952edc..36825e6ad6 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -1,7 +1,7 @@
 //! Export a PDF ▸ Image ▸ Export all images, and Edit ▸ Save image as: the images that pages
 //! use, as files. JPEG images are written unchanged; other images, and JPEG images with
 //! transparency or with CMYK samples a viewer would read inverted, are decoded and written as PNG with their soft mask, stencil mask or colour
-//! key as alpha. Images PdfCraft can't decode yet (JPEG 2000, JBIG2, CCITT, separations) are
+//! key as alpha. Images PdfCraft can't decode yet (JPEG 2000, CCITT, separations) are
 //! reported, never silently left out.
 
 use std::collections::HashSet;
@@ -100,6 +100,101 @@ fn filters(s: &Stream) -> Vec<Vec<u8>> {
     }
 }
 
+/// The samples of image `s`, decoded: through its filters, or, for a JBIG2 image (its only
+/// filter), through a JBIG2 decoder with its `/JBIG2Globals`, as rows of one-bit samples each
+/// starting on a byte, with black as 0, as `JBIG2Decode` gives them (ISO 32000-2 §7.4.7).
+fn decoded(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
+    match filters(s).as_slice() {
+        [f] if f == b"JBIG2Decode" => jbig2(doc, s),
+        _ => s.decoded().map_err(|e| e.to_string()),
+    }
+}
+
+/// The `/DecodeParms` of a stream with one filter: a dictionary, or the one in an array (7.4.2).
+fn decode_parms(doc: &Document, s: &Stream) -> Dict {
+    let Some(p) = s.dict.get(b"DecodeParms").map(|p| doc.resolve(p)) else { return Dict::default() };
+    let p = match &*p {
+        Object::Array(a) => match a.first() {
+            Some(first) => doc.resolve(first),
+            None => return Dict::default(),
+        },
+        _ => p,
+    };
+    p.as_dict().cloned().unwrap_or_default()
+}
+
+/// [`decoded`] for a JBIG2 image. Its JBIG2 page has to be the image's width, which the caller
+/// checked against the export's size limit; rows past the image's height are dropped, and too few
+/// rows are refused by the caller. Globals that can't be read refuse the image, rather than
+/// decoding it without them.
+fn jbig2(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
+    let globals = match decode_parms(doc, s).get(b"JBIG2Globals").map(|g| doc.resolve(g)).as_deref() {
+        Some(Object::Stream(g)) => Some(g.decoded().map_err(|e| format!("the JBIG2 globals can't be read: {e}"))?),
+        _ => None,
+    };
+    let image = hayro_jbig2::Image::new_embedded(&s.raw, globals.as_deref()).map_err(|e| format!("the JBIG2 image can't be read: {e}"))?;
+    if s.dict.int(b"Width") != Some(i64::from(image.width())) {
+        return Err("the JBIG2 image's width isn't the image's width".into());
+    }
+    let height = s.dict.int(b"Height").and_then(|h| usize::try_from(h).ok()).unwrap_or(0);
+    let mut rows = Rows::new(image.width() as usize, height);
+    image.decode(&mut rows).map_err(|e| format!("the JBIG2 image can't be decoded: {e}"))?;
+    Ok(rows.out)
+}
+
+/// Rows of one-bit samples, each starting on a byte, filled from a decoder's pixels: `columns`
+/// a row and at most `rows` rows. Pixels past a row's end and rows past the last are dropped, so
+/// the output is bounded by the size the caller gave.
+struct Rows {
+    out: Vec<u8>,
+    row: Vec<u8>,
+    x: usize,
+    columns: usize,
+    rows: usize,
+    done: usize,
+}
+
+impl Rows {
+    fn new(columns: usize, rows: usize) -> Self {
+        Rows { out: Vec::new(), row: vec![0; columns.div_ceil(8)], x: 0, columns, rows, done: 0 }
+    }
+
+    /// `count` pixels, as 1 samples when `one`.
+    fn push(&mut self, one: bool, count: usize) {
+        let end = self.x.saturating_add(count);
+        if one {
+            for x in self.x..end.min(self.columns) {
+                if let Some(b) = self.row.get_mut(x / 8) {
+                    *b |= 0x80 >> (x % 8);
+                }
+            }
+        }
+        self.x = end;
+    }
+
+    fn end_row(&mut self) {
+        if self.done < self.rows {
+            self.out.extend_from_slice(&self.row);
+            self.done += 1;
+        }
+        self.row.fill(0);
+        self.x = 0;
+    }
+}
+
+/// JBIG2 codes black as 1, which `JBIG2Decode` gives as 0.
+impl hayro_jbig2::Decoder for Rows {
+    fn push_pixel(&mut self, black: bool) {
+        self.push(!black, 1);
+    }
+    fn push_pixel_chunk(&mut self, black: bool, chunks: u32) {
+        self.push(!black, (chunks as usize).saturating_mul(8));
+    }
+    fn next_line(&mut self) {
+        self.end_row();
+    }
+}
+
 /// The file for one image: its JPEG data as is, or a PNG. An image with transparency (a soft
 /// mask, a stencil `/Mask` or a colour-key `/Mask`) is always a PNG with that transparency as
 /// alpha, JPEG images included, so cut-out images keep their transparent background.
@@ -108,7 +203,7 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String>
     let jpeg = matches!(f.last().map(Vec::as_slice), Some(b"DCTDecode" | b"DCT")) && f.len() == 1;
     match f.last().map(Vec::as_slice) {
         Some(b"JPXDecode") => return Err("JPEG 2000 images can't be exported yet".into()),
-        Some(b"JBIG2Decode") => return Err("JBIG2 images can't be exported yet".into()),
+        Some(b"JBIG2Decode") if f.len() > 1 => return Err("JBIG2 images inside other filters can't be exported yet".into()),
         Some(b"CCITTFaxDecode" | b"CCF") => return Err("CCITT fax images can't be exported yet".into()),
         Some(b"DCTDecode" | b"DCT") if !jpeg => return Err("JPEG images inside other filters can't be exported yet".into()),
         _ => {}
@@ -148,7 +243,7 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String>
         space = decoded;
         (samples, 8)
     } else {
-        let data = s.decoded().map_err(|e| e.to_string())?;
+        let data = decoded(doc, s)?;
         let bpc = if mask { 1 } else { s.dict.int(b"BitsPerComponent").unwrap_or(8) };
         let bpc = match bpc {
             1 => 1,
@@ -466,7 +561,7 @@ fn stencil_mask(doc: &Document, s: &Stream, w: usize, h: usize) -> Option<Vec<u8
 }
 
 /// A one-component mask image as 8-bit values (its `/Decode` interval applied), scaled to
-/// `w` × `h`. `None` when it can't be decoded (JPEG 2000, JBIG2 and CCITT masks).
+/// `w` × `h`. `None` when it can't be decoded (JPEG 2000 and CCITT masks).
 fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>> {
     let (mw, mh) = size(m.dict.int(b"Width")?, m.dict.int(b"Height")?)?;
     let stencil = m.dict.get(b"ImageMask").is_some_and(|v| matches!(&*doc.resolve(v), Object::Bool(true)));
@@ -476,7 +571,7 @@ fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>>
             let img = image::load_from_memory_with_format(&m.raw, image::ImageFormat::Jpeg).ok()?.into_luma8();
             (img.width() as usize == mw && img.height() as usize == mh).then(|| img.into_raw())?
         }
-        Some(b"DCTDecode" | b"DCT" | b"JPXDecode" | b"JBIG2Decode" | b"CCITTFaxDecode" | b"CCF") => return None,
+        Some(b"DCTDecode" | b"DCT" | b"JPXDecode" | b"CCITTFaxDecode" | b"CCF") => return None,
         _ => {
             let bpc = if stencil { 1 } else { m.dict.int(b"BitsPerComponent").unwrap_or(8) };
             let bpc = match bpc {
@@ -488,7 +583,7 @@ fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>>
                 _ => return None,
             };
             let max = (1u32 << bpc.min(8)) - 1;
-            unpack(&m.decoded().ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
+            unpack(&decoded(doc, m).ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
         }
     };
     if let Some([lo, hi]) = decode(doc, m, 1).and_then(|pairs| pairs.first().copied()) {
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 5cd34a0f1a..8a861270db 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1338,3 +1338,82 @@ fn a_tiny_gif_on_a_huge_screen_is_refused() {
     let doc = reopen(&from_images(&[("small.gif".into(), gif_on_screen(40, 30))]).unwrap());
     assert_eq!(media(&pages(&doc)[0]), [0.0, 0.0, 40.0, 30.0]);
 }
+
+/// Export ▸ Images reads JBIG2 images (ISO 32000-2 §7.4.7), JBIG2 black as 0: as the image, and as
+/// a stencil `/Mask` of another. Their `/JBIG2Globals` are read, from a dictionary or the one in
+/// an array, so globals that can't be read skip the image rather than being ignored. Rows past the
+/// image's height are left out; a JBIG2 page of another width, or with fewer rows than the image,
+/// or data that isn't JBIG2, skips the image.
+#[test]
+fn jbig2_images_export_as_their_picture() {
+    let (w, h) = (203i64, 41i64);
+    let stride = 26;
+    let mut seed = 0x2545_F491_4F6C_DD1Du64;
+    let bits: Vec<u8> = (0..stride * h as usize)
+        .map(|_| {
+            seed ^= seed << 13;
+            seed ^= seed >> 7;
+            seed ^= seed << 17;
+            seed as u8
+        })
+        .collect();
+    // The first `rows` rows as RGBA: a 1 sample white, a 0 black.
+    let picture = |rows: i64| -> Vec<u8> {
+        (0..rows as usize)
+            .flat_map(|y| (0..w as usize).map(move |x| (x, y)))
+            .flat_map(|(x, y)| {
+                let v = if bits[y * stride + x / 8] & (0x80 >> (x % 8)) != 0 { 255 } else { 0 };
+                [v, v, v, 255]
+            })
+            .collect()
+    };
+    let jbig2 = pdfcraft_filters::encode_jbig2_generic(&bits, w as u32, h as u32).unwrap();
+    // A page whose image is `data` as JBIG2, `width` × `height`. With `globals`, its /DecodeParms
+    // (an array when `.1`) name a globals stream; with `mask`, it is the stencil /Mask of a grey
+    // image.
+    let page = |width: i64, height: i64, data: &[u8], globals: Option<(&[u8], bool)>, mask: bool| {
+        let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+        with_image(&mut doc, |doc| {
+            let mut d = image_dict(width, height, "DeviceGray", 1);
+            d.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+            if let Some((g, in_array)) = globals {
+                let g = doc.add(Object::Stream(Stream::from_raw(Dict::new(), g.to_vec())));
+                let mut parms = Dict::new();
+                parms.set(b"JBIG2Globals".to_vec(), Object::Ref(g));
+                d.set(b"DecodeParms".to_vec(), if in_array { Object::Array(vec![Object::Dict(parms)]) } else { Object::Dict(parms) });
+            }
+            if !mask {
+                return Stream::from_raw(d, data.to_vec());
+            }
+            d.remove(b"ColorSpace");
+            d.set(b"ImageMask".to_vec(), Object::Bool(true));
+            let m = doc.add(Object::Stream(Stream::from_raw(d, data.to_vec())));
+            let mut image = image_dict(width, height, "DeviceGray", 8);
+            image.set(b"Mask".to_vec(), Object::Ref(m));
+            Stream::from_raw(image, vec![128; (width * height) as usize])
+        });
+        doc
+    };
+    let skipped = |doc: &Document| {
+        let out = extract_images(doc, &[0], 0);
+        out.images.is_empty() && out.skipped.len() == 1
+    };
+
+    assert_eq!(exported_rgba(&page(w, h, &jbig2, None, false)), ("png", picture(h)));
+    assert_eq!(exported_rgba(&page(w, h, &jbig2, Some((&[][..], false)), false)).1, picture(h), "empty globals");
+    for in_array in [false, true] {
+        assert!(skipped(&page(w, h, &jbig2, Some((&b"not JBIG2"[..], in_array)), false)), "unreadable globals, in an array: {in_array}");
+    }
+    assert_eq!(exported_rgba(&page(w, h - 5, &jbig2, None, false)).1, picture(h - 5), "rows past the height");
+    for (width, height, data) in [(w + 8, h, &jbig2[..]), (w - 1, h, &jbig2[..]), (w, h + 1, &jbig2[..]), (w, h, &b"not JBIG2"[..])] {
+        assert!(skipped(&page(width, height, data, None, false)), "{width} × {height}, {} bytes", data.len());
+    }
+    // Damaged data never panics.
+    for end in [0, 1, 10, 20, 30, jbig2.len() / 2] {
+        let _ = extract_images(&page(w, h, &jbig2[..end], None, false), &[0], 0);
+    }
+
+    // As a stencil /Mask, its 1 samples (JBIG2 white) hide the image.
+    let alpha: Vec<u8> = picture(h).as_chunks::<4>().0.iter().map(|p| 255 - p[0]).collect();
+    assert_eq!(alphas(&exported_rgba(&page(w, h, &jbig2, None, true)).1), alpha);
+}
diff --git a/crates/filters/README.md b/crates/filters/README.md
index aeb082ef0f..98363e33dc 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -43,7 +43,7 @@ encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
 | CCITTFaxDecode | not here (`Unsupported`; renderers decode it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
-| JBIG2Decode | not here (`Unsupported`; renderers decode it) | `encode_jbig2_generic`: the embedded organisation (D.3) with a page information segment and an immediate lossless generic region (7.4.6), no `/JBIG2Globals`; template 0 with its nominal AT pixels and typical prediction (6.2.5), coded with the MQ arithmetic coder (Annex E, Table E.1) and ended by its 0xFF 0xAC marker. A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, so the stream decodes to the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 1,048,576 samples a row; no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
+| JBIG2Decode | not here (`Unsupported`; the renderer and image export decode it with `hayro-jbig2`) | `encode_jbig2_generic`: the embedded organisation (D.3) with a page information segment and an immediate lossless generic region (7.4.6), no `/JBIG2Globals`; template 0 with its nominal AT pixels and typical prediction (6.2.5), coded with the MQ arithmetic coder (Annex E, Table E.1) and ended by its 0xFF 0xAC marker. A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, so the stream decodes to the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 1,048,576 samples a row; no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
 
 ## Tests
 
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index dba04f6c4c..a1c26eefb4 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,6 +1,6 @@
 # PDF specification and standards parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: CCITT Group 4 encoding in the Optimizer; earlier, §14.3: custom properties edited in Document Properties) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: lossless JBIG2 encoding in the Optimizer; JBIG2 images export; earlier, §7.4: CCITT Group 4 encoding in the Optimizer) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -21,7 +21,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 |---|---|---|---|---|
 | §7.2–7.5 | Syntax, objects, file structure, xref tables and streams, object streams, hybrid files, incremental updates | full | **own**, tolerant, repairs damaged files | `crates/cos`; corpus 958 files; fuzzed nightly |
 | §7.4 | Stream filters: Flate, LZW, ASCII85, ASCIIHex, RunLength, predictors | full | **own** | `crates/filters` |
-| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; the Optimizer encodes CCITT Group 4 (`pdfcraft_filters::encode_g4`, `optimize.mono-compression`); no JBIG2 encoding |
+| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding; **own** JBIG2 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; the Optimizer encodes CCITT Group 4 (`pdfcraft_filters::encode_g4`) and lossless JBIG2 (a generic region; no symbol coding), `optimize.mono-compression` |
 | §7.5.8 | Linearization | R W | R only | `core.linearization` planned |
 | §7.6.4 | Standard security handler R2–R6 (RC4 40/128, AES-128, AES-256), crypt filters, `/EncryptMetadata`, SASLprep | full | **own**, read and write | `crates/crypt`; written files open in Acrobat DC since #836 (#774: Acrobat needs the catalog outside object streams) |
 | §7.6.5 | Public-key security handler | full | none | `core.open-public-key`, `protect.certificate-encryption` planned |
@@ -130,6 +130,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | §7.4: lossless JBIG2 generic-region encoding (own, from the JBIG2 draft standard) in the Optimizer; Export ▸ Images decodes JBIG2 |
 | 2026-10-26 | minor | §7.4: CCITT Group 4 encoding (`fax`) in the Optimizer |
 | 2026-10-14 | minor | §12.4.4: `/Trans` and `/Dur` read into `DocInfo::transitions` and reported by `doc_info` |
 | 2026-10-11 | minor | §7.6.4: encrypted files we write open in Acrobat (#774, fixed by #836) |
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 872c524870..4f376cfb7f 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,7 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
-> **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer can store black-and-white images as lossless JBIG2; estimates unchanged)
+> **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-24 · **Change:** minor (M11: the PDF Optimizer can store black-and-white images as lossless JBIG2, and Export ▸ Images reads JBIG2 images; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
@@ -257,7 +257,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-10-23 | minor | M11: lossless JBIG2 for black-and-white images (`pdfcraft_filters::encode_jbig2_generic`, a generic region coded with the MQ coder, written from the JBIG2 draft standard), as Monochrome Images ▸ JBIG2 (lossless) and `doc_optimize` `mono: jbig2`; about a third smaller than Group 4 on 300 dpi text. Symbol coding not yet. Estimates unchanged. |
+| 2026-10-23 | minor | M11: lossless JBIG2 for black-and-white images (`pdfcraft_filters::encode_jbig2_generic`, a generic region coded with the MQ coder, written from the JBIG2 draft standard), as Monochrome Images ▸ JBIG2 (lossless) and `doc_optimize` `mono: jbig2`; about a third smaller than Group 4 on 300 dpi text. Export ▸ Images reads JBIG2 images (`hayro-jbig2`, with `/JBIG2Globals`). Symbol coding not yet. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index be8c1b904e..7d66616ef7 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7164,8 +7164,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["export.all_images"]
 tools = ["doc_export_all_images"]
-evidence = ["crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps"]
-notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2/CCITT masks are left out (image exported opaque); JPX/JBIG2/CCITT/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported."
+evidence = ["crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps", "crates/create/src/tests.rs::jbig2_images_export_as_their_picture", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2"]
+notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JBIG2 images and masks decode (JBIG2 as the only filter, with /JBIG2Globals; a JBIG2 page of another width is skipped); JPX/CCITT masks are left out (image exported opaque); JPX/CCITT/separations, and JBIG2 inside other filters, reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported."
 
 [[feature]]
 id = "create.export-html"

From b79fb490c2368ffc98efde1336bd27c36e164f91 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 20:03:55 +0100
Subject: [PATCH 156/270] M11: Persian and Indonesian for "JBIG2 (lossless)"

fa.tsv lacked the row: Persian came to main after it was written. It goes after "CCITT Group 4",
worded like the Arabic and Kurdish rows. id.tsv had it as an English copy beside rows it
translates; it now says "tanpa kehilangan", as de, tr and vi translate "lossless".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/ui-egui/src/i18n/fa.tsv | 1 +
 crates/ui-egui/src/i18n/id.tsv | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/crates/ui-egui/src/i18n/fa.tsv b/crates/ui-egui/src/i18n/fa.tsv
index 09a2e21689..961307a35c 100644
--- a/crates/ui-egui/src/i18n/fa.tsv
+++ b/crates/ui-egui/src/i18n/fa.tsv
@@ -596,6 +596,7 @@
 	Grayscale Images	تصاویر خاکستری
 	Monochrome Images	تصاویر تک‌رنگ
 	CCITT Group 4	CCITT گروه ۴
+	JBIG2 (lossless)	JBIG2 (بدون اتلاف)
 	Bicubic downsampling to	نمونه برداری کاهشی دو مکعبی به
 	for images above	برای تصاویر بالا‌تر از
 	Compression	فشرده‌سازی
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 1783118fff..d737f093bd 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -2057,7 +2057,7 @@ comment menu	Edit	Edit
 	Grayscale Images	Gambar Skala Abu-abu
 	Monochrome Images	Gambar Monokrom
 	CCITT Group 4	CCITT Grup 4
-	JBIG2 (lossless)	JBIG2 (lossless)
+	JBIG2 (lossless)	JBIG2 (tanpa kehilangan)
 	Green	Hijau
 	Green on black	Hijau di atas hitam
 	H / Space (hold)	H / Space (tahan)

From b2922056f4a9e2da1f3cd50097322167465beb88 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 12:44:00 +0100
Subject: [PATCH 157/270] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20re?=
 =?UTF-8?q?ads=20an=20image's=20/DecodeParms=20given=20by=20reference?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Export ▸ Images and Save Image As decoded an image with
Stream::decoded, which reads /DecodeParms only when it is direct. An
image whose PNG predictor came by reference (the dictionary, an entry
of an array, or the numbers inside) kept its row tags in the samples,
and the picture came out shifted. The same was true of an indexed
image's lookup table given as a stream, and of a JBIG2 image's
/JBIG2Globals stream, which then couldn't be read, so the image was
skipped. All three now decode through Document::with_direct_parms
(#4304), as the optimizer does, and a test exports each. Found by
CodeRabbit on #4805; the image decode was already this way on main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/create/src/extract.rs | 19 +++++----
 crates/create/src/tests.rs   | 78 ++++++++++++++++++++++++++++++++++++
 2 files changed, 89 insertions(+), 8 deletions(-)

diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 36825e6ad6..a1aba3f784 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -100,13 +100,15 @@ fn filters(s: &Stream) -> Vec<Vec<u8>> {
     }
 }
 
-/// The samples of image `s`, decoded: through its filters, or, for a JBIG2 image (its only
-/// filter), through a JBIG2 decoder with its `/JBIG2Globals`, as rows of one-bit samples each
-/// starting on a byte, with black as 0, as `JBIG2Decode` gives them (ISO 32000-2 §7.4.7).
+/// The samples of image `s`, decoded: through its filters, with a `/DecodeParms` dictionary given
+/// by reference, or as an array's entry, or with numbers inside by reference, read too (a predictor
+/// given so would otherwise be lost), or, for a JBIG2 image
+/// (its only filter), through a JBIG2 decoder with its `/JBIG2Globals`, as rows of one-bit samples
+/// each starting on a byte, with black as 0, as `JBIG2Decode` gives them (ISO 32000-2 §7.4.7).
 fn decoded(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
     match filters(s).as_slice() {
         [f] if f == b"JBIG2Decode" => jbig2(doc, s),
-        _ => s.decoded().map_err(|e| e.to_string()),
+        _ => doc.with_direct_parms(s).decoded().map_err(|e| e.to_string()),
     }
 }
 
@@ -129,7 +131,7 @@ fn decode_parms(doc: &Document, s: &Stream) -> Dict {
 /// decoding it without them.
 fn jbig2(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
     let globals = match decode_parms(doc, s).get(b"JBIG2Globals").map(|g| doc.resolve(g)).as_deref() {
-        Some(Object::Stream(g)) => Some(g.decoded().map_err(|e| format!("the JBIG2 globals can't be read: {e}"))?),
+        Some(Object::Stream(g)) => Some(doc.with_direct_parms(g).decoded().map_err(|e| format!("the JBIG2 globals can't be read: {e}"))?),
         _ => None,
     };
     let image = hayro_jbig2::Image::new_embedded(&s.raw, globals.as_deref()).map_err(|e| format!("the JBIG2 image can't be read: {e}"))?;
@@ -498,9 +500,10 @@ fn space(doc: &Document, cs: Option<&Object>) -> Result<Space, String> {
                 };
                 let table = match a.get(3).map(|t| doc.resolve(t)).as_deref() {
                     Some(Object::String(s)) => s.bytes.clone(),
-                    Some(Object::Stream(t)) => {
-                        t.decoded_within(MAX_LOOKUP).map_err(|_| "an indexed colour space with an oversized or damaged lookup table".to_string())?
-                    }
+                    Some(Object::Stream(t)) => doc
+                        .with_direct_parms(t)
+                        .decoded_within(MAX_LOOKUP)
+                        .map_err(|_| "an indexed colour space with an oversized or damaged lookup table".to_string())?,
                     _ => return Err("an indexed colour space without a lookup table".into()),
                 };
                 Ok(Space::Indexed(Box::new(base), hival, table))
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 8a861270db..7a1f92759a 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1339,6 +1339,84 @@ fn a_tiny_gif_on_a_huge_screen_is_refused() {
     assert_eq!(media(&pages(&doc)[0]), [0.0, 0.0, 40.0, 30.0]);
 }
 
+/// An image whose PNG predictor is given by reference exports as its picture: its `/DecodeParms`
+/// dictionary given by reference, as an array's entry, or direct with its numbers by reference. So
+/// do an indexed image whose lookup table is a stream with its `/DecodeParms` given by reference,
+/// and a JBIG2 image whose `/JBIG2Globals` stream has them so. `Stream::decoded` reads only a
+/// direct `/DecodeParms` with direct numbers: the row tags stayed in the samples, and the picture
+/// came out shifted.
+#[test]
+fn images_whose_predictor_is_given_by_reference_export_as_their_picture() {
+    // PNG predictor parameters for `columns` one-byte samples a row.
+    let parms = |columns: i64| {
+        let mut p = Dict::new();
+        p.set(b"Predictor".to_vec(), Object::Int(15));
+        p.set(b"Colors".to_vec(), Object::Int(1));
+        p.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        p.set(b"Columns".to_vec(), Object::Int(columns));
+        p
+    };
+    // Two rows of four grey samples, each behind a PNG "None" row tag.
+    let predicted = pdfcraft_filters::encode_flate(&[0, 10, 20, 30, 40, 0, 50, 60, 70, 80]);
+    let grey: Vec<u8> = [10u8, 20, 30, 40, 50, 60, 70, 80].iter().flat_map(|v| [*v, *v, *v, 255]).collect();
+    for form in ["a reference", "an array of a reference", "numbers by reference"] {
+        let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+        with_image(&mut doc, |doc| {
+            let mut d = image_dict(4, 2, "DeviceGray", 8);
+            d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+            let decode_parms = match form {
+                "numbers by reference" => {
+                    let mut p = parms(4);
+                    for key in [&b"Predictor"[..], b"Columns"] {
+                        let v = p.get(key).cloned().unwrap();
+                        p.set(key.to_vec(), Object::Ref(doc.add(v)));
+                    }
+                    Object::Dict(p)
+                }
+                "a reference" => Object::Ref(doc.add(Object::Dict(parms(4)))),
+                _ => Object::Array(vec![Object::Ref(doc.add(Object::Dict(parms(4))))]),
+            };
+            d.set(b"DecodeParms".to_vec(), decode_parms);
+            Stream::from_raw(d, predicted.clone())
+        });
+        assert_eq!(exported_rgba(&doc), ("png", grey.clone()), "/DecodeParms as {form}");
+    }
+    // An indexed image's lookup table, red then blue, as a stream behind a "None" row tag.
+    let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+    with_image(&mut doc, |doc| {
+        let mut t = Dict::new();
+        t.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        t.set(b"DecodeParms".to_vec(), Object::Ref(doc.add(Object::Dict(parms(6)))));
+        let table = doc.add(Object::Stream(Stream::from_raw(t, pdfcraft_filters::encode_flate(&[0, 255, 0, 0, 0, 0, 255]))));
+        let mut d = image_dict(4, 1, "DeviceGray", 8);
+        d.set(b"ColorSpace".to_vec(), Object::Array(vec![Object::name("Indexed"), Object::name("DeviceRGB"), Object::Int(1), Object::Ref(table)]));
+        Stream::from_raw(d, vec![0, 1, 0, 1])
+    });
+    let (red, blue) = ([255, 0, 0, 255], [0, 0, 255, 255]);
+    assert_eq!(exported_rgba(&doc), ("png", [red, blue, red, blue].concat()), "the lookup table's /DecodeParms by reference");
+    // A JBIG2 image whose globals hold one extension segment (ISO/IEC 14492 7.4.14) a decoder
+    // ignores, behind a "None" row tag. With the tag left in, the globals can't be read and the
+    // image is skipped.
+    let segment = [0, 0, 0, 0, 0x3E, 0, 0, 0, 0, 0, 4, 0, 0, 0, 1];
+    let bits = [0xF0u8, 0x0F, 0xAA, 0x55];
+    let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+    with_image(&mut doc, |doc| {
+        let mut g = Dict::new();
+        g.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        g.set(b"DecodeParms".to_vec(), Object::Ref(doc.add(Object::Dict(parms(segment.len() as i64)))));
+        let tagged: Vec<u8> = [0].iter().chain(&segment).copied().collect();
+        let globals = doc.add(Object::Stream(Stream::from_raw(g, pdfcraft_filters::encode_flate(&tagged))));
+        let mut decode_parms = Dict::new();
+        decode_parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+        let mut d = image_dict(16, 2, "DeviceGray", 1);
+        d.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+        d.set(b"DecodeParms".to_vec(), Object::Dict(decode_parms));
+        Stream::from_raw(d, pdfcraft_filters::encode_jbig2_generic(&bits, 16, 2).unwrap())
+    });
+    let picture: Vec<u8> = (0..32).flat_map(|i| if bits[i / 8] & (0x80 >> (i % 8)) != 0 { [255, 255, 255, 255] } else { [0, 0, 0, 255] }).collect();
+    assert_eq!(exported_rgba(&doc), ("png", picture), "the JBIG2 globals' /DecodeParms by reference");
+}
+
 /// Export ▸ Images reads JBIG2 images (ISO 32000-2 §7.4.7), JBIG2 black as 0: as the image, and as
 /// a stencil `/Mask` of another. Their `/JBIG2Globals` are read, from a dictionary or the one in
 /// an array, so globals that can't be read skip the image rather than being ignored. Rows past the

From e6e34bfa8d1c7d39b8d42d19db6a8fc3ce9d563c Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 12:44:00 +0100
Subject: [PATCH 158/270] M11: only Group 4 is limited to rows of 32,767
 samples (README, parity)

The optimizer README's and optimize.mono-compression's "not yet" lists
said rows wider than 32,767 samples aren't stored. That is Group 4's
limit (MAX_G4_COLUMNS); JBIG2 takes rows of up to 1,048,576
(MAX_JBIG2_COLUMNS). Found by CodeRabbit on #4805.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/README.md    | 11 ++++++-----
 parity/acrobat-features.toml |  2 +-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 5162cdbbaf..9c1715ad81 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -42,11 +42,12 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   than Group 4. It is lossless: the samples decode to the same bits, so the colour
   space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
-  JBIG2 symbol coding (lossy or lossless), monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
-  than 32,767 samples. Redaction doesn't decode Group 4 yet: a mark over part of an image stored
-  this way removes the whole image (nothing leaks). Nor does anything that exports an image:
-  Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML
-  export leave the picture out.
+  JBIG2 symbol coding (lossy or lossless), monochrome downsampling, inline images, soft masks and
+  `/Mask` images, and Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to
+  1,048,576). Redaction doesn't decode Group 4 yet: a mark over part of an image stored this way
+  removes the whole image (nothing leaks). Nor does anything that exports an image: Export ▸
+  Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave
+  the picture out.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 7d66616ef7..e6688347af 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/filters/src/mq.rs::the_annex_h_test_sequence_encodes_to_its_bytes", "crates/filters/src/jbig2.rs::bitmaps_round_trip", "crates/filters/src/jbig2.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/optimize/tests/optimize.rs::black_and_white_images_become_jbig2", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4 (the default, so Reduce File Size does it too) or JBIG2, both lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. JBIG2 is a generic region (template 0, typical prediction), about a third smaller than Group 4 on 300 dpi text; a document below PDF 1.4 gets /Version 1.4. Not yet: JBIG2 symbol coding (text regions with symbol dictionaries, where JBIG2's larger gains on text come from, and its lossy mode), JBIG2Globals, monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks), nor does anything that exports an image: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
+notes = "CCITT Group 4 (the default, so Reduce File Size does it too) or JBIG2, both lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. JBIG2 is a generic region (template 0, typical prediction), about a third smaller than Group 4 on 300 dpi text; a document below PDF 1.4 gets /Version 1.4. Not yet: JBIG2 symbol coding (text regions with symbol dictionaries, where JBIG2's larger gains on text come from, and its lossy mode), JBIG2Globals, monochrome downsampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to 1,048,576). Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks), nor does anything that exports an image: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 881c4150e94ec3e638107aab4d228b7079d23528 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 13:26:24 +0100
Subject: [PATCH 159/270] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20re?=
 =?UTF-8?q?fuses=20a=20JBIG2=20page=20larger=20than=20it=20exports,=20befo?=
 =?UTF-8?q?re=20decoding?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The export checked an image's /Width × /Height against its 100-million-
pixel budget, and the JBIG2 page's width against /Width, but not the
page's height. The decoder decodes the whole page, rows past the
image's height too, and takes pages of up to about 2^28 pixels: a
20,000 × 4 image over a 20,000 × 10,000 JBIG2 page cost 200 million
pixels of decoding to export four rows. The page itself is now held to
the budget before it is decoded. Found by CodeRabbit on #4320.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/create/src/extract.rs |  7 ++++++-
 crates/create/src/tests.rs   | 20 +++++++++++++++++++-
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index a1aba3f784..b46f74570f 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -126,7 +126,9 @@ fn decode_parms(doc: &Document, s: &Stream) -> Dict {
 }
 
 /// [`decoded`] for a JBIG2 image. Its JBIG2 page has to be the image's width, which the caller
-/// checked against the export's size limit; rows past the image's height are dropped, and too few
+/// checked against the export's size limit, and within that limit itself: the decoder decodes the
+/// whole page, rows past the image's height too, so a small `/Height` over a far taller page
+/// would cost more than the limit allows. Rows past the image's height are dropped, and too few
 /// rows are refused by the caller. Globals that can't be read refuse the image, rather than
 /// decoding it without them.
 fn jbig2(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
@@ -138,6 +140,9 @@ fn jbig2(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
     if s.dict.int(b"Width") != Some(i64::from(image.width())) {
         return Err("the JBIG2 image's width isn't the image's width".into());
     }
+    if u64::from(image.width()).saturating_mul(u64::from(image.height())) > MAX_PIXELS {
+        return Err(format!("the JBIG2 page, {} × {}, is too large to export", image.width(), image.height()));
+    }
     let height = s.dict.int(b"Height").and_then(|h| usize::try_from(h).ok()).unwrap_or(0);
     let mut rows = Rows::new(image.width() as usize, height);
     image.decode(&mut rows).map_err(|e| format!("the JBIG2 image can't be decoded: {e}"))?;
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 7a1f92759a..9b54787fc9 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1421,7 +1421,8 @@ fn images_whose_predictor_is_given_by_reference_export_as_their_picture() {
 /// a stencil `/Mask` of another. Their `/JBIG2Globals` are read, from a dictionary or the one in
 /// an array, so globals that can't be read skip the image rather than being ignored. Rows past the
 /// image's height are left out; a JBIG2 page of another width, or with fewer rows than the image,
-/// or data that isn't JBIG2, skips the image.
+/// or larger than an exported image may be (however small the image's `/Height`), or data that
+/// isn't JBIG2, skips the image.
 #[test]
 fn jbig2_images_export_as_their_picture() {
     let (w, h) = (203i64, 41i64);
@@ -1486,6 +1487,23 @@ fn jbig2_images_export_as_their_picture() {
     for (width, height, data) in [(w + 8, h, &jbig2[..]), (w - 1, h, &jbig2[..]), (w, h + 1, &jbig2[..]), (w, h, &b"not JBIG2"[..])] {
         assert!(skipped(&page(width, height, data, None, false)), "{width} × {height}, {} bytes", data.len());
     }
+    // The same stream with its page information (the first segment's data, after its 11-byte
+    // header: width, then height) claiming a 20,000 × 10,000 page: 200 million pixels, over the
+    // export's 100 million, behind an image of 20,000 × 4. The decoder would decode the whole page
+    // (it takes pages of up to about 2^28 pixels), so it is refused first.
+    let mut large = jbig2.clone();
+    large[11..15].copy_from_slice(&20_000u32.to_be_bytes());
+    large[15..19].copy_from_slice(&10_000u32.to_be_bytes());
+    assert!(skipped(&page(20_000, 4, &large, None, false)), "a page over the export's size");
+    // A page of exactly the budget, 20,000 × 5,000, is decoded; one row more is refused.
+    for (rows, refused) in [(5_000u32, false), (5_001, true)] {
+        large[15..19].copy_from_slice(&rows.to_be_bytes());
+        let doc = page(20_000, 4, &large, None, false);
+        assert_eq!(skipped(&doc), refused, "a page of 20,000 × {rows}");
+        if !refused {
+            assert_eq!(exported_rgba(&doc).1.len(), 20_000 * 4 * 4);
+        }
+    }
     // Damaged data never panics.
     for end in [0, 1, 10, 20, 30, jbig2.len() / 2] {
         let _ = extract_images(&page(w, h, &jbig2[..end], None, false), &[0], 0);

From fe5e8f44317d93ffe956fdcb785aa63e556f406d Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 13:54:56 +0100
Subject: [PATCH 160/270] M11: the optimizer reads a catalog /Version given by
 reference

When the optimizer stores an image as JBIG2 (PDF 1.4), it raises the
catalog's /Version for an older file. It read /Version only when it was
direct: a catalog saying 1.7 by reference looked like no version at all,
and was set to /1.4, lowering the document. It is now resolved first.
Found in pre-push review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/src/images.rs     |  7 ++++---
 crates/optimize/tests/optimize.rs | 25 +++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 8b2f30a8f0..cf668d0fbf 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -674,12 +674,13 @@ pub(crate) fn run(
 }
 
 /// JBIG2Decode is PDF 1.4: a document whose header says less, and whose catalog doesn't say 1.4
-/// or more already, gets `/Version /1.4` in its catalog (ISO 32000-2 §7.7.2). A full save with
-/// object streams writes a 1.5 header anyway.
+/// or more already (directly or by reference), gets `/Version /1.4` in its catalog (ISO 32000-2
+/// §7.7.2). A full save with object streams writes a 1.5 header anyway.
 fn at_least_pdf_1_4(doc: &mut Document) -> Result<(), OptimizeError> {
     let below = |v: &[u8]| v.len() < 3 || v < &b"1.4"[..];
     let Some(root) = doc.root() else { return Ok(()) };
-    let catalog = doc.get(root).as_dict().and_then(|c| c.name(b"Version").map(<[u8]>::to_vec));
+    let version = doc.get(root).as_dict().and_then(|c| c.get(b"Version").cloned());
+    let catalog = version.and_then(|v| doc.resolve(&v).as_name().map(<[u8]>::to_vec));
     if below(doc.version().as_bytes()) && catalog.as_deref().is_none_or(below) {
         doc.update_dict(root, |c| c.set(b"Version".to_vec(), Object::name("1.4")))?;
     }
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index aaebc5f4f5..9a0990286e 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -649,6 +649,31 @@ fn black_and_white_images_become_jbig2() {
     assert!(render(&jbig2) == before, "the page looks the same");
 }
 
+/// A catalog `/Version` given by reference is read through it: a PDF 1.3 file whose catalog says
+/// 1.7 by reference keeps 1.7 when its images become JBIG2, rather than being lowered to 1.4; one
+/// whose catalog says 1.3 by reference gets 1.4.
+#[test]
+fn a_catalog_version_given_by_reference_is_read() {
+    for (catalog, after) in [("1.7", "1.7"), ("1.3", "1.4")] {
+        let mut doc = Document::new_empty();
+        let (w, h) = (1200, 480);
+        let text = bilevel(w, h, false);
+        let im = mono_image(&mut doc, w, h, &text, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+        page(&mut doc, &[("Im", im)], "q 300 0 0 120 20 660 cm /Im Do Q");
+        let version = doc.add(Object::name(catalog));
+        let root = doc.root().unwrap();
+        doc.update_dict(root, |c| c.set(b"Version".to_vec(), Object::Ref(version))).unwrap();
+        let mut bytes = write_full(&doc, &SaveOptions { object_streams: false, ..SaveOptions::default() }).unwrap();
+        bytes[..8].copy_from_slice(b"%PDF-1.3");
+        let mut doc = Document::open(Arc::new(bytes)).unwrap();
+        let r = optimize(&mut doc, &Settings { mono: MonoCompression::Jbig2, ..Settings::default() }).unwrap();
+        assert_eq!(r.images_recompressed, 1);
+        let root = doc.root().unwrap();
+        let v = doc.get(root).as_dict().and_then(|c| c.get(b"Version").cloned()).unwrap();
+        assert_eq!(doc.resolve(&v).as_name(), Some(after.as_bytes()), "catalog {catalog} by reference");
+    }
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();

From d416d6a36e8c8b8a748851f0bafb150cd93a1420 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 13:55:01 +0100
Subject: [PATCH 161/270] M11: say how export and redaction treat JBIG2 images
 they can't read
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Export ▸ Images skips an image whose JBIG2 page has another width or
more pixels than an export takes; a JBIG2 stencil mask refused the same
way is left out and the image exported opaque, as JPX and CCITT masks
are, which the export test now checks. The README and parity note said
only "is skipped". And redaction doesn't decode JBIG2 or Group 4 yet,
so a mark over part of an image the optimizer stored either way removes
the whole image; the optimizer README and parity note now say so (#4384
adds Group 4). Found in pre-push review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/create/README.md      | 4 +++-
 crates/create/src/tests.rs   | 6 ++++++
 crates/optimize/README.md    | 8 ++++----
 parity/acrobat-features.toml | 4 ++--
 4 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/crates/create/README.md b/crates/create/README.md
index f49e53dad4..05395656a3 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -26,7 +26,9 @@ Every function returns a `pdfcraft_cos::Document`; the caller writes it.
 
 Image export and Save Image As apply each lossless image's Decode pair before converting its color components.
 JBIG2 images and masks (JBIG2 as their only filter) are decoded with `hayro-jbig2`, their `/JBIG2Globals` included,
-as `JBIG2Decode` gives them: black as 0. A JBIG2 page of another width than the image is skipped.
+as `JBIG2Decode` gives them: black as 0. An image whose JBIG2 page has another width than the image, or more
+pixels than an exported image may have, is skipped; such a mask is left out and the image exported opaque, as JPX
+and CCITT masks are.
 Indexed Decode values select palette entries after rounding and clipping. Color-key masks compare the original samples.
 Missing, null or malformed Decode arrays keep the default mapping.
 Soft-mask Decode intervals map samples to opacity before the mask is resized, including reversed ranges and indirect entries.
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 9b54787fc9..98fbfd7eee 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1495,6 +1495,12 @@ fn jbig2_images_export_as_their_picture() {
     large[11..15].copy_from_slice(&20_000u32.to_be_bytes());
     large[15..19].copy_from_slice(&10_000u32.to_be_bytes());
     assert!(skipped(&page(20_000, 4, &large, None, false)), "a page over the export's size");
+    // Refused the same ways as a stencil /Mask, it is left out: the image exports opaque.
+    for (width, height, mask) in [(w + 8, h, &jbig2), (20_000, 4, &large)] {
+        let rgba = exported_rgba(&page(width, height, mask, None, true)).1;
+        assert_eq!(rgba.len() as i64, width * height * 4, "a {width}-wide mask");
+        assert!(alphas(&rgba).iter().all(|a| *a == 255), "a refused {width}-wide mask is left out");
+    }
     // A page of exactly the budget, 20,000 × 5,000, is decoded; one row more is refused.
     for (rows, refused) in [(5_000u32, false), (5_001, true)] {
         large[15..19].copy_from_slice(&rows.to_be_bytes());
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 9c1715ad81..a1c47697b5 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -44,10 +44,10 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
   JBIG2 symbol coding (lossy or lossless), monochrome downsampling, inline images, soft masks and
   `/Mask` images, and Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to
-  1,048,576). Redaction doesn't decode Group 4 yet: a mark over part of an image stored this way
-  removes the whole image (nothing leaks). Nor does anything that exports an image: Export ▸
-  Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave
-  the picture out.
+  1,048,576). Redaction doesn't decode JBIG2 or Group 4 yet: a mark over part of such an image
+  removes the whole image (nothing leaks). Export reads JBIG2, but nothing that exports an image
+  reads Group 4 yet: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word,
+  PowerPoint and HTML export leave the picture out.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index e6688347af..84f7981676 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7165,7 +7165,7 @@ status = "shipped"
 commands = ["export.all_images"]
 tools = ["doc_export_all_images"]
 evidence = ["crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps", "crates/create/src/tests.rs::jbig2_images_export_as_their_picture", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2"]
-notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JBIG2 images and masks decode (JBIG2 as the only filter, with /JBIG2Globals; a JBIG2 page of another width is skipped); JPX/CCITT masks are left out (image exported opaque); JPX/CCITT/separations, and JBIG2 inside other filters, reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported."
+notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JBIG2 images and masks decode (JBIG2 as the only filter, with /JBIG2Globals; an image whose JBIG2 page has another width, or more pixels than an export takes, is skipped, and such a mask is left out, the image exported opaque); JPX/CCITT masks are left out (image exported opaque); JPX/CCITT/separations, and JBIG2 inside other filters, reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported."
 
 [[feature]]
 id = "create.export-html"
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/filters/src/mq.rs::the_annex_h_test_sequence_encodes_to_its_bytes", "crates/filters/src/jbig2.rs::bitmaps_round_trip", "crates/filters/src/jbig2.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/optimize/tests/optimize.rs::black_and_white_images_become_jbig2", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4 (the default, so Reduce File Size does it too) or JBIG2, both lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. JBIG2 is a generic region (template 0, typical prediction), about a third smaller than Group 4 on 300 dpi text; a document below PDF 1.4 gets /Version 1.4. Not yet: JBIG2 symbol coding (text regions with symbol dictionaries, where JBIG2's larger gains on text come from, and its lossy mode), JBIG2Globals, monochrome downsampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to 1,048,576). Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks), nor does anything that exports an image: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
+notes = "CCITT Group 4 (the default, so Reduce File Size does it too) or JBIG2, both lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. JBIG2 is a generic region (template 0, typical prediction), about a third smaller than Group 4 on 300 dpi text; a document below PDF 1.4 gets /Version 1.4. Not yet: JBIG2 symbol coding (text regions with symbol dictionaries, where JBIG2's larger gains on text come from, and its lossy mode), JBIG2Globals, monochrome downsampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to 1,048,576). Redaction doesn't decode JBIG2 or Group 4 yet: a mark over part of such an image removes the whole image (nothing leaks). Export reads JBIG2, but nothing that exports an image reads Group 4 yet: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From c748d2183ddd80ba5515bff948176267864ab909 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 14:25:11 +0100
Subject: [PATCH 162/270] M11: doc_optimize reports a catalog /Version given by
 reference

With compatibility retain, doc_optimize reports the later of the
header's version and the catalog's /Version. It read /Version only when
it was direct, so a catalog saying 1.6 by reference was reported as the
header's 1.4. It is now resolved first, as the optimizer reads it
(a88c8afb). The bug was already on main; found in pre-push review as a
sibling of that fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/automation/src/documents.rs       | 4 +++-
 crates/automation/tests/it/automation.rs | 9 +++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
index 880179b1eb..83790afed7 100644
--- a/crates/automation/src/documents.rs
+++ b/crates/automation/src/documents.rs
@@ -373,7 +373,9 @@ impl Automation {
                 let pw = self.doc(a).ok().and_then(|d| d.password.as_deref());
                 let doc = pdfcraft_cos::Document::open_with_password(bytes.clone(), pw).ok()?;
                 let root = doc.root()?;
-                doc.get(root).as_dict()?.name(b"Version").and_then(valid_version).map(str::to_owned)
+                // Through a reference too, as the optimizer reads it.
+                let version = doc.get(root).as_dict()?.get(b"Version")?.clone();
+                doc.resolve(&version).as_name().and_then(valid_version).map(str::to_owned)
             })
             .flatten();
         let header_version = bytes.strip_prefix(b"%PDF-").and_then(|b| b.get(..3)).and_then(valid_version);
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 835db4c755..f41519aff7 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6293,6 +6293,15 @@ fn optimizing_through_tools() {
     let cat_doc = ok(&mut a, "doc_open", json!({ "path": "cat16.pdf" }))["doc"].as_u64().unwrap();
     let retained = ok(&mut a, "doc_optimize", json!({ "doc": cat_doc, "path": "retained.pdf", "compatibility": "retain", "object_streams": false }));
     assert_eq!(retained["pdf_version"].as_str(), Some("1.6"), "{retained}");
+    // The same with the catalog's /Version given by reference: read through it.
+    let v16 = cos14.add(pdfcraft_cos::Object::name("1.6"));
+    cos14.update_dict(root, |c| c.set(b"Version".to_vec(), pdfcraft_cos::Object::Ref(v16))).unwrap();
+    let ref16 = pdfcraft_cos::write_full(&cos14, &pdfcraft_cos::SaveOptions { object_streams: false, ..Default::default() }).unwrap();
+    std::fs::write(dir.join("ref16.pdf"), &ref16).unwrap();
+    let ref_doc = ok(&mut a, "doc_open", json!({ "path": "ref16.pdf" }))["doc"].as_u64().unwrap();
+    let by_ref =
+        ok(&mut a, "doc_optimize", json!({ "doc": ref_doc, "path": "retained-ref.pdf", "compatibility": "retain", "object_streams": false }));
+    assert_eq!(by_ref["pdf_version"].as_str(), Some("1.6"), "{by_ref}");
 
     assert!(matches!(a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "compatibility": "1.3" })), Err(ToolError::InvalidArgs(_))));
     assert!(matches!(

From 71875ce5a8d20a87c9d3fa1ae567f9f13797faa4 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 18:14:02 +0100
Subject: [PATCH 163/270] M11: Copy Image reads JBIG2; the parity table no
 longer lists lossless JBIG2 as missing

Copy Image and Copy Image in Original Format go through Export's
decoder, which reads JBIG2 now, so the view.copy-image parity note no
longer lists JBIG2 as missing. docs/target-app-parity.md's optimize row
lists JBIG2 symbol coding and lossy JBIG2 as missing instead of
monochrome JBIG2, with a status line and a revision row.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 docs/target-app-parity.md    | 4 +++-
 parity/acrobat-features.toml | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index d790e98178..22832f65f2 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,5 +1,6 @@
 # PdfCraft parity with Adobe Acrobat Pro
 
+> **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-26 · **Change:** minor (K Optimize and standards no longer lists lossless JBIG2 as missing; scores and estimates unchanged)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-26 · **Change:** minor (`optimize.mono-compression` partial (CCITT Group 4): K Optimize and standards 15 shipped and 11 partial of 58, 35.3%; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497); estimates unchanged)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-25 · **Change:** minor (localization current state: Arabic logical catalog, explicit RTL direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite. Scores and estimates unchanged)
 
@@ -209,7 +210,7 @@ full parity in that area.
 | H Digital signatures | 45 | 23 | 10 | 62.2% | 45% | 40–70 | PAdES B-B signing and validation (PKCS #12, macOS Keychain, Windows store with PIN prompts), certification, encrypted documents, certificate usage checks; B-T, LTV, OCSP/CRL with caller-supplied evidence. Missing: PKCS #11 and smart cards outside Windows, timestamp-server preferences, online revocation fetching, FieldMDP and field locking, OS trust store, EU Trusted Lists, compare signed version |
 | I Scan and OCR | 26 | 5 | 2 | 23.1% | 15% | 40–75 | Searchable image (ocrs, Latin script without accents) on pages, ranges and many files. Missing: every other language (#744 Dutch; accents, CJK, Cyrillic, Arabic), editable-text output, deskew, rotation, despeckle, camera images beyond straightening (found or placed corners): orientation, clean-up, MRC compression, scanners |
 | J Create and export | 34 | 12 | 3 | 39.7% | 25% | 55–100 | Create from images, multipage TIFF, text, clipboard, blank, many files at once; export PNG/JPEG/TIFF, text, RTF; Word and HTML partial. Missing: Office/HTML/web/PostScript to PDF, Excel and PowerPoint export, Word layout fidelity (#773), SVG/XML/EPS/PS/JPEG 2000 export, accessible text |
-| K Optimize and standards | 58 | 15 | 11 | 35.3% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2 and downsampling |
+| K Optimize and standards | 58 | 15 | 11 | 35.3% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, JBIG2 symbol coding and lossy JBIG2, monochrome downsampling |
 | L Print | 39 | 15 | 1 | 39.7% | 35% | 30–55 | Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, print-ready PDF, CUPS on macOS/Linux, the Windows spooler (#756) and the browser's print dialog on the web. Missing: print as image, PostScript, all print-production tools (output preview, separations, ink manager, printer marks, colour conversion) |
 | M Accessibility | 61 | 38 | 1 | 63.1% | 30% | 40–70 | Accessibility Checker (all 32 rules, report, fixes), alternate text, title and language. Missing: autotag, Tags/Order/Content panels, Reading Order tool, artifact marking, table editor, Read Out Loud, full keyboard operation of the app, screen-reader audit |
 | N Automation, preferences, misc | 75 | 20 | 5 | 30.0% | 35% | 25–45 | CLI, MCP, UI control channel, 141 automation tools, Action Wizard (run, create), compare (text, visual, report, side by side, Text/Visual filter). Missing: most Preferences pages, Acrobat's finer compare filters, Action Wizard management, custom commands, AI providers, rich media/3D, hosted web app |
@@ -295,6 +296,7 @@ licensed OCR or AI model.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | K Optimize and standards no longer lists lossless JBIG2 as missing (a generic region, through the Optimizer's Monochrome Images); symbol coding and lossy JBIG2 still are. Scores and estimates unchanged. |
 | 2026-10-26 | minor | `optimize.mono-compression` became partial (CCITT Group 4), counted on the table's own measurement: K Optimize and standards 15 shipped and 11 partial of 58 (35.3%), no longer listing CCITT as missing; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497). Estimates unchanged. |
 | 2026-10-25 | minor | Localization current state: Arabic catalogs stay logical, Arabic/Kurdish labels take an explicit RTL direction, and stock chrome mirrors; native/browser RTL input, IME and complex workflows remain unqualified. Native Simplified Chinese uses LXGW WenKai Lite; the web build has no Hans face. Scores and estimates unchanged. |
 | 2026-10-20 | minor | M12 #3673: the Character encoding rule accepts Identity-H/V fonts with Adobe CJK collections, or a predefined non-Identity CMap, while rejecting unknown names and foreign registries. Synthetic checker and read-only automation regressions passed after failing before the fix; per-glyph mapping validation and embedded-font extraction remain separate. Breadth, readiness and hours unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 84f7981676..69a05410de 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1599,7 +1599,7 @@ status = "partial"
 commands = []
 tools = []
 evidence = ["crates/ui-egui/tests/it/viewer.rs::a_clicked_picture_is_selected_and_copied_in_its_original_format", "crates/ui-egui/tests/it/viewer.rs::right_click_on_a_picture_copies_it_at_full_size", "crates/ui-egui/tests/it/viewer.rs::a_picture_inside_form_artwork_under_text_is_selected_and_copied", "crates/engine/src/tests.rs::copy_image_finds_a_picture_inside_form_artwork_under_text"]
-notes = "Select tool: a click selects a raster image (also inside Form artwork or under text) and ⌘C copies it as a file in its original format (JPEG as stored, else PNG); right-click ▸ Copy Image copies its pixels at full resolution. Missing: inline images (BI/ID/EI), JPEG 2000/JBIG2/CCITT images, multi-format clipboard (file and bitmap at once), the web build"
+notes = "Select tool: a click selects a raster image (also inside Form artwork or under text) and ⌘C copies it as a file in its original format (JPEG as stored, else PNG); right-click ▸ Copy Image copies its pixels at full resolution. Missing: inline images (BI/ID/EI), JPEG 2000/CCITT images, JBIG2 inside other filters, multi-format clipboard (file and bitmap at once), the web build"
 
 [[feature]]
 id = "view.rulers"

From 9883da3bc33397d522b086fa0035ecbdaa7a4def Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 00:56:00 +0200
Subject: [PATCH 164/270] M11: Create PDF stores black-and-white images at one
 bit, as Group 4 when smaller

A scan saved as a 1-bit PNG decodes to eight-bit grey and was stored
that way, larger than the PNG it came from; a bilevel TIFF was stored at
one bit but with Flate. Now any image of only pure black and white
(1-bit, eight-bit grey, a two-colour palette, RGB without a profile) is
stored at one bit per pixel, as CCITT Group 4 or Flate, whichever is
smaller as stored. A grey profile stays; RGB with a profile keeps its
colours.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 Cargo.lock                 |   2 +
 crates/create/Cargo.toml   |   2 +
 crates/create/src/lib.rs   |  75 ++++++++++++++++-
 crates/create/src/tests.rs | 168 +++++++++++++++++++++++++++++++++++++
 4 files changed, 244 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 42426bc688..e2427a1b0a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4333,9 +4333,11 @@ name = "pdfcraft-create"
 version = "0.15.0"
 dependencies = [
  "encoding_rs",
+ "hayro-ccitt",
  "hayro-syntax",
  "image",
  "pdfcraft-cos",
+ "pdfcraft-filters",
  "pdfcraft-fonts",
  "pdfcraft-model",
  "pdfcraft-xfa",
diff --git a/crates/create/Cargo.toml b/crates/create/Cargo.toml
index 12daad621c..56cebc2af6 100644
--- a/crates/create/Cargo.toml
+++ b/crates/create/Cargo.toml
@@ -10,6 +10,7 @@ workspace = true
 
 [dependencies]
 pdfcraft-cos = { workspace = true }
+pdfcraft-filters = { workspace = true }
 pdfcraft-model = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 # For `image::bmp_with_pixel_offset`, shared with XFA pictures.
@@ -24,5 +25,6 @@ thiserror = { workspace = true }
 encoding_rs = "0.8"
 
 [dev-dependencies]
+hayro-ccitt.workspace = true
 image = { version = "0.25", default-features = false, features = ["bmp", "gif", "jpeg"] }
 hayro-syntax = { workspace = true }
diff --git a/crates/create/src/lib.rs b/crates/create/src/lib.rs
index a6fb28b3d6..36b52d4211 100644
--- a/crates/create/src/lib.rs
+++ b/crates/create/src/lib.rs
@@ -2,7 +2,7 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
-use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream, serialize};
 
 mod extract;
 mod upright_image;
@@ -108,9 +108,42 @@ fn jpeg_icc(mut chunks: Vec<(u8, u8, &[u8])>) -> Option<Vec<u8>> {
     complete.then(|| chunks.iter().flat_map(|c| c.2.iter().copied()).collect())
 }
 
+/// The samples of a black-and-white image packed one bit per pixel (1 for white, each row
+/// starting on a byte): eight-bit grey (`n` 1) or RGB (`n` 3) whose every pixel is pure black or
+/// pure white, or one-bit grey, already packed (a bilevel TIFF). `None` for anything else, found
+/// at its first other pixel.
+fn bilevel(data: &[u8], (w, h): (u32, u32), n: usize, bits: Option<i64>) -> Option<Vec<u8>> {
+    let (w, h) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
+    let stride = w.div_ceil(8);
+    let size = stride.checked_mul(h)?;
+    match (bits, n) {
+        (Some(1), 1) => data.get(..size).map(<[u8]>::to_vec),
+        (Some(8), 1 | 3) if w > 0 => {
+            let samples = data.get(..w.checked_mul(h)?.checked_mul(n)?)?;
+            let mut packed = vec![0u8; size];
+            for (i, px) in samples.chunks_exact(n).enumerate() {
+                let white = match px {
+                    [0] | [0, 0, 0] => false,
+                    [255] | [255, 255, 255] => true,
+                    _ => return None,
+                };
+                if white && let Some(b) = packed.get_mut((i / w) * stride + (i % w) / 8) {
+                    *b |= 0x80 >> (i % w % 8);
+                }
+            }
+            Some(packed)
+        }
+        _ => None,
+    }
+}
+
 /// Add `img` to `doc` as an image XObject. An ICC profile becomes an `/ICCBased` colour space
 /// (with the device space as `/Alternate`); `profiles` shares one object between images that
 /// carry the same profile.
+///
+/// A black-and-white image is stored at one bit per pixel, as CCITT Group 4 when that is smaller
+/// than Flate: losslessly, and several times smaller than the eight bits a scan saved as a 1-bit
+/// PNG decodes to. RGB keeps its colour space when it has a colour profile.
 fn add_image(doc: &mut Document, img: Embedded, profiles: &mut Vec<(Vec<u8>, ObjRef)>) -> ObjRef {
     let mut d = img.dict;
     d.set(b"Type".to_vec(), Object::name("XObject"));
@@ -118,12 +151,48 @@ fn add_image(doc: &mut Document, img: Embedded, profiles: &mut Vec<(Vec<u8>, Obj
     d.set(b"Width".to_vec(), Object::Int(img.px.0 as i64));
     d.set(b"Height".to_vec(), Object::Int(img.px.1 as i64));
     let device = d.name(b"ColorSpace").map(<[u8]>::to_vec);
-    let n = match device.as_deref() {
+    let mut n = match device.as_deref() {
         Some(b"DeviceGray") => 1,
         Some(b"DeviceRGB") => 3,
         Some(b"DeviceCMYK") => 4,
         _ => 0,
     };
+    let (mut data, mut filtered) = (img.data, img.filtered);
+    let profiled_rgb = n == 3 && img.icc.is_some();
+    if !filtered
+        && !profiled_rgb
+        && let Some(packed) = bilevel(&data, img.px, n, d.int(b"BitsPerComponent"))
+    {
+        if n == 3 {
+            d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+            n = 1;
+        }
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+        // The smaller as stored, dictionary included: Group 4's parameters outweigh its saving on
+        // a tiny image.
+        let stored = |d: &Dict, data: &[u8]| {
+            let mut out = Vec::new();
+            serialize(&Object::Dict(d.clone()), &mut out);
+            out.len().saturating_add(data.len())
+        };
+        let mut flate_dict = d.clone();
+        flate_dict.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        let flate = pdfcraft_filters::encode_flate(&packed);
+        (d, data) = match pdfcraft_filters::encode_g4(&packed, img.px.0, img.px.1) {
+            Ok(g4) => {
+                let mut parms = Dict::new();
+                parms.set(b"K".to_vec(), Object::Int(-1));
+                parms.set(b"Columns".to_vec(), Object::Int(i64::from(img.px.0)));
+                parms.set(b"Rows".to_vec(), Object::Int(i64::from(img.px.1)));
+                let mut g4_dict = d.clone();
+                g4_dict.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+                g4_dict.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+                if stored(&g4_dict, &g4) < stored(&flate_dict, &flate) { (g4_dict, g4) } else { (flate_dict, flate) }
+            }
+            Err(_) => (flate_dict, flate),
+        };
+        filtered = true;
+    }
     if let (Some(icc), Some(device)) = (img.icc.and_then(|p| icc_for(p, n)), device) {
         let r = match profiles.iter().find(|(p, _)| *p == icc) {
             Some((_, r)) => *r,
@@ -142,7 +211,7 @@ fn add_image(doc: &mut Document, img: Embedded, profiles: &mut Vec<(Vec<u8>, Obj
         let mr = doc.add(Object::Stream(Stream::flate(m, &alpha)));
         d.set(b"SMask".to_vec(), Object::Ref(mr));
     }
-    let stream = if img.filtered { Stream::from_raw(d, img.data) } else { Stream::flate(d, &img.data) };
+    let stream = if filtered { Stream::from_raw(d, data) } else { Stream::flate(d, &data) };
     doc.add(Object::Stream(stream))
 }
 
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 5cd34a0f1a..f94fc020a1 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1338,3 +1338,171 @@ fn a_tiny_gif_on_a_huge_screen_is_refused() {
     let doc = reopen(&from_images(&[("small.gif".into(), gif_on_screen(40, 30))]).unwrap());
     assert_eq!(media(&pages(&doc)[0]), [0.0, 0.0, 40.0, 30.0]);
 }
+
+/// A PNG of `w` × `h` samples `data` in `color` at `depth`, with a palette or an ICC profile.
+fn png_of(w: u32, h: u32, color: png::ColorType, depth: png::BitDepth, data: &[u8], palette: Option<Vec<u8>>, icc: Option<Vec<u8>>) -> Vec<u8> {
+    let mut out = Vec::new();
+    {
+        let mut info = png::Info::with_size(w, h);
+        info.color_type = color;
+        info.bit_depth = depth;
+        info.palette = palette.map(Into::into);
+        info.icc_profile = icc.map(Into::into);
+        let mut writer = png::Encoder::with_info(&mut out, info).unwrap().write_header().unwrap();
+        writer.write_image_data(data).unwrap();
+    }
+    out
+}
+
+/// Rows of `w` one-bit samples (1 white), each on a new byte: lines of glyphs drawn from a few
+/// shapes at uneven spacing, whose edges move a pixel now and then, as a scan of text has them.
+/// (Clean, evenly spaced strokes favour Flate over Group 4.)
+fn strokes(w: u32, h: u32) -> Vec<u8> {
+    let stride = (w as usize).div_ceil(8);
+    let mut data = vec![0xFF; stride * h as usize];
+    let mut seed = 0x9E37_79B9_7F4A_7C15u64;
+    let mut next = move || {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        seed
+    };
+    let (w, h) = (w as usize, h as usize);
+    for line in (4..h.saturating_sub(18)).step_by(24) {
+        let mut x = 8;
+        while x + 16 < w {
+            let wide = 5 + (next() % 4) as usize;
+            let shape = next() % 4;
+            let mut fill = |x0: usize, x1: usize, y0: usize, y1: usize| {
+                for y in line + y0..line + y1 {
+                    let ragged = |r: u64| match r % 8 {
+                        0 => 0,
+                        1 => 2,
+                        _ => 1,
+                    };
+                    let (left, right) = ((x + x0 + 1).saturating_sub(ragged(next())), x + x1 + ragged(next()));
+                    for xx in left..right.saturating_sub(1).min(w) {
+                        data[y * stride + xx / 8] &= !(0x80 >> (xx % 8));
+                    }
+                }
+            };
+            match shape {
+                0 => fill(0, 2, 0, 14),
+                1 => {
+                    fill(0, wide, 4, 6);
+                    fill(0, wide, 12, 14);
+                    fill(0, 2, 4, 14);
+                    fill(wide - 2, wide, 4, 14);
+                }
+                2 => {
+                    fill(0, 2, 4, 14);
+                    fill(wide - 2, wide, 6, 14);
+                    fill(0, wide - 1, 4, 6);
+                }
+                _ => {
+                    fill(0, 2, 7, 14);
+                    fill(0, 2, 2, 4);
+                }
+            }
+            x += wide + 2 + (next() % 2) as usize + if next() % 6 == 0 { 7 } else { 0 };
+        }
+    }
+    data
+}
+
+/// The one-bit samples (true for white) a Group 4 image stream decodes to, through an
+/// independent decoder.
+fn g4_rows(s: &Stream) -> Vec<Vec<bool>> {
+    struct Rows(Vec<Vec<bool>>, Vec<bool>, usize);
+    impl hayro_ccitt::Decoder for Rows {
+        fn push_pixel(&mut self, white: bool) {
+            self.1.push(white);
+        }
+        fn push_pixel_chunk(&mut self, white: bool, chunks: u32) {
+            self.1.extend(std::iter::repeat_n(white, chunks as usize * 8));
+        }
+        fn next_line(&mut self) {
+            let mut row = std::mem::take(&mut self.1);
+            row.truncate(self.2);
+            self.0.push(row);
+        }
+    }
+    let (w, h) = (s.dict.int(b"Width").unwrap() as u32, s.dict.int(b"Height").unwrap() as u32);
+    let settings = hayro_ccitt::DecodeSettings {
+        columns: w,
+        rows: h,
+        end_of_block: true,
+        end_of_line: false,
+        rows_are_byte_aligned: false,
+        encoding: hayro_ccitt::EncodingMode::Group4,
+        invert_black: false,
+    };
+    let mut out = Rows(Vec::new(), Vec::new(), w as usize);
+    hayro_ccitt::decode(&s.raw, &mut out, &mut hayro_ccitt::DecoderContext::new(settings)).unwrap();
+    out.0
+}
+
+fn image_stream(doc: &Document, page: usize) -> Stream {
+    let p = &pages(doc)[page];
+    let res = doc.resolve(p.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+    let xo = doc.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+    match &*doc.resolve(xo.get(b"Im0").unwrap()) {
+        Object::Stream(s) => s.clone(),
+        _ => panic!("not an image"),
+    }
+}
+
+/// Black-and-white pictures are stored at one bit per pixel, as CCITT Group 4 when that is
+/// smaller, whichever way the file holds them: a 1-bit PNG (which decodes to eight bits), eight-bit
+/// grey of only black and white, a two-colour palette, black-and-white RGB. The bits are the
+/// picture's. A grey profile stays; a picture with any other shade, colour, or an RGB profile is
+/// stored as before.
+#[test]
+fn black_and_white_images_are_stored_at_one_bit() {
+    use png::{BitDepth, ColorType};
+    let (w, h) = (1200u32, 240u32);
+    let bits = strokes(w, h);
+    let stride = (w as usize).div_ceil(8);
+    let white = |x: usize, y: usize| bits[y * stride + x / 8] & (0x80 >> (x % 8)) != 0;
+    let expected: Vec<Vec<bool>> = (0..h as usize).map(|y| (0..w as usize).map(|x| white(x, y)).collect()).collect();
+    let grey: Vec<u8> = expected.iter().flatten().map(|&wh| if wh { 255 } else { 0 }).collect();
+    let rgb: Vec<u8> = grey.iter().flat_map(|&v| [v, v, v]).collect();
+    let pictures = [
+        png_of(w, h, ColorType::Grayscale, BitDepth::One, &bits, None, None),
+        png_of(w, h, ColorType::Grayscale, BitDepth::Eight, &grey, None, None),
+        png_of(w, h, ColorType::Indexed, BitDepth::One, &bits.iter().map(|b| !b).collect::<Vec<_>>(), Some(vec![255, 255, 255, 0, 0, 0]), None),
+        png_of(w, h, ColorType::Rgb, BitDepth::Eight, &rgb, None, None),
+        png_of(w, h, ColorType::Grayscale, BitDepth::One, &bits, None, Some(icc_profile(b"GRAY"))),
+    ];
+    let files: Vec<(String, Vec<u8>)> = pictures.into_iter().enumerate().map(|(i, p)| (format!("{i}.png"), p)).collect();
+    let doc = reopen(&from_images(&files).unwrap());
+    for page in 0..5 {
+        let s = image_stream(&doc, page);
+        assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])), "page {page}");
+        assert_eq!(g4_rows(&s), expected, "page {page}");
+        assert!(s.raw.len() < bits.len(), "page {page}: {} bytes, smaller than its one-bit samples", s.raw.len());
+    }
+    assert_eq!(image_of(&doc, 3).name(b"ColorSpace"), Some(&b"DeviceGray"[..]), "black-and-white RGB becomes grey");
+    assert_eq!(icc_of(&doc, &image_of(&doc, 4)).map(|(n, ..)| n), Some(1), "the grey profile stays");
+
+    // Another shade, colour, an RGB profile: as before. A tiny picture: one bit, but Flate.
+    let mut shaded = grey.clone();
+    shaded[5] = 128;
+    let mut coloured = rgb.clone();
+    coloured[0] = 200;
+    let others = [
+        png_of(w, h, ColorType::Grayscale, BitDepth::Eight, &shaded, None, None),
+        png_of(w, h, ColorType::Rgb, BitDepth::Eight, &coloured, None, None),
+        png_of(w, h, ColorType::Rgb, BitDepth::Eight, &rgb, None, Some(icc_profile(b"RGB "))),
+        png_of(2, 2, ColorType::Grayscale, BitDepth::Eight, &[0, 255, 255, 0], None, None),
+    ];
+    let files: Vec<(String, Vec<u8>)> = others.into_iter().enumerate().map(|(i, p)| (format!("o{i}.png"), p)).collect();
+    let doc = reopen(&from_images(&files).unwrap());
+    let kept: Vec<(Option<i64>, Option<Vec<u8>>)> =
+        (0..4).map(|p| (image_of(&doc, p).int(b"BitsPerComponent"), image_of(&doc, p).name(b"Filter").map(<[u8]>::to_vec))).collect();
+    assert_eq!(
+        kept[..3],
+        [(Some(8), Some(b"FlateDecode".to_vec())), (Some(8), Some(b"FlateDecode".to_vec())), (Some(8), Some(b"FlateDecode".to_vec()))]
+    );
+    assert_eq!(kept[3], (Some(1), Some(b"FlateDecode".to_vec())), "Group 4 isn't smaller for 2 × 2");
+}

From 3d6e11ecdb7f6af30bbb8f6e06baa2e30845742c Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 00:56:00 +0200
Subject: [PATCH 165/270] M11: the optimizer stores eight-bit black-and-white
 grey images at one bit

An eight-bit grey image whose samples are all 0 or 255 is packed to one
bit per pixel and then stored as Monochrome Images asks (Group 4, or
JBIG2 with #4320), when that is smaller as stored; its decode array
stays. Indexed images, a colour-key /Mask and Retain are left alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/optimize/src/images.rs     | 55 +++++++++++++++++++++++-
 crates/optimize/tests/optimize.rs | 70 +++++++++++++++++++++++++++++++
 2 files changed, 124 insertions(+), 1 deletion(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 57e583a078..33e60256e0 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -604,6 +604,59 @@ fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stre
     (crate::stored_len(&new)? < crate::stored_len(s)?).then_some(new)
 }
 
+/// An eight-bit grey image whose every sample is 0 or 255, stored at one bit per pixel and then as
+/// `compression` asks (see [`mono`]), if that is smaller as stored. Lossless: a decode array maps
+/// 0 and 255 at eight bits as it maps 0 and 1 at one bit, so it stays. Left alone: indexed images
+/// (their samples are palette indices), a colour-key `/Mask` (its ranges are in eight-bit values),
+/// and everything when `compression` is Retain.
+fn bilevel_grey(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stream> {
+    if compression == MonoCompression::Retain {
+        return None;
+    }
+    let d = &s.dict;
+    let indexed = |cs: &Object| match &*doc.resolve(cs) {
+        Object::Array(a) => matches!(a.first().and_then(Object::as_name), Some(b"Indexed" | b"I")),
+        _ => false,
+    };
+    let colour_key = d.get(b"Mask").is_some_and(|m| doc.resolve(m).as_array().is_some());
+    if d.int(b"BitsPerComponent") != Some(8)
+        || matches!(d.get(b"ImageMask"), Some(Object::Bool(true)))
+        || colour_key
+        || !d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs) && !indexed(cs))
+    {
+        return None;
+    }
+    // Through u32 first, as everywhere here, so the product can't overflow.
+    let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
+    if w == 0 || h == 0 || u64::from(w) * u64::from(h) > MAX_PIXELS {
+        return None;
+    }
+    let (w, h) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
+    let samples = s.decoded().ok()?;
+    let samples = samples.get(..w.checked_mul(h)?)?;
+    let stride = w.div_ceil(8);
+    let mut packed = vec![0u8; stride.checked_mul(h)?];
+    for (i, v) in samples.iter().enumerate() {
+        match v {
+            0 => {}
+            255 => {
+                if let Some(b) = packed.get_mut((i / w) * stride + (i % w) / 8) {
+                    *b |= 0x80 >> (i % w % 8);
+                }
+            }
+            _ => return None,
+        }
+    }
+    let mut one_bit = d.clone();
+    for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
+        one_bit.remove(k);
+    }
+    one_bit.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    let one_bit = Stream::flate(one_bit, &packed);
+    let best = mono(doc, &one_bit, compression).unwrap_or(one_bit);
+    (crate::stored_len(&best)? < crate::stored_len(s)?).then_some(best)
+}
+
 pub(crate) fn run(
     doc: &mut Document,
     pages: &[ObjRef],
@@ -630,7 +683,7 @@ pub(crate) fn run(
         let obj = doc.get(r);
         let Object::Stream(s) = &*obj else { continue };
         report.images += 1;
-        if let Some(new) = mono(doc, s, settings.mono) {
+        if let Some(new) = mono(doc, s, settings.mono).or_else(|| bilevel_grey(doc, s, settings.mono)) {
             report.image_bytes_before += s.raw.len();
             report.image_bytes_after += new.raw.len();
             report.images_recompressed += 1;
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 3fce1dadba..8993c598f8 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -588,6 +588,76 @@ fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
     assert!(stream(&doc, eight_bit).dict.int(b"Width").is_some_and(|nw| nw < i64::from(w)), "8-bit hex text in lines: resampled");
 }
 
+/// Eight-bit samples (0 or 255) from rows of one-bit ones.
+fn eight_bit(bits: &[u8], w: u32, h: u32) -> Vec<u8> {
+    let stride = (w as usize).div_ceil(8);
+    (0..h as usize).flat_map(|y| (0..w as usize).map(move |x| if bits[y * stride + x / 8] & (0x80 >> (x % 8)) != 0 { 255 } else { 0 })).collect()
+}
+
+/// Eight-bit grey images of only black and white (as some scanners and converters write scans)
+/// become one-bit Group 4, losslessly: the page looks the same, an inverting decode array
+/// included. Not touched by this: a grey image with any other shade, an indexed image (its samples
+/// are palette indices), one masked by colour key, and everything with `mono: Retain`.
+#[test]
+fn eight_bit_black_and_white_images_become_one_bit() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200, 480);
+    let grey = eight_bit(&bilevel(w, h, false), w, h);
+    let image = |doc: &mut Document, data: &[u8], entries: &[(&str, Object)]| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w as i64));
+        d.set(b"Height".to_vec(), Object::Int(h as i64));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        for (k, v) in entries {
+            d.set(k.as_bytes().to_vec(), v.clone());
+        }
+        doc.add(Object::Stream(Stream::flate(d, data)))
+    };
+    let gray_cs = ("ColorSpace", Object::name("DeviceGray"));
+    let plain = image(&mut doc, &grey, std::slice::from_ref(&gray_cs));
+    let decode = Object::Array(vec![1.into(), 0.into()]);
+    let inverted = image(&mut doc, &grey, &[gray_cs.clone(), ("Decode", decode.clone())]);
+    let mut shaded = grey.clone();
+    shaded[1000] = 128;
+    let shade = image(&mut doc, &shaded, std::slice::from_ref(&gray_cs));
+    let palette = Object::Array(vec![
+        Object::name("Indexed"),
+        Object::name("DeviceGray"),
+        255.into(),
+        Object::String(pdfcraft_cos::PdfString::literal((0..=255u8).rev().collect::<Vec<_>>())),
+    ]);
+    let indexed = image(&mut doc, &grey, &[("ColorSpace", palette)]);
+    let keyed = image(&mut doc, &grey, &[gray_cs, ("Mask", Object::Array(vec![0.into(), 0.into()]))]);
+    page(
+        &mut doc,
+        &[("A", plain), ("B", inverted), ("C", shade), ("D", indexed), ("E", keyed)],
+        "q 300 0 0 120 20 660 cm /A Do Q q 300 0 0 120 320 660 cm /B Do Q q 300 0 0 120 20 520 cm /C Do Q \
+         q 300 0 0 120 320 520 cm /D Do Q q 300 0 0 120 20 380 cm /E Do Q",
+    );
+    let before = render(&doc);
+    let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
+    // Grey settings that leave grey images alone, so only this conversion acts.
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    let settings = Settings { gray: keep, ..Settings::default() };
+
+    let mut kept = doc.clone();
+    let r = optimize(&mut kept, &Settings { mono: MonoCompression::Retain, ..settings.clone() }).unwrap();
+    assert_eq!(r.images_recompressed, 0, "Retain keeps every image as it is");
+
+    let untouched = [shade, indexed, keyed].map(|r| raw(&doc, r));
+    let r = optimize(&mut doc, &settings).unwrap();
+    assert_eq!(r.images_recompressed, 2);
+    for i in [plain, inverted] {
+        let s = stream(&doc, i);
+        assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])));
+    }
+    assert_eq!(stream(&doc, inverted).dict.get(b"Decode"), Some(&decode), "the decode array stays");
+    assert_eq!([shade, indexed, keyed].map(|r| raw(&doc, r)), untouched);
+    assert!(render(&doc) == before, "the page looks the same");
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();

From 4712abaabb78ac94b6260be1b27c468b710de4fd Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 01:03:01 +0200
Subject: [PATCH 166/270] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20de?=
 =?UTF-8?q?codes=20CCITT=20fax=20images?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Group 4 images (now written by Create PDF and the optimizer) would
otherwise stop exporting: they were reported as "can't be exported
yet". A CCITT fax image (its only filter) is decoded through
hayro-ccitt with its /DecodeParms (K, Columns, Rows, EndOfBlock,
EndOfLine, EncodedByteAlign, BlackIs1), masks included; /Columns has to
be the image's width, so a hostile value can't size the buffers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 ROADMAP.md                               |  1 +
 crates/automation/src/tools.rs           |  2 +-
 crates/automation/tests/it/automation.rs | 49 ++++++++++++
 crates/create/Cargo.toml                 |  3 +-
 crates/create/README.md                  |  6 +-
 crates/create/src/extract.rs             | 95 ++++++++++++++++++++++--
 crates/create/src/tests.rs               | 57 ++++++++++++++
 crates/optimize/README.md                |  7 +-
 docs/roadmap.md                          |  2 +
 parity/acrobat-features.toml             | 12 +--
 10 files changed, 216 insertions(+), 18 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 87f5b6705f..9d6b7a43fe 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,6 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
+- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit, and Export ▸ Images reads CCITT fax images.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 2760be9298..15530229fd 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1274,7 +1274,7 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("ocr.recognize")
             .with(schema(json!({}), &[])),
-        t("doc_export_all_images", "Export all images", "Write the images that pages use into a folder (`<name>_Page_<n>_Image_<k>.jpg|png`, n zero-padded to the page count's digits), each once: JPEG images unchanged, others as PNG with their soft mask as alpha. min_size skips images with fewer pixels on their shorter side. Images that can't be decoded yet (JPEG 2000, JBIG2, CCITT, separations) are listed under skipped. Includes unsaved edits.")
+        t("doc_export_all_images", "Export all images", "Write the images that pages use into a folder (`<name>_Page_<n>_Image_<k>.jpg|png`, n zero-padded to the page count's digits), each once: JPEG images unchanged, others as PNG with their soft mask as alpha. min_size skips images with fewer pixels on their shorter side. Images that can't be decoded yet (JPEG 2000, JBIG2, separations) are listed under skipped. Includes unsaved edits.")
             .cmd("export.all_images")
             .with(schema(
                 json!({
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index dcd321eddb..ea943eff79 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6431,6 +6431,55 @@ fn scanned_page() -> Vec<u8> {
     write_full(&doc, &SaveOptions::default()).unwrap()
 }
 
+/// A scan saved as a 1-bit PNG becomes a page whose picture stays one bit per pixel (not the eight
+/// bits the PNG decodes to), and Export all images gives the picture back.
+#[test]
+fn a_one_bit_scan_stays_one_bit_and_exports() {
+    let dir = workdir("bilevel");
+    let (w, h) = (800u32, 200u32);
+    let stride = (w as usize).div_ceil(8);
+    let mut bits = vec![0xFFu8; stride * h as usize];
+    for y in 0..h as usize {
+        for x in 0..w as usize {
+            if y % 25 >= 6 && y % 25 < 18 && (x * 7 + y / 25 * 13) % 11 < 4 {
+                bits[y * stride + x / 8] &= !(0x80 >> (x % 8));
+            }
+        }
+    }
+    let mut png_bytes = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png_bytes, w, h);
+        enc.set_color(png::ColorType::Grayscale);
+        enc.set_depth(png::BitDepth::One);
+        enc.write_header().unwrap().write_image_data(&bits).unwrap();
+    }
+    std::fs::write(dir.join("scan.png"), &png_bytes).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_create", json!({ "from": "images", "paths": ["scan.png"] }))["doc"].as_u64().unwrap();
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "scan.pdf" }));
+    let saved = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join("scan.pdf")).unwrap())).unwrap();
+    let images: Vec<Option<i64>> = saved
+        .object_numbers()
+        .into_iter()
+        .filter_map(|num| match &*saved.get(pdfcraft_cos::ObjRef { num, generation: saved.generation(num) }) {
+            pdfcraft_cos::Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => Some(s.dict.int(b"BitsPerComponent")),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(images, [Some(1)]);
+    let r = ok(&mut a, "doc_export_all_images", json!({ "doc": doc, "folder": "out" }));
+    let files = r["files"].as_array().unwrap();
+    assert_eq!(files.len(), 1, "{r}");
+    let exported = std::fs::read(files[0]["path"].as_str().unwrap()).unwrap();
+    let mut reader = png::Decoder::new(std::io::Cursor::new(exported)).read_info().unwrap();
+    let mut buf = vec![0; reader.output_buffer_size().unwrap()];
+    let frame = reader.next_frame(&mut buf).unwrap();
+    let white: Vec<bool> = buf[..frame.buffer_size()].as_chunks::<3>().0.iter().map(|p| *p == [255, 255, 255]).collect();
+    let expected: Vec<bool> =
+        (0..h as usize).flat_map(|y| (0..w as usize).map(move |x| (y, x))).map(|(y, x)| bits[y * stride + x / 8] & (0x80 >> (x % 8)) != 0).collect();
+    assert_eq!(white, expected);
+}
+
 /// A scan's black-and-white image is stored as CCITT Group 4 by default, and kept as it is with
 /// `mono: { compression: retain }`.
 #[test]
diff --git a/crates/create/Cargo.toml b/crates/create/Cargo.toml
index 56cebc2af6..e60e554ba8 100644
--- a/crates/create/Cargo.toml
+++ b/crates/create/Cargo.toml
@@ -11,6 +11,8 @@ workspace = true
 [dependencies]
 pdfcraft-cos = { workspace = true }
 pdfcraft-filters = { workspace = true }
+# Already in the graph through hayro: decodes CCITT fax images for Export ▸ Images.
+hayro-ccitt.workspace = true
 pdfcraft-model = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 # For `image::bmp_with_pixel_offset`, shared with XFA pictures.
@@ -25,6 +27,5 @@ thiserror = { workspace = true }
 encoding_rs = "0.8"
 
 [dev-dependencies]
-hayro-ccitt.workspace = true
 image = { version = "0.25", default-features = false, features = ["bmp", "gif", "jpeg"] }
 hayro-syntax = { workspace = true }
diff --git a/crates/create/README.md b/crates/create/README.md
index d1561a6333..e8ed9a872c 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -6,7 +6,9 @@ Layer L4. Create a PDF (Acrobat's Create a PDF tool), execution plan M10.2:
 - `from_images(&[(name, bytes)])`: one page per image, sized from the image's resolution
   (PNG `pHYs`, JPEG JFIF density; 72 dpi when absent). JPEG data is embedded as is
   (`/DCTDecode`, grey, RGB or Adobe-inverted CMYK); PNG is decoded and stored with Flate,
-  with transparency as a soft mask. An ICC profile in the file (JPEG `APP2 ICC_PROFILE`, PNG
+  with transparency as a soft mask. A picture of only pure black and white (a 1-bit PNG or TIFF,
+  eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as
+  CCITT Group 4 or Flate, whichever is smaller as stored (`pdfcraft_filters::encode_g4`). An ICC profile in the file (JPEG `APP2 ICC_PROFILE`, PNG
   `iCCP`) that matches the image's colour space is kept as an `/ICCBased` colour space with
   the device space as `/Alternate`; images with the same profile share one profile object.
   JPEG metadata scanning skips marker fill bytes and reads application segments after the
@@ -31,3 +33,5 @@ Soft-mask Decode intervals map samples to opacity before the mask is resized, in
 The existing 16-bit path still uses each sample's high byte.
 JPEG image Decode handling remains limited.
 ICC transforms and calibrated color conversion remain outside this export path.
+CCITT fax images (Group 3 and 4) are decoded for export through `hayro-ccitt` with their `/DecodeParms`
+(`/Columns` has to be the image's width); JPEG 2000 and JBIG2 images are still reported, not exported.
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 7828952edc..16ecd5d8d4 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -100,6 +100,92 @@ fn filters(s: &Stream) -> Vec<Vec<u8>> {
     }
 }
 
+/// The samples of image `s`, decoded: through its filters, or, for a CCITT fax image (its only
+/// filter), through a CCITT decoder, as rows of one-bit samples each starting on a byte, with black
+/// as 0 unless `/BlackIs1` says 1, as `CCITTFaxDecode` gives them (ISO 32000-2 §7.4.6).
+fn decoded(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
+    match filters(s).as_slice() {
+        [f] if f == b"CCITTFaxDecode" || f == b"CCF" => ccitt(doc, s),
+        _ => s.decoded().map_err(|e| e.to_string()),
+    }
+}
+
+/// [`decoded`] for a CCITT fax image, with its `/DecodeParms` (Table 11 defaults). `/Columns` has to
+/// be the image's width; pixels past it and rows past the image's height are dropped, so the output
+/// is bounded by the size the caller already checked. A stream that ends early gives fewer rows,
+/// which the caller refuses.
+fn ccitt(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
+    struct Rows {
+        out: Vec<u8>,
+        row: Vec<u8>,
+        x: usize,
+        columns: usize,
+        rows: usize,
+        black_is_1: bool,
+    }
+    impl Rows {
+        fn push(&mut self, white: bool, count: usize) {
+            for _ in 0..count {
+                if self.x < self.columns
+                    && white != self.black_is_1
+                    && let Some(b) = self.row.get_mut(self.x / 8)
+                {
+                    *b |= 0x80 >> (self.x % 8);
+                }
+                self.x = self.x.saturating_add(1);
+            }
+        }
+    }
+    impl hayro_ccitt::Decoder for Rows {
+        fn push_pixel(&mut self, white: bool) {
+            self.push(white, 1);
+        }
+        fn push_pixel_chunk(&mut self, white: bool, chunks: u32) {
+            self.push(white, (chunks as usize).saturating_mul(8));
+        }
+        fn next_line(&mut self) {
+            if self.out.len() / self.row.len().max(1) < self.rows {
+                self.out.extend_from_slice(&self.row);
+            }
+            self.row.fill(0);
+            self.x = 0;
+        }
+    }
+    let p = s.dict.get(b"DecodeParms").map(|p| doc.resolve(p)).and_then(|p| p.as_dict().cloned()).unwrap_or_default();
+    let flag = |key: &[u8], default: bool| match p.get(key).map(|v| doc.resolve(v)).as_deref() {
+        Some(Object::Bool(b)) => *b,
+        _ => default,
+    };
+    let k = p.int(b"K").unwrap_or(0);
+    // A row is the image's width: that was checked against the export's size limit, so a hostile
+    // /Columns can't size the buffers.
+    let columns = u32::try_from(p.int(b"Columns").unwrap_or(1728)).ok().filter(|c| *c > 0).ok_or("the fax image has no columns")?;
+    if s.dict.int(b"Width") != Some(i64::from(columns)) {
+        return Err("the fax image's columns aren't its width".into());
+    }
+    let height = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
+    let rows = p.int(b"Rows").and_then(|r| u32::try_from(r).ok()).filter(|r| *r > 0).unwrap_or(height).min(height);
+    let settings = hayro_ccitt::DecodeSettings {
+        columns,
+        rows,
+        end_of_block: flag(b"EndOfBlock", true),
+        end_of_line: flag(b"EndOfLine", false),
+        rows_are_byte_aligned: flag(b"EncodedByteAlign", false),
+        encoding: match k {
+            ..0 => hayro_ccitt::EncodingMode::Group4,
+            0 => hayro_ccitt::EncodingMode::Group3_1D,
+            k => hayro_ccitt::EncodingMode::Group3_2D { k: u32::try_from(k).unwrap_or(u32::MAX) },
+        },
+        invert_black: false,
+    };
+    let stride = (columns as usize).div_ceil(8);
+    let mut out =
+        Rows { out: Vec::new(), row: vec![0; stride], x: 0, columns: columns as usize, rows: rows as usize, black_is_1: flag(b"BlackIs1", false) };
+    // Rows decoded before damaged data are kept; too few rows are refused by the caller.
+    let _ = hayro_ccitt::decode(&s.raw, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
+    Ok(out.out)
+}
+
 /// The file for one image: its JPEG data as is, or a PNG. An image with transparency (a soft
 /// mask, a stencil `/Mask` or a colour-key `/Mask`) is always a PNG with that transparency as
 /// alpha, JPEG images included, so cut-out images keep their transparent background.
@@ -109,7 +195,6 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String>
     match f.last().map(Vec::as_slice) {
         Some(b"JPXDecode") => return Err("JPEG 2000 images can't be exported yet".into()),
         Some(b"JBIG2Decode") => return Err("JBIG2 images can't be exported yet".into()),
-        Some(b"CCITTFaxDecode" | b"CCF") => return Err("CCITT fax images can't be exported yet".into()),
         Some(b"DCTDecode" | b"DCT") if !jpeg => return Err("JPEG images inside other filters can't be exported yet".into()),
         _ => {}
     }
@@ -148,7 +233,7 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String>
         space = decoded;
         (samples, 8)
     } else {
-        let data = s.decoded().map_err(|e| e.to_string())?;
+        let data = decoded(doc, s)?;
         let bpc = if mask { 1 } else { s.dict.int(b"BitsPerComponent").unwrap_or(8) };
         let bpc = match bpc {
             1 => 1,
@@ -466,7 +551,7 @@ fn stencil_mask(doc: &Document, s: &Stream, w: usize, h: usize) -> Option<Vec<u8
 }
 
 /// A one-component mask image as 8-bit values (its `/Decode` interval applied), scaled to
-/// `w` × `h`. `None` when it can't be decoded (JPEG 2000, JBIG2 and CCITT masks).
+/// `w` × `h`. `None` when it can't be decoded (JPEG 2000 and JBIG2 masks).
 fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>> {
     let (mw, mh) = size(m.dict.int(b"Width")?, m.dict.int(b"Height")?)?;
     let stencil = m.dict.get(b"ImageMask").is_some_and(|v| matches!(&*doc.resolve(v), Object::Bool(true)));
@@ -476,7 +561,7 @@ fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>>
             let img = image::load_from_memory_with_format(&m.raw, image::ImageFormat::Jpeg).ok()?.into_luma8();
             (img.width() as usize == mw && img.height() as usize == mh).then(|| img.into_raw())?
         }
-        Some(b"DCTDecode" | b"DCT" | b"JPXDecode" | b"JBIG2Decode" | b"CCITTFaxDecode" | b"CCF") => return None,
+        Some(b"DCTDecode" | b"DCT" | b"JPXDecode" | b"JBIG2Decode") => return None,
         _ => {
             let bpc = if stencil { 1 } else { m.dict.int(b"BitsPerComponent").unwrap_or(8) };
             let bpc = match bpc {
@@ -488,7 +573,7 @@ fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>>
                 _ => return None,
             };
             let max = (1u32 << bpc.min(8)) - 1;
-            unpack(&m.decoded().ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
+            unpack(&decoded(doc, m).ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
         }
     };
     if let Some([lo, hi]) = decode(doc, m, 1).and_then(|pairs| pairs.first().copied()) {
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index f94fc020a1..9716470abb 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1506,3 +1506,60 @@ fn black_and_white_images_are_stored_at_one_bit() {
     );
     assert_eq!(kept[3], (Some(1), Some(b"FlateDecode".to_vec())), "Group 4 isn't smaller for 2 × 2");
 }
+
+/// The pixels of an exported PNG (RGB), as true for white.
+fn exported_white(png_data: &[u8]) -> Vec<bool> {
+    let mut reader = png::Decoder::new(std::io::Cursor::new(png_data.to_vec())).read_info().unwrap();
+    let mut buf = vec![0; reader.output_buffer_size().unwrap()];
+    let frame = reader.next_frame(&mut buf).unwrap();
+    assert_eq!(frame.color_type, png::ColorType::Rgb);
+    buf[..frame.buffer_size()].as_chunks::<3>().0.iter().map(|p| *p == [255, 255, 255]).collect()
+}
+
+/// Export ▸ Images reads CCITT fax images: a page created from a 1-bit PNG (Group 4 now) exports as
+/// the picture, as does the picture coded the other way round with /BlackIs1. One whose /Columns
+/// aren't its width is skipped, not misread.
+#[test]
+fn ccitt_fax_images_export_as_their_picture() {
+    use png::{BitDepth, ColorType};
+    let (w, h) = (1200u32, 240u32);
+    let bits = strokes(w, h);
+    let stride = (w as usize).div_ceil(8);
+    let picture: Vec<bool> =
+        (0..h as usize).flat_map(|y| (0..w as usize).map(move |x| (y, x))).map(|(y, x)| bits[y * stride + x / 8] & (0x80 >> (x % 8)) != 0).collect();
+    let mut doc = from_images(&[("scan.png".into(), png_of(w, h, ColorType::Grayscale, BitDepth::One, &bits, None, None))]).unwrap();
+    assert_eq!(image_of(&doc, 0).name(b"Filter"), Some(&b"CCITTFaxDecode"[..]));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+    assert_eq!(exported_white(&out.images[0].data), picture);
+
+    // The same picture coded with 1 for black, which /BlackIs1 says.
+    let r = {
+        let page = pdfcraft_model::pages(&doc)[0].clone();
+        let res = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+        let xo = doc.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+        xo.get(b"Im0").and_then(Object::as_ref).unwrap()
+    };
+    let base = image_of(&doc, 0);
+    let with = |black_is_1: bool, columns: i64, data: Vec<u8>| {
+        let mut d = base.clone();
+        let mut parms = Dict::new();
+        parms.set(b"K".to_vec(), Object::Int(-1));
+        parms.set(b"Columns".to_vec(), Object::Int(columns));
+        parms.set(b"Rows".to_vec(), Object::Int(i64::from(h)));
+        parms.set(b"BlackIs1".to_vec(), Object::Bool(black_is_1));
+        d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        d.remove(b"Length");
+        Stream::from_raw(d, data)
+    };
+    let inverted: Vec<u8> = bits.iter().map(|b| !b).collect();
+    let stream = with(true, i64::from(w), pdfcraft_filters::encode_g4(&inverted, w, h).unwrap());
+    doc.set(r, Object::Stream(stream));
+    let out = extract_images(&doc, &[0], 0);
+    assert_eq!(exported_white(&out.images[0].data), picture, "BlackIs1");
+
+    let stream = with(false, i64::from(w) + 8, pdfcraft_filters::encode_g4(&bits, w, h).unwrap());
+    doc.set(r, Object::Stream(stream));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.images.is_empty() && out.skipped.len() == 1, "columns other than the width: skipped");
+}
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index c3281f00c4..bfd3dad7de 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -37,14 +37,13 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
 - **Monochrome images** (`Settings::mono`, CCITT Group 4 by default): a 1-bit image with one
   colour component (grey, indexed, a separation) or an image mask, stored with no filter or with
   general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
-  that is smaller as stored. It is lossless: the samples decode to the same bits, so the colour
+  that is smaller as stored. An eight-bit grey image of only 0 and 255 is packed to one bit first
+  (not an indexed image, whose samples are palette indices, nor one with a colour-key `/Mask`). It is lossless: the samples decode to the same bits, so the colour
   space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
   JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
   than 32,767 samples. Redaction doesn't decode Group 4 yet: a mark over part of an image stored
-  this way removes the whole image (nothing leaks). Nor does anything that exports an image:
-  Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML
-  export leave the picture out.
+  this way removes the whole image (nothing leaks).
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 75be8e3833..1ebbb025ad 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,6 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white pictures stay one bit when PDFs are created and optimized; CCITT images export; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
@@ -256,6 +257,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them; Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 02d7219aba..e7c515e610 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -6884,8 +6884,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["create.images"]
 tools = ["doc_create"]
-evidence = ["crates/create/src/tests.rs::jpeg_2000_images_are_embedded_as_is", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::embedded_icc_profiles_tag_the_image_colour_space"]
-notes = "PNG, JPEG, TIFF (multi-page), GIF (first frame), BMP, and JPEG 2000 (JP2 or codestream, embedded as JPXDecode with its capture resolution). JPEG and PNG ICC profiles are kept as /ICCBased; TIFF profiles are not read yet"
+evidence = ["crates/create/src/tests.rs::black_and_white_images_are_stored_at_one_bit", "crates/create/src/tests.rs::jpeg_2000_images_are_embedded_as_is", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::embedded_icc_profiles_tag_the_image_colour_space"]
+notes = "PNG, JPEG, TIFF (multi-page), GIF (first frame), BMP, and JPEG 2000 (JP2 or codestream, embedded as JPXDecode with its capture resolution). JPEG and PNG ICC profiles are kept as /ICCBased; TIFF profiles are not read yet. A picture of only pure black and white (a 1-bit PNG or TIFF, eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as CCITT Group 4 or Flate, whichever is smaller"
 
 [[feature]]
 id = "create.from-multipage-tiff"
@@ -7164,8 +7164,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["export.all_images"]
 tools = ["doc_export_all_images"]
-evidence = ["crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps"]
-notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2/CCITT masks are left out (image exported opaque); JPX/JBIG2/CCITT/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported."
+evidence = ["crates/create/src/tests.rs::ccitt_fax_images_export_as_their_picture", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps"]
+notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2 masks are left out (image exported opaque); JPX/JBIG2/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported. CCITT fax images (Group 3 and 4, with their /DecodeParms) export as their picture, masks included."
 
 [[feature]]
 id = "create.export-html"
@@ -7384,8 +7384,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
-evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks), nor does anything that exports an image: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
+evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside). Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 3204051c3b21b0c0d327c81512f9c94303fb3be1 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 01:35:31 +0200
Subject: [PATCH 167/270] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20re?=
 =?UTF-8?q?ads=20CCITT=20parameters=20given=20in=20an=20array?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A CCITT image whose /DecodeParms is a one-element array (common beside
/Filter [/CCITTFaxDecode]) was decoded with the default parameters: K 0
and 1728 columns. Wider scans were skipped, and a fax 1728 wide could be
misread. The parameters are now read from a dictionary or the one in an
array (ISO 32000-2 §7.4.2). The module doc no longer lists CCITT as
undecodable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/create/src/extract.rs | 17 +++++++++++++++--
 crates/create/src/tests.rs   | 13 +++++++++++--
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 16ecd5d8d4..a32b42556b 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -1,7 +1,7 @@
 //! Export a PDF ▸ Image ▸ Export all images, and Edit ▸ Save image as: the images that pages
 //! use, as files. JPEG images are written unchanged; other images, and JPEG images with
 //! transparency or with CMYK samples a viewer would read inverted, are decoded and written as PNG with their soft mask, stencil mask or colour
-//! key as alpha. Images PdfCraft can't decode yet (JPEG 2000, JBIG2, CCITT, separations) are
+//! key as alpha. Images PdfCraft can't decode yet (JPEG 2000, JBIG2, separations) are
 //! reported, never silently left out.
 
 use std::collections::HashSet;
@@ -110,6 +110,19 @@ fn decoded(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
     }
 }
 
+/// The `/DecodeParms` of a stream with one filter: a dictionary, or the one in an array (7.4.2).
+fn decode_parms(doc: &Document, s: &Stream) -> Dict {
+    let Some(p) = s.dict.get(b"DecodeParms").map(|p| doc.resolve(p)) else { return Dict::default() };
+    let p = match &*p {
+        Object::Array(a) => match a.first() {
+            Some(first) => doc.resolve(first),
+            None => return Dict::default(),
+        },
+        _ => p,
+    };
+    p.as_dict().cloned().unwrap_or_default()
+}
+
 /// [`decoded`] for a CCITT fax image, with its `/DecodeParms` (Table 11 defaults). `/Columns` has to
 /// be the image's width; pixels past it and rows past the image's height are dropped, so the output
 /// is bounded by the size the caller already checked. A stream that ends early gives fewer rows,
@@ -151,7 +164,7 @@ fn ccitt(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
             self.x = 0;
         }
     }
-    let p = s.dict.get(b"DecodeParms").map(|p| doc.resolve(p)).and_then(|p| p.as_dict().cloned()).unwrap_or_default();
+    let p = decode_parms(doc, s);
     let flag = |key: &[u8], default: bool| match p.get(key).map(|v| doc.resolve(v)).as_deref() {
         Some(Object::Bool(b)) => *b,
         _ => default,
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 9716470abb..3f47d6d6d6 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1517,8 +1517,8 @@ fn exported_white(png_data: &[u8]) -> Vec<bool> {
 }
 
 /// Export ▸ Images reads CCITT fax images: a page created from a 1-bit PNG (Group 4 now) exports as
-/// the picture, as does the picture coded the other way round with /BlackIs1. One whose /Columns
-/// aren't its width is skipped, not misread.
+/// the picture, as does the picture coded the other way round with /BlackIs1, and the picture with
+/// its filter and parameters in arrays. One whose /Columns aren't its width is skipped, not misread.
 #[test]
 fn ccitt_fax_images_export_as_their_picture() {
     use png::{BitDepth, ColorType};
@@ -1558,6 +1558,15 @@ fn ccitt_fax_images_export_as_their_picture() {
     let out = extract_images(&doc, &[0], 0);
     assert_eq!(exported_white(&out.images[0].data), picture, "BlackIs1");
 
+    let mut stream = with(false, i64::from(w), pdfcraft_filters::encode_g4(&bits, w, h).unwrap());
+    let parms = stream.dict.get(b"DecodeParms").cloned().unwrap();
+    stream.dict.set(b"DecodeParms".to_vec(), Object::Array(vec![parms]));
+    stream.dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("CCITTFaxDecode")]));
+    doc.set(r, Object::Stream(stream));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+    assert_eq!(exported_white(&out.images[0].data), picture, "in arrays");
+
     let stream = with(false, i64::from(w) + 8, pdfcraft_filters::encode_g4(&bits, w, h).unwrap());
     doc.set(r, Object::Stream(stream));
     let out = extract_images(&doc, &[0], 0);

From 66b5ad2ab7771ee2bc4489b759439c4742ab0d56 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 02:10:57 +0200
Subject: [PATCH 168/270] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20re?=
 =?UTF-8?q?ads=20CCITT=20numbers=20given=20by=20reference,=20and=20decodes?=
 =?UTF-8?q?=20up=20to=20the=20image's=20height?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A CCITT image whose /K, /Columns or /Rows is an indirect integer was read
with the defaults (K 0, 1728 columns), and one whose /Rows is below its
/Height was cut short and skipped. The numbers are now resolved, and the
image is decoded up to its /Height rows whatever /Rows says, still bounded
by the size the export checked (review of #4335).

The doc comment of the optimizer's bilevel step now says what Retain
leaves to the grey settings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/create/src/extract.rs  | 10 ++++++----
 crates/create/src/tests.rs    | 16 ++++++++++++++--
 crates/optimize/src/images.rs |  3 ++-
 3 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index a32b42556b..1053df2d78 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -169,15 +169,17 @@ fn ccitt(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
         Some(Object::Bool(b)) => *b,
         _ => default,
     };
-    let k = p.int(b"K").unwrap_or(0);
+    let int = |key: &[u8]| p.get(key).and_then(|v| doc.resolve(v).as_int());
+    let k = int(b"K").unwrap_or(0);
     // A row is the image's width: that was checked against the export's size limit, so a hostile
     // /Columns can't size the buffers.
-    let columns = u32::try_from(p.int(b"Columns").unwrap_or(1728)).ok().filter(|c| *c > 0).ok_or("the fax image has no columns")?;
+    let columns = u32::try_from(int(b"Columns").unwrap_or(1728)).ok().filter(|c| *c > 0).ok_or("the fax image has no columns")?;
     if s.dict.int(b"Width") != Some(i64::from(columns)) {
         return Err("the fax image's columns aren't its width".into());
     }
-    let height = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
-    let rows = p.int(b"Rows").and_then(|r| u32::try_from(r).ok()).filter(|r| *r > 0).unwrap_or(height).min(height);
+    // As many rows as the image has, whatever /Rows says: one below /Height would cut the picture
+    // short, and rows past /Height aren't drawn.
+    let rows = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
     let settings = hayro_ccitt::DecodeSettings {
         columns,
         rows,
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 3f47d6d6d6..8ad8a54cd8 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1517,8 +1517,9 @@ fn exported_white(png_data: &[u8]) -> Vec<bool> {
 }
 
 /// Export ▸ Images reads CCITT fax images: a page created from a 1-bit PNG (Group 4 now) exports as
-/// the picture, as does the picture coded the other way round with /BlackIs1, and the picture with
-/// its filter and parameters in arrays. One whose /Columns aren't its width is skipped, not misread.
+/// the picture, as does the picture coded the other way round with /BlackIs1, the picture with its
+/// filter and parameters in arrays, with /K and /Columns given by reference, and with a /Rows below
+/// its height. One whose /Columns aren't its width is skipped, not misread.
 #[test]
 fn ccitt_fax_images_export_as_their_picture() {
     use png::{BitDepth, ColorType};
@@ -1567,6 +1568,17 @@ fn ccitt_fax_images_export_as_their_picture() {
     assert!(out.skipped.is_empty(), "{:?}", out.skipped);
     assert_eq!(exported_white(&out.images[0].data), picture, "in arrays");
 
+    let mut stream = with(false, i64::from(w), pdfcraft_filters::encode_g4(&bits, w, h).unwrap());
+    let mut parms = stream.dict.get(b"DecodeParms").and_then(Object::as_dict).cloned().unwrap();
+    parms.set(b"K".to_vec(), Object::Ref(doc.add(Object::Int(-1))));
+    parms.set(b"Columns".to_vec(), Object::Ref(doc.add(Object::Int(i64::from(w)))));
+    parms.set(b"Rows".to_vec(), Object::Int(1));
+    stream.dict.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+    doc.set(r, Object::Stream(stream));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+    assert_eq!(exported_white(&out.images[0].data), picture, "/K and /Columns by reference, /Rows 1");
+
     let stream = with(false, i64::from(w) + 8, pdfcraft_filters::encode_g4(&bits, w, h).unwrap());
     doc.set(r, Object::Stream(stream));
     let out = extract_images(&doc, &[0], 0);
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 33e60256e0..7367f6d0db 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -608,7 +608,8 @@ fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stre
 /// `compression` asks (see [`mono`]), if that is smaller as stored. Lossless: a decode array maps
 /// 0 and 255 at eight bits as it maps 0 and 1 at one bit, so it stays. Left alone: indexed images
 /// (their samples are palette indices), a colour-key `/Mask` (its ranges are in eight-bit values),
-/// and everything when `compression` is Retain.
+/// and everything when `compression` is Retain: such an image is then a grey image like any other,
+/// which the grey settings handle as they did before.
 fn bilevel_grey(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stream> {
     if compression == MonoCompression::Retain {
         return None;

From 7ca7e01f921f40d12270e2621c688344beb26013 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 09:08:33 +0200
Subject: [PATCH 169/270] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20de?=
 =?UTF-8?q?codes=20CCITT=20fax=20images=20behind=20other=20filters?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A fax image with /Filter [/ASCII85Decode /CCITTFaxDecode], say, was
skipped: only a lone CCITT filter went to the CCITT decoder. Now the
filters before it are undone first, and its parameters are the
/DecodeParms entry at its own place in the array (ISO 32000-2 §7.4.1),
not the first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/create/README.md      |  2 +-
 crates/create/src/extract.rs | 48 +++++++++++++++++++++++-------------
 crates/create/src/tests.rs   | 24 ++++++++++++++++--
 parity/acrobat-features.toml |  2 +-
 4 files changed, 55 insertions(+), 21 deletions(-)

diff --git a/crates/create/README.md b/crates/create/README.md
index e8ed9a872c..8e0bdc68be 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -34,4 +34,4 @@ The existing 16-bit path still uses each sample's high byte.
 JPEG image Decode handling remains limited.
 ICC transforms and calibrated color conversion remain outside this export path.
 CCITT fax images (Group 3 and 4) are decoded for export through `hayro-ccitt` with their `/DecodeParms`
-(`/Columns` has to be the image's width); JPEG 2000 and JBIG2 images are still reported, not exported.
+(`/Columns` has to be the image's width), behind other filters such as `ASCII85Decode` too; JPEG 2000 and JBIG2 images are still reported, not exported.
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 1053df2d78..c67d80bd8b 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -4,6 +4,7 @@
 //! key as alpha. Images PdfCraft can't decode yet (JPEG 2000, JBIG2, separations) are
 //! reported, never silently left out.
 
+use std::borrow::Cow;
 use std::collections::HashSet;
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
@@ -100,34 +101,48 @@ fn filters(s: &Stream) -> Vec<Vec<u8>> {
     }
 }
 
-/// The samples of image `s`, decoded: through its filters, or, for a CCITT fax image (its only
-/// filter), through a CCITT decoder, as rows of one-bit samples each starting on a byte, with black
-/// as 0 unless `/BlackIs1` says 1, as `CCITTFaxDecode` gives them (ISO 32000-2 §7.4.6).
+/// The samples of image `s`, decoded: through its filters, or, for a CCITT fax image (its last
+/// filter), through the filters before it and then a CCITT decoder, as rows of one-bit samples
+/// each starting on a byte, with black as 0 unless `/BlackIs1` says 1, as `CCITTFaxDecode` gives
+/// them (ISO 32000-2 §7.4.6).
 fn decoded(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
-    match filters(s).as_slice() {
-        [f] if f == b"CCITTFaxDecode" || f == b"CCF" => ccitt(doc, s),
+    let names = filters(s);
+    match names.split_last() {
+        Some((f, outer)) if f == b"CCITTFaxDecode" || f == b"CCF" => {
+            // Such as ASCII85Decode, undone first (7.4.1).
+            let chain = s.filters();
+            let data = match chain.split_last() {
+                Some((_, before)) if !before.is_empty() => {
+                    Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, pdfcraft_cos::MAX_DECODED).map_err(|e| e.to_string())?.0)
+                }
+                _ => Cow::Borrowed(&s.raw[..]),
+            };
+            ccitt(doc, s, &data, decode_parms(doc, s, outer.len()))
+        }
         _ => s.decoded().map_err(|e| e.to_string()),
     }
 }
 
-/// The `/DecodeParms` of a stream with one filter: a dictionary, or the one in an array (7.4.2).
-fn decode_parms(doc: &Document, s: &Stream) -> Dict {
+/// The `/DecodeParms` of filter `index` of a stream: the dictionary of a stream with one filter,
+/// or that entry of an array (7.4.2).
+fn decode_parms(doc: &Document, s: &Stream, index: usize) -> Dict {
     let Some(p) = s.dict.get(b"DecodeParms").map(|p| doc.resolve(p)) else { return Dict::default() };
     let p = match &*p {
-        Object::Array(a) => match a.first() {
-            Some(first) => doc.resolve(first),
+        Object::Array(a) => match a.get(index) {
+            Some(entry) => doc.resolve(entry),
             None => return Dict::default(),
         },
-        _ => p,
+        _ if index == 0 => p,
+        _ => return Dict::default(),
     };
     p.as_dict().cloned().unwrap_or_default()
 }
 
-/// [`decoded`] for a CCITT fax image, with its `/DecodeParms` (Table 11 defaults). `/Columns` has to
-/// be the image's width; pixels past it and rows past the image's height are dropped, so the output
-/// is bounded by the size the caller already checked. A stream that ends early gives fewer rows,
-/// which the caller refuses.
-fn ccitt(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
+/// [`decoded`] for a CCITT fax image: `data`, coded with parameters `p` (Table 11 defaults).
+/// `/Columns` has to be the image's width; pixels past it and rows past the image's height are
+/// dropped, so the output is bounded by the size the caller already checked. A stream that ends
+/// early gives fewer rows, which the caller refuses.
+fn ccitt(doc: &Document, s: &Stream, data: &[u8], p: Dict) -> Result<Vec<u8>, String> {
     struct Rows {
         out: Vec<u8>,
         row: Vec<u8>,
@@ -164,7 +179,6 @@ fn ccitt(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
             self.x = 0;
         }
     }
-    let p = decode_parms(doc, s);
     let flag = |key: &[u8], default: bool| match p.get(key).map(|v| doc.resolve(v)).as_deref() {
         Some(Object::Bool(b)) => *b,
         _ => default,
@@ -197,7 +211,7 @@ fn ccitt(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
     let mut out =
         Rows { out: Vec::new(), row: vec![0; stride], x: 0, columns: columns as usize, rows: rows as usize, black_is_1: flag(b"BlackIs1", false) };
     // Rows decoded before damaged data are kept; too few rows are refused by the caller.
-    let _ = hayro_ccitt::decode(&s.raw, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
+    let _ = hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
     Ok(out.out)
 }
 
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 8ad8a54cd8..dd9414dc68 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1518,8 +1518,8 @@ fn exported_white(png_data: &[u8]) -> Vec<bool> {
 
 /// Export ▸ Images reads CCITT fax images: a page created from a 1-bit PNG (Group 4 now) exports as
 /// the picture, as does the picture coded the other way round with /BlackIs1, the picture with its
-/// filter and parameters in arrays, with /K and /Columns given by reference, and with a /Rows below
-/// its height. One whose /Columns aren't its width is skipped, not misread.
+/// filter and parameters in arrays, with /K and /Columns given by reference, with a /Rows below its
+/// height, and behind another filter. One whose /Columns aren't its width is skipped, not misread.
 #[test]
 fn ccitt_fax_images_export_as_their_picture() {
     use png::{BitDepth, ColorType};
@@ -1579,6 +1579,26 @@ fn ccitt_fax_images_export_as_their_picture() {
     assert!(out.skipped.is_empty(), "{:?}", out.skipped);
     assert_eq!(exported_white(&out.images[0].data), picture, "/K and /Columns by reference, /Rows 1");
 
+    // Behind another filter, with its parameters second in the array, as 7.4.1 pairs them.
+    let g4 = pdfcraft_filters::encode_g4(&bits, w, h).unwrap();
+    let hex = g4.iter().map(|b| format!("{b:02x}")).chain([">".to_string()]).collect::<String>().into_bytes();
+    for (outer, data) in [("ASCIIHexDecode", hex), ("FlateDecode", pdfcraft_filters::encode_flate(&g4))] {
+        let mut stream = with(false, i64::from(w), data);
+        let parms = stream.dict.get(b"DecodeParms").cloned().unwrap();
+        stream.dict.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Null, parms]));
+        stream.dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name(outer), Object::name("CCITTFaxDecode")]));
+        doc.set(r, Object::Stream(stream));
+        let out = extract_images(&doc, &[0], 0);
+        assert!(out.skipped.is_empty(), "{outer}: {:?}", out.skipped);
+        assert_eq!(exported_white(&out.images[0].data), picture, "behind {outer}");
+    }
+    // CCITT before another filter isn't a picture yet.
+    let mut stream = with(false, i64::from(w), pdfcraft_filters::encode_flate(&g4));
+    stream.dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("CCITTFaxDecode"), Object::name("FlateDecode")]));
+    doc.set(r, Object::Stream(stream));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.images.is_empty() && out.skipped.len() == 1, "CCITT, then Flate: skipped");
+
     let stream = with(false, i64::from(w) + 8, pdfcraft_filters::encode_g4(&bits, w, h).unwrap());
     doc.set(r, Object::Stream(stream));
     let out = extract_images(&doc, &[0], 0);
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index e7c515e610..bf96832b16 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7165,7 +7165,7 @@ status = "shipped"
 commands = ["export.all_images"]
 tools = ["doc_export_all_images"]
 evidence = ["crates/create/src/tests.rs::ccitt_fax_images_export_as_their_picture", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps"]
-notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2 masks are left out (image exported opaque); JPX/JBIG2/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported. CCITT fax images (Group 3 and 4, with their /DecodeParms) export as their picture, masks included."
+notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2 masks are left out (image exported opaque); JPX/JBIG2/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported. CCITT fax images (Group 3 and 4, with their /DecodeParms, behind other filters too) export as their picture, masks included."
 
 [[feature]]
 id = "create.export-html"

From 8af04af01b4fe121f681188973f1ec5a02642a22 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 10:18:48 +0200
Subject: [PATCH 170/270] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20re?=
 =?UTF-8?q?ads=20/DecodeParms=20given=20by=20reference?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Stream::decoded reads only direct parameter dictionaries, so an image
behind [/FlateDecode /CCITTFaxDecode] whose Flate entry is a reference
lost its predictor, and the CCITT decoder got the predictor's bytes; a
plain Flate image with its predictor given by reference was misread the
same way. Export now decodes through
pdfcraft_cos::Document::with_direct_parms (#4304), as the optimizer
does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/create/src/extract.rs |  2 ++
 crates/create/src/tests.rs   | 19 ++++++++++++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index c67d80bd8b..9b6925d16d 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -106,6 +106,8 @@ fn filters(s: &Stream) -> Vec<Vec<u8>> {
 /// each starting on a byte, with black as 0 unless `/BlackIs1` says 1, as `CCITTFaxDecode` gives
 /// them (ISO 32000-2 §7.4.6).
 fn decoded(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
+    // Parameters given by reference, which the filters read only once direct.
+    let s = &*doc.with_direct_parms(s);
     let names = filters(s);
     match names.split_last() {
         Some((f, outer)) if f == b"CCITTFaxDecode" || f == b"CCF" => {
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index dd9414dc68..554dc01ff8 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1519,7 +1519,8 @@ fn exported_white(png_data: &[u8]) -> Vec<bool> {
 /// Export ▸ Images reads CCITT fax images: a page created from a 1-bit PNG (Group 4 now) exports as
 /// the picture, as does the picture coded the other way round with /BlackIs1, the picture with its
 /// filter and parameters in arrays, with /K and /Columns given by reference, with a /Rows below its
-/// height, and behind another filter. One whose /Columns aren't its width is skipped, not misread.
+/// height, and behind another filter (its parameters by reference too). One whose /Columns aren't
+/// its width is skipped, not misread.
 #[test]
 fn ccitt_fax_images_export_as_their_picture() {
     use png::{BitDepth, ColorType};
@@ -1592,6 +1593,22 @@ fn ccitt_fax_images_export_as_their_picture() {
         assert!(out.skipped.is_empty(), "{outer}: {:?}", out.skipped);
         assert_eq!(exported_white(&out.images[0].data), picture, "behind {outer}");
     }
+    // Behind Flate with a PNG predictor, whose parameters are given by reference.
+    let padded: Vec<u8> = g4.iter().copied().chain(std::iter::repeat_n(0, 16 - g4.len() % 16)).collect();
+    let params = pdfcraft_filters::Params { predictor: 12, colors: 1, bits_per_component: 8, columns: 16, early_change: 1 };
+    let predicted = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &padded).unwrap();
+    let mut flate_parms = Dict::new();
+    flate_parms.set(b"Predictor".to_vec(), Object::Int(12));
+    flate_parms.set(b"Columns".to_vec(), Object::Int(16));
+    let flate_parms = doc.add(Object::Dict(flate_parms));
+    let mut stream = with(false, i64::from(w), predicted);
+    let parms = stream.dict.get(b"DecodeParms").cloned().unwrap();
+    stream.dict.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Ref(flate_parms), parms]));
+    stream.dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"), Object::name("CCITTFaxDecode")]));
+    doc.set(r, Object::Stream(stream));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+    assert_eq!(exported_white(&out.images[0].data), picture, "behind Flate with a predictor given by reference");
     // CCITT before another filter isn't a picture yet.
     let mut stream = with(false, i64::from(w), pdfcraft_filters::encode_flate(&g4));
     stream.dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("CCITTFaxDecode"), Object::name("FlateDecode")]));

From 546f78c042cd0a93ad38359f06a6a0b2d1f88af1 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 11:32:14 +0200
Subject: [PATCH 171/270] M11: the optimizer reads eight-bit grey through
 /DecodeParms given by reference

Packing eight-bit black-and-white grey to one bit decoded with
Stream::decoded, which ignores /DecodeParms given by reference. With PNG
predictor 10 each row then kept its tag byte, a 0, so the shifted rows
still passed as black and white and were packed and stored skewed. It
now decodes through Document::with_direct_parms (#4304), and the test
of images with their parameters by reference covers this case.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/optimize/src/images.rs     |  4 +++-
 crates/optimize/tests/optimize.rs | 34 ++++++++++++++++++++++---------
 2 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 7367f6d0db..08e65d037c 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -633,7 +633,9 @@ fn bilevel_grey(doc: &Document, s: &Stream, compression: MonoCompression) -> Opt
         return None;
     }
     let (w, h) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
-    let samples = s.decoded().ok()?;
+    // Through its parameters given by reference too: without a PNG predictor's tag bytes taken
+    // off, rows of 0 and 255 would still pass below, each shifted by a byte.
+    let samples = doc.with_direct_parms(s).decoded().ok()?;
     let samples = samples.get(..w.checked_mul(h)?)?;
     let stride = w.div_ceil(8);
     let mut packed = vec![0u8; stride.checked_mul(h)?];
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 8993c598f8..f861da9d20 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -475,9 +475,10 @@ fn group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit() {
 /// An image whose /DecodeParms are a reference, or hold numbers given by reference
 /// (`/Predictor 9 0 R`, which `Dict::int` doesn't follow), is read through them, as one with them
 /// direct: a predictor's tag bytes would otherwise shift every row, and the image would be stored
-/// again wrong. Here a 1-bit image with a PNG predictor (stored again as Group 4) and an eight-bit
-/// grey one with a PNG predictor at 600 ppi (resampled) come out byte for byte as with direct
-/// parameters.
+/// again wrong. Here a 1-bit image with a PNG predictor (stored again as Group 4), an eight-bit
+/// grey one with a PNG predictor at 600 ppi (resampled), and an eight-bit one of only black and
+/// white with PNG predictor 10 (each row's tag a 0, so the shifted rows would still be black and
+/// white; packed to one bit) come out byte for byte as with direct parameters.
 #[test]
 fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
     let build = |how: &str| {
@@ -485,6 +486,7 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
         let (w, h) = (1200u32, 480u32);
         let grey = [("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))];
         let one_bit = mono_image(&mut doc, w, h, &bilevel(w, h, false), Some(15), &grey);
+        let black_and_white_samples = eight_bit(&bilevel(w, h, false), w, h);
         let shades: Vec<u8> = (0..w * h).map(|i| ((i % w) * 255 / w) as u8 ^ ((i / w) as u8 & 0x0F)).collect();
         let params = pdfcraft_filters::Params { predictor: 15, colors: 1, bits_per_component: 8, columns: w as i64, early_change: 1 };
         let mut parms = Dict::new();
@@ -500,8 +502,15 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
         d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
         d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
         let coded = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &shades).unwrap();
-        let eight_bit = doc.add(Object::Stream(Stream::from_raw(d, coded)));
-        for r in [one_bit, eight_bit] {
+        let eight_bit = doc.add(Object::Stream(Stream::from_raw(d.clone(), coded)));
+        let params = pdfcraft_filters::Params { predictor: 10, ..params };
+        let mut parms = Dict::new();
+        parms.set(b"Predictor".to_vec(), Object::Int(10));
+        parms.set(b"Columns".to_vec(), Object::Int(w as i64));
+        d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        let black_and_white = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &black_and_white_samples).unwrap();
+        let packed = doc.add(Object::Stream(Stream::from_raw(d, black_and_white)));
+        for r in [one_bit, eight_bit, packed] {
             let mut s = stream(&doc, r);
             let Some(Object::Dict(mut parms)) = s.dict.get(b"DecodeParms").cloned() else { panic!("{:?}", s.dict) };
             let made = match how {
@@ -519,13 +528,18 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
             doc.set(r, Object::Stream(s));
         }
         // 300 × 120 pt is 288 ppi; 144 × 57.6 pt is 600 ppi.
-        page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
-        let before = [one_bit, eight_bit].map(|r| stream(&doc, r).raw);
+        page(
+            &mut doc,
+            &[("A", one_bit), ("B", eight_bit), ("C", packed)],
+            "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q q 300 0 0 120 20 200 cm /C Do Q",
+        );
+        let before = [one_bit, eight_bit, packed].map(|r| stream(&doc, r).raw);
         let r = optimize(&mut doc, &Settings::default()).unwrap();
-        assert_eq!((r.images_resampled, r.images_recompressed), (1, 1), "{r:?}");
-        let after = [one_bit, eight_bit].map(|r| stream(&doc, r));
-        assert!(before.iter().zip(&after).all(|(b, a)| *b != a.raw), "both stored again");
+        assert_eq!((r.images_resampled, r.images_recompressed), (1, 2), "{r:?}");
+        let after = [one_bit, eight_bit, packed].map(|r| stream(&doc, r));
+        assert!(before.iter().zip(&after).all(|(b, a)| *b != a.raw), "all stored again");
         assert_eq!(after[0].dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]));
+        assert_eq!((after[2].dict.int(b"BitsPerComponent"), after[2].dict.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])));
         after.map(|s| s.raw)
     };
     let direct = build("direct");

From f33227886d1729b756795126422e8c0b8fdad338 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:00:50 +0100
Subject: [PATCH 172/270] M11: eight-bit black-and-white grey takes the smaller
 of one bit and the grey settings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An eight-bit grey image of only black and white was packed to one bit
and stored, and the grey settings never saw it. For a dithered scan that
is bigger than what Reduce File Size made of it before, downsampled to
JPEG: 1-bit Flate can't shrink the dots (a 1200 × 1500 dither at 300 ppi
was 157 KB packed, 67 KB as before). Both are made now, and the smaller
as stored wins, counting a soft mask resampled with the image. Clean
text still packs to one bit. The packing also decodes no further than
its samples can need, as the other image steps do now.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/README.md         |  4 +-
 crates/optimize/src/images.rs     | 32 +++++++++++--
 crates/optimize/tests/optimize.rs | 77 ++++++++++++++++++++++++++++---
 parity/acrobat-features.toml      |  2 +-
 4 files changed, 101 insertions(+), 14 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index bfd3dad7de..518910fea4 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -38,7 +38,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   colour component (grey, indexed, a separation) or an image mask, stored with no filter or with
   general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
   that is smaller as stored. An eight-bit grey image of only 0 and 255 is packed to one bit first
-  (not an indexed image, whose samples are palette indices, nor one with a colour-key `/Mask`). It is lossless: the samples decode to the same bits, so the colour
+  (not an indexed image, whose samples are palette indices, nor one with a colour-key `/Mask`),
+  unless the grey settings make it smaller still, as they can a dithered scan by downsampling it
+  to JPEG. It is lossless: the samples decode to the same bits, so the colour
   space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
   JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 08e65d037c..8550affb5c 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -635,7 +635,7 @@ fn bilevel_grey(doc: &Document, s: &Stream, compression: MonoCompression) -> Opt
     let (w, h) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
     // Through its parameters given by reference too: without a PNG predictor's tag bytes taken
     // off, rows of 0 and 255 would still pass below, each shifted by a byte.
-    let samples = doc.with_direct_parms(s).decoded().ok()?;
+    let samples = doc.with_direct_parms(s).decoded_within(allowance(w.checked_mul(h)?, u32::try_from(h).ok()?)?).ok()?;
     let samples = samples.get(..w.checked_mul(h)?)?;
     let stride = w.div_ceil(8);
     let mut packed = vec![0u8; stride.checked_mul(h)?];
@@ -686,16 +686,38 @@ pub(crate) fn run(
         let obj = doc.get(r);
         let Object::Stream(s) = &*obj else { continue };
         report.images += 1;
-        if let Some(new) = mono(doc, s, settings.mono).or_else(|| bilevel_grey(doc, s, settings.mono)) {
+        if let Some(new) = mono(doc, s, settings.mono) {
             report.image_bytes_before += s.raw.len();
             report.image_bytes_after += new.raw.len();
             report.images_recompressed += 1;
             doc.set(r, Object::Stream(new));
             continue;
         }
-        let Some(n) = s.dict.get(b"ColorSpace").and_then(|cs| components(doc, cs)) else { continue };
-        let st = if n == 1 { &settings.gray } else { &settings.color };
-        let Some((new, smask)) = process(doc, s, ppi, st, n) else { continue };
+        let packed = bilevel_grey(doc, s, settings.mono);
+        let n = s.dict.get(b"ColorSpace").and_then(|cs| components(doc, cs));
+        let processed = n.and_then(|n| process(doc, s, ppi, if n == 1 { &settings.gray } else { &settings.color }, n));
+        // An image packed from eight bits is lossless at one bit, but the grey settings can make it
+        // smaller still (a dithered scan, downsampled and JPEG-compressed): the smaller wins,
+        // counting a soft mask resampled with it.
+        let smask_len = |smask: Option<&(ObjRef, Stream)>| match smask {
+            Some((_, m)) => Some(m.raw.len()),
+            None => s.dict.reference(b"SMask").map(|m| match &*doc.get(m) {
+                Object::Stream(m) => m.raw.len(),
+                _ => 0,
+            }),
+        };
+        let total = |new: &Stream, smask: Option<&(ObjRef, Stream)>| Some(crate::stored_len(new)?.saturating_add(smask_len(smask).unwrap_or(0)));
+        let packed_wins = packed.as_ref().is_some_and(|p| {
+            processed.as_ref().is_none_or(|(new, smask)| total(p, None).zip(total(new, smask.as_ref())).is_some_and(|(a, b)| a <= b))
+        });
+        if let Some(new) = packed.filter(|_| packed_wins) {
+            report.image_bytes_before += s.raw.len();
+            report.image_bytes_after += new.raw.len();
+            report.images_recompressed += 1;
+            doc.set(r, Object::Stream(new));
+            continue;
+        }
+        let Some((new, smask)) = processed else { continue };
         let resized = new.dict.int(b"Width") != s.dict.int(b"Width") || new.dict.int(b"Height") != s.dict.int(b"Height");
         report.image_bytes_before += s.raw.len();
         report.image_bytes_after += new.raw.len();
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index f861da9d20..73ed54d6b1 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -548,9 +548,10 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
 }
 
 /// An image whose data decodes far past what its samples can need (a decompression bomb) is left
-/// alone rather than decoded up to the 1 GiB limit: a 1-bit one that would become Group 4, and an
-/// eight-bit one that would be resampled, each with four megabytes of zeros after its samples. Stored
-/// as ASCIIHex text under Flate, broken into lines of 64 digits, their samples aren't a bomb.
+/// alone rather than decoded up to the 1 GiB limit: a 1-bit one that would become Group 4, an
+/// eight-bit one that would be resampled, and an eight-bit one of only black and white that would
+/// be packed to one bit, each with four megabytes of zeros after its samples. Stored as ASCIIHex
+/// text under Flate, broken into lines of 64 digits, their samples aren't a bomb.
 #[test]
 fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
     let (w, h) = (1200u32, 480u32);
@@ -562,13 +563,18 @@ fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
         let grey = |bits: i64| [("BitsPerComponent", bits.into()), ("ColorSpace", Object::name("DeviceGray"))];
         let one_bit = mono_image(&mut doc, w, h, &padded(&text), None, &grey(1));
         let eight_bit = mono_image(&mut doc, w, h, &padded(&shades), None, &grey(8));
+        let packed = mono_image(&mut doc, w, h, &padded(&self::eight_bit(&text, w, h)), None, &grey(8));
         // 300 × 120 pt is 288 ppi; 144 × 57.6 pt is 600 ppi.
-        page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
-        let before = [one_bit, eight_bit].map(|r| stream(&doc, r).raw);
+        page(
+            &mut doc,
+            &[("A", one_bit), ("B", eight_bit), ("C", packed)],
+            "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q q 300 0 0 120 20 200 cm /C Do Q",
+        );
+        let before = [one_bit, eight_bit, packed].map(|r| stream(&doc, r).raw);
         let r = optimize(&mut doc, &Settings::default()).unwrap();
-        let after = [one_bit, eight_bit].map(|r| stream(&doc, r).raw);
+        let after = [one_bit, eight_bit, packed].map(|r| stream(&doc, r).raw);
         if padding == 0 {
-            assert_eq!((r.images_resampled, r.images_recompressed), (1, 1), "{r:?}");
+            assert_eq!((r.images_resampled, r.images_recompressed), (1, 2), "{r:?}");
         } else {
             assert_eq!((r.images_resampled, r.images_recompressed), (0, 0), "{r:?}");
             assert_eq!(after, before);
@@ -608,6 +614,63 @@ fn eight_bit(bits: &[u8], w: u32, h: u32) -> Vec<u8> {
     (0..h as usize).flat_map(|y| (0..w as usize).map(move |x| if bits[y * stride + x / 8] & (0x80 >> (x % 8)) != 0 { 255 } else { 0 })).collect()
 }
 
+/// Eight-bit samples of only 0 and 255, dithered (Floyd–Steinberg) from a smooth picture as a
+/// scanner's halftone mode gives them: no shade but black and white, in short runs.
+fn dithered(w: u32, h: u32) -> Vec<u8> {
+    let (w, h) = (w as usize, h as usize);
+    let mut level: Vec<f32> = (0..w * h).map(|i| 127.5 + 127.5 * ((i % w) as f32 / 37.0).sin() * ((i / w) as f32 / 53.0).cos()).collect();
+    let mut out = vec![0u8; w * h];
+    for y in 0..h {
+        for x in 0..w {
+            let i = y * w + x;
+            let v = if level[i] < 128.0 { 0.0 } else { 255.0 };
+            out[i] = v as u8;
+            let e = level[i] - v;
+            if x + 1 < w {
+                level[i + 1] += e * 7.0 / 16.0;
+            }
+            if y + 1 < h {
+                if x > 0 {
+                    level[i + w - 1] += e * 3.0 / 16.0;
+                }
+                level[i + w] += e * 5.0 / 16.0;
+                if x + 1 < w {
+                    level[i + w + 1] += e / 16.0;
+                }
+            }
+        }
+    }
+    out
+}
+
+/// A dithered scan stored as eight-bit grey of only black and white is smaller downsampled and
+/// JPEG-compressed by the grey settings than packed to one bit, which can't shrink its dots: the
+/// smaller wins, so Reduce File Size makes it no larger than with Monochrome Images on Retain.
+/// Clean text is still packed to one bit at the same resolution.
+#[test]
+fn eight_bit_black_and_white_takes_the_smaller_of_one_bit_and_the_grey_settings() {
+    let (w, h) = (1200u32, 1500u32);
+    for (what, samples) in [("dither", dithered(w, h)), ("text", eight_bit(&bilevel(w, h, false), w, h))] {
+        let build = || {
+            let mut doc = Document::new_empty();
+            let img = mono_image(&mut doc, w, h, &samples, None, &[("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+            // 288 × 360 pt is 300 ppi, above where the grey settings downsample.
+            page(&mut doc, &[("A", img)], "q 288 0 0 360 20 400 cm /A Do Q");
+            (doc, img)
+        };
+        let (mut doc, img) = build();
+        optimize(&mut doc, &Settings::default()).unwrap();
+        let (mut retained, _) = build();
+        optimize(&mut retained, &Settings { mono: MonoCompression::Retain, ..Settings::default() }).unwrap();
+        let (s, kept) = (stream(&doc, img), stream(&retained, img));
+        let bits = if what == "dither" { 8 } else { 1 };
+        assert_eq!(s.dict.int(b"BitsPerComponent"), Some(bits), "{what}: {} bytes, {} with Retain", s.raw.len(), kept.raw.len());
+        if what == "dither" {
+            assert!(s.raw.len() <= kept.raw.len(), "{what}: {} bytes, {} with Retain", s.raw.len(), kept.raw.len());
+        }
+    }
+}
+
 /// Eight-bit grey images of only black and white (as some scanners and converters write scans)
 /// become one-bit Group 4, losslessly: the page looks the same, an inverting decode array
 /// included. Not touched by this: a grey image with any other shade, an indexed image (its samples
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index bf96832b16..81c971dbc8 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside). Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still (a dithered scan downsampled to JPEG). Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 096f6431c7d5557fbfe1af5b8f812811db1b2c9f Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:05:28 +0100
Subject: [PATCH 173/270] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20re?=
 =?UTF-8?q?ads=20a=20lookup=20table's=20/DecodeParms=20given=20by=20refere?=
 =?UTF-8?q?nce;=20tests=20for=20its=20claims?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- An indexed image's lookup table given as a stream was decoded without
  its /DecodeParms when they came by reference, so a PNG predictor's tag
  bytes ran into the colours (red and blue came out [2,255,0] and black).
  It decodes through with_direct_parms now, as the samples do. This was
  already so on main; #4320 makes the same change.
- Tests for what this PR claims and no test held: Group 3 one-
  dimensional data exports as its picture (mapping /K 0 to Group 4 gave
  all white and passed); CCITT soft and stencil masks export as the same
  masks in Flate (decoding them plainly dropped them and passed); a
  Flate image's predictor given by reference reads as direct; and a
  1-bit TIFF is stored as Group 4 (the TIFF test said "a 1-bit one" but
  wrote eight bits; its comment now says what it writes).

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/create/src/extract.rs |   8 +-
 crates/create/src/tests.rs   | 161 ++++++++++++++++++++++++++++++++++-
 2 files changed, 165 insertions(+), 4 deletions(-)

diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 9b6925d16d..d9895ffdd2 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -519,9 +519,11 @@ fn space(doc: &Document, cs: Option<&Object>) -> Result<Space, String> {
                 };
                 let table = match a.get(3).map(|t| doc.resolve(t)).as_deref() {
                     Some(Object::String(s)) => s.bytes.clone(),
-                    Some(Object::Stream(t)) => {
-                        t.decoded_within(MAX_LOOKUP).map_err(|_| "an indexed colour space with an oversized or damaged lookup table".to_string())?
-                    }
+                    // Through its parameters given by reference too, as the image's samples.
+                    Some(Object::Stream(t)) => doc
+                        .with_direct_parms(t)
+                        .decoded_within(MAX_LOOKUP)
+                        .map_err(|_| "an indexed colour space with an oversized or damaged lookup table".to_string())?,
                     _ => return Err("an indexed colour space without a lookup table".into()),
                 };
                 Ok(Space::Indexed(Box::new(base), hival, table))
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 554dc01ff8..7bb1b80066 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -186,7 +186,7 @@ fn bmp_gif_and_multi_page_tiff_images() {
         let mut enc = image::codecs::gif::GifEncoder::new(&mut gif);
         enc.encode(img.as_raw(), 2, 2, image::ExtendedColorType::Rgba8).unwrap();
     }
-    // TIFF: two pages, an 8-bit gray one at 144 dpi and a 1-bit one.
+    // TIFF: two 8-bit gray pages, one at 144 dpi and one of only black and white.
     let mut tif = std::io::Cursor::new(Vec::new());
     {
         let mut enc = tiff::encoder::TiffEncoder::new(&mut tif).unwrap();
@@ -1295,6 +1295,48 @@ fn a_cyclic_indexed_colour_space_is_refused() {
     assert_eq!(out.skipped.len(), 1, "{:?}", out.skipped);
 }
 
+/// A baseline TIFF of one uncompressed strip of 1-bit samples, `packed` rows each starting on a
+/// byte, 0 for black (BlackIsZero; TIFF 6.0, section 3): the `tiff` crate writes no 1-bit images.
+fn one_bit_tiff(w: u32, h: u32, packed: &[u8]) -> Vec<u8> {
+    // Tag, type (3 SHORT, 4 LONG), value; the strip follows the IFD.
+    let entries: [(u16, u16, u32); 8] =
+        [(256, 4, w), (257, 4, h), (258, 3, 1), (259, 3, 1), (262, 3, 1), (273, 4, 0), (278, 4, h), (279, 4, packed.len() as u32)];
+    let strip = 8 + 2 + entries.len() as u32 * 12 + 4;
+    let mut out = b"II*\0".to_vec();
+    out.extend(8u32.to_le_bytes());
+    out.extend((entries.len() as u16).to_le_bytes());
+    for (tag, kind, value) in entries {
+        let value = if tag == 273 { strip } else { value };
+        out.extend(tag.to_le_bytes());
+        out.extend(kind.to_le_bytes());
+        out.extend(1u32.to_le_bytes());
+        match kind {
+            3 => out.extend((value as u16).to_le_bytes().into_iter().chain([0, 0])),
+            _ => out.extend(value.to_le_bytes()),
+        }
+    }
+    out.extend(0u32.to_le_bytes());
+    out.extend_from_slice(packed);
+    out
+}
+
+/// A bilevel TIFF (one bit a sample) stays one bit, stored as Group 4 when that is smaller, and
+/// exports as its picture.
+#[test]
+fn a_one_bit_tiff_is_stored_as_group_4() {
+    let (w, h) = (1200u32, 240u32);
+    let bits = strokes(w, h);
+    let stride = (w as usize).div_ceil(8);
+    let picture: Vec<bool> =
+        (0..(w * h) as usize).map(|i| bits[i / w as usize * stride + i % w as usize / 8] & (0x80 >> (i % w as usize % 8)) != 0).collect();
+    let doc = from_images(&[("scan.tif".into(), one_bit_tiff(w, h, &bits))]).unwrap();
+    let im = image_of(&doc, 0);
+    assert_eq!((im.int(b"BitsPerComponent"), im.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+    assert_eq!(exported_white(&out.images[0].data), picture);
+}
+
 /// A TIFF of `pages` 64×64 gray pages, then (with `unreadable`) one whose samples Create can't read.
 fn gray_tiff(pages: usize, unreadable: bool) -> Vec<u8> {
     let mut tif = std::io::Cursor::new(Vec::new());
@@ -1621,3 +1663,120 @@ fn ccitt_fax_images_export_as_their_picture() {
     let out = extract_images(&doc, &[0], 0);
     assert!(out.images.is_empty() && out.skipped.len() == 1, "columns other than the width: skipped");
 }
+
+/// Group 3 data: rows of run lengths, white first, coded one-dimensionally (ITU-T T.4) with no
+/// end-of-line codes, from the few codes these runs need.
+fn group_3(rows: &[&[u32]]) -> Vec<u8> {
+    let code = |white: bool, run: u32| match (white, run) {
+        (true, 16) => "101010",
+        (true, 32) => "00011011",
+        (false, 16) => "0000010111",
+        (false, 32) => "000001101010",
+        _ => panic!("no code here for a run of {run}"),
+    };
+    let bits: String = rows.iter().flat_map(|row| row.iter().enumerate().map(|(i, run)| code(i % 2 == 0, *run))).collect();
+    bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
+}
+
+/// What Export ▸ Images claims for CCITT and for parameters given by reference, each checked
+/// against the same picture stored another way: Group 3 one-dimensional data (`/K 0`) exports as
+/// its picture; a CCITT soft mask and a CCITT stencil `/Mask` export as the same masks in Flate;
+/// and a Flate image's PNG predictor, and an indexed image's lookup table stream with one, read
+/// the same with their `/DecodeParms` given by reference as direct.
+#[test]
+fn group_3_ccitt_masks_and_parameters_by_reference_export_as_their_picture() {
+    use png::{BitDepth, ColorType};
+    let (w, h) = (64u32, 16u32);
+    let rows: Vec<&[u32]> = (0..h).map(|y| if y % 2 == 0 { &[32u32, 32][..] } else { &[16, 16, 32][..] }).collect();
+    let mut bits = vec![0u8; 8 * h as usize];
+    for (y, runs) in rows.iter().enumerate() {
+        let mut x = 0;
+        for (i, run) in runs.iter().enumerate() {
+            if i % 2 == 0 {
+                (x..x + *run as usize).for_each(|xx| bits[y * 8 + xx / 8] |= 0x80 >> (xx % 8));
+            }
+            x += *run as usize;
+        }
+    }
+    let picture: Vec<bool> = (0..(w * h) as usize).map(|i| bits[i / 8] & (0x80 >> (i % 8)) != 0).collect();
+    let mut doc = from_images(&[("scan.png".into(), png_of(w, h, ColorType::Grayscale, BitDepth::One, &bits, None, None))]).unwrap();
+    let r = {
+        let page = pdfcraft_model::pages(&doc)[0].clone();
+        let res = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+        let xo = doc.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+        xo.get(b"Im0").and_then(Object::as_ref).unwrap()
+    };
+    let image = |entries: &[(&str, Object)]| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        for (k, v) in entries {
+            d.set(k.as_bytes().to_vec(), v.clone());
+        }
+        d
+    };
+    let fax = |k: i64| {
+        let mut parms = Dict::new();
+        parms.set(b"K".to_vec(), Object::Int(k));
+        parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+        parms.set(b"Rows".to_vec(), Object::Int(h.into()));
+        [("Filter", Object::name("CCITTFaxDecode")), ("DecodeParms", Object::Dict(parms))]
+    };
+    let grey = |bits: i64| [("BitsPerComponent", Object::Int(bits)), ("ColorSpace", Object::name("DeviceGray"))];
+
+    let d = image(&[&grey(1)[..], &fax(0)].concat());
+    doc.set(r, Object::Stream(Stream::from_raw(d, group_3(&rows))));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+    assert_eq!(exported_white(&out.images[0].data), picture, "Group 3");
+
+    // A grey picture under the same bits as a soft mask, then as a stencil mask: CCITT against Flate.
+    let g4 = pdfcraft_filters::encode_g4(&bits, w, h).unwrap();
+    for (key, mask) in [("SMask", grey(1).to_vec()), ("Mask", vec![("ImageMask", Object::Bool(true))])] {
+        let mut exported = Vec::new();
+        for coded in [true, false] {
+            let m = if coded { Stream::from_raw(image(&[&mask[..], &fax(-1)].concat()), g4.clone()) } else { Stream::flate(image(&mask), &bits) };
+            let m = doc.add(Object::Stream(m));
+            let d = image(&[&grey(8)[..], &[(key, Object::Ref(m))]].concat());
+            doc.set(r, Object::Stream(Stream::flate(d, &vec![100u8; (w * h) as usize])));
+            exported.push(exported_rgba(&doc));
+        }
+        assert!(exported[0].1.chunks(4).any(|p| p[3] == 0), "{key}: masked somewhere");
+        assert_eq!(exported[0], exported[1], "{key}: CCITT as Flate");
+    }
+
+    // A PNG predictor given by reference, for the samples and for a lookup table.
+    let predicted = |rows: &[u8], columns: i64| {
+        let params = pdfcraft_filters::Params { predictor: 12, colors: 1, bits_per_component: 8, columns, early_change: 1 };
+        let mut parms = Dict::new();
+        parms.set(b"Predictor".to_vec(), Object::Int(12));
+        parms.set(b"Columns".to_vec(), Object::Int(columns));
+        (pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, rows).unwrap(), parms)
+    };
+    let shades: Vec<u8> = (0..w * h).map(|i| (i * 7 % 256) as u8).collect();
+    let (table, table_parms) = predicted(&[255, 0, 0, 0, 0, 255], 3);
+    let indices: Vec<u8> = (0..w * h).map(|i| (i % 3 % 2) as u8).collect();
+    let mut exported = Vec::new();
+    for by_reference in [false, true] {
+        let parms = |doc: &mut Document, p: &Dict| if by_reference { Object::Ref(doc.add(Object::Dict(p.clone()))) } else { Object::Dict(p.clone()) };
+        let (samples, sample_parms) = predicted(&shades, w.into());
+        let sample_parms = parms(&mut doc, &sample_parms);
+        let d = image(&[&grey(8)[..], &[("Filter", Object::name("FlateDecode")), ("DecodeParms", sample_parms)]].concat());
+        doc.set(r, Object::Stream(Stream::from_raw(d, samples)));
+        let plain = exported_rgba(&doc);
+
+        let mut lookup = Dict::new();
+        lookup.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        lookup.set(b"DecodeParms".to_vec(), parms(&mut doc, &table_parms));
+        let lookup = doc.add(Object::Stream(Stream::from_raw(lookup, table.clone())));
+        let cs = Object::Array(vec![Object::name("Indexed"), Object::name("DeviceRGB"), 1.into(), Object::Ref(lookup)]);
+        let d = image(&[("BitsPerComponent", Object::Int(8)), ("ColorSpace", cs)]);
+        doc.set(r, Object::Stream(Stream::flate(d, &indices)));
+        exported.push((plain, exported_rgba(&doc)));
+    }
+    assert_eq!(exported[0].0.1.chunks(4).map(|p| p[0]).collect::<Vec<_>>(), shades, "the samples, direct");
+    assert_eq!(exported[0].1.1.get(..8), Some(&[255, 0, 0, 255, 0, 0, 255, 255][..]), "red, then blue");
+    assert_eq!(exported[1], exported[0], "by reference as direct");
+}

From a4058c92425d84162263b73439d4c74f5f32ff00 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:05:28 +0100
Subject: [PATCH 174/270] M11: say redaction removes Create PDF's Group 4
 pictures whole for now

Redaction doesn't decode CCITT yet, so a mark over part of a picture
Create PDF stored as Group 4 removes the whole picture (nothing leaks);
before this PR such pictures were eight-bit Flate and had only the
covered pixels cleared. The create README and the image-to-PDF parity
note say so; #4384 adds CCITT to redaction. The workspace's comment on
hayro-ccitt says Export uses it, not only tests.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 Cargo.toml                   | 3 ++-
 crates/create/README.md      | 4 +++-
 parity/acrobat-features.toml | 2 +-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 5a92b67475..b2380a7496 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -67,7 +67,8 @@ flate2 = { version = "1.1", default-features = false, features = ["rust_backend"
 weezl = "0.2"
 # CCITT Group 4 encoding (pdfcraft-filters); already in the tree through tiff.
 fax = "0.2.7"
-# An independent CCITT decoder, for round-trip tests; already in the tree through hayro.
+# A CCITT decoder: Export ▸ Images decodes fax images with it, and the encoder's round-trip tests
+# check against it; already in the tree through hayro.
 hayro-ccitt = "0.3"
 
 # foundation
diff --git a/crates/create/README.md b/crates/create/README.md
index 8e0bdc68be..14d42e0a18 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -8,7 +8,9 @@ Layer L4. Create a PDF (Acrobat's Create a PDF tool), execution plan M10.2:
   (`/DCTDecode`, grey, RGB or Adobe-inverted CMYK); PNG is decoded and stored with Flate,
   with transparency as a soft mask. A picture of only pure black and white (a 1-bit PNG or TIFF,
   eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as
-  CCITT Group 4 or Flate, whichever is smaller as stored (`pdfcraft_filters::encode_g4`). An ICC profile in the file (JPEG `APP2 ICC_PROFILE`, PNG
+  CCITT Group 4 or Flate, whichever is smaller as stored (`pdfcraft_filters::encode_g4`).
+  Redaction doesn't decode Group 4 yet: a mark over part of such a picture removes the whole
+  picture (nothing leaks). An ICC profile in the file (JPEG `APP2 ICC_PROFILE`, PNG
   `iCCP`) that matches the image's colour space is kept as an `/ICCBased` colour space with
   the device space as `/Alternate`; images with the same profile share one profile object.
   JPEG metadata scanning skips marker fill bytes and reads application segments after the
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 81c971dbc8..7310893697 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -6885,7 +6885,7 @@ status = "shipped"
 commands = ["create.images"]
 tools = ["doc_create"]
 evidence = ["crates/create/src/tests.rs::black_and_white_images_are_stored_at_one_bit", "crates/create/src/tests.rs::jpeg_2000_images_are_embedded_as_is", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::embedded_icc_profiles_tag_the_image_colour_space"]
-notes = "PNG, JPEG, TIFF (multi-page), GIF (first frame), BMP, and JPEG 2000 (JP2 or codestream, embedded as JPXDecode with its capture resolution). JPEG and PNG ICC profiles are kept as /ICCBased; TIFF profiles are not read yet. A picture of only pure black and white (a 1-bit PNG or TIFF, eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as CCITT Group 4 or Flate, whichever is smaller"
+notes = "PNG, JPEG, TIFF (multi-page), GIF (first frame), BMP, and JPEG 2000 (JP2 or codestream, embedded as JPXDecode with its capture resolution). JPEG and PNG ICC profiles are kept as /ICCBased; TIFF profiles are not read yet. A picture of only pure black and white (a 1-bit PNG or TIFF, eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as CCITT Group 4 or Flate, whichever is smaller. Redaction doesn't decode Group 4 yet: a mark over part of such a picture removes it whole (nothing leaks)"
 
 [[feature]]
 id = "create.from-multipage-tiff"

From d2c3bda6b52d84bc0001b4b0862d7d919b912318 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:26:10 +0100
Subject: [PATCH 175/270] M11: tests for the soft mask in "the smaller wins",
 the byte totals and Group 3's options

- Eight-bit black-and-white text under a noisy soft mask: the grey
  settings win, as they shrink the mask far more than packing saves.
  Counting the packed image without its mask passed every test before.
- The packing test checks the report's byte totals exactly.
- Export reads Group 3 with end-of-line codes, with rows on a byte
  (EncodedByteAlign), with both, and mixed (/K 1, each row tagged
  one-dimensional) with end-of-line codes and without. Decoding /K 1 as
  one-dimensional, or ignoring EncodedByteAlign, now fails a test.
  /EndOfLine is passed to the decoder, but no input here tells it apart:
  the decoder accepts end-of-line codes either way, as ISO 32000-2
  (Table 11) requires.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/create/src/tests.rs        | 40 ++++++++++++++++++++++++-------
 crates/optimize/tests/optimize.rs | 31 ++++++++++++++++++++++++
 2 files changed, 62 insertions(+), 9 deletions(-)

diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 7bb1b80066..212fa3ca71 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1664,9 +1664,11 @@ fn ccitt_fax_images_export_as_their_picture() {
     assert!(out.images.is_empty() && out.skipped.len() == 1, "columns other than the width: skipped");
 }
 
-/// Group 3 data: rows of run lengths, white first, coded one-dimensionally (ITU-T T.4) with no
-/// end-of-line codes, from the few codes these runs need.
-fn group_3(rows: &[&[u32]]) -> Vec<u8> {
+/// Group 3 data: rows of run lengths, white first, coded one-dimensionally (ITU-T T.4), from the
+/// few codes these runs need. Each row starts with an end-of-line code with `eol`, then with
+/// `tag` a 1 bit (the next row one-dimensional, as `/K` above 0 has it). With `align` each row
+/// starts on a byte, its end-of-line code too.
+fn group_3(rows: &[&[u32]], eol: bool, tag: bool, align: bool) -> Vec<u8> {
     let code = |white: bool, run: u32| match (white, run) {
         (true, 16) => "101010",
         (true, 32) => "00011011",
@@ -1674,7 +1676,19 @@ fn group_3(rows: &[&[u32]]) -> Vec<u8> {
         (false, 32) => "000001101010",
         _ => panic!("no code here for a run of {run}"),
     };
-    let bits: String = rows.iter().flat_map(|row| row.iter().enumerate().map(|(i, run)| code(i % 2 == 0, *run))).collect();
+    let mut bits = String::new();
+    for row in rows {
+        while align && !bits.len().is_multiple_of(8) {
+            bits.push('0');
+        }
+        if eol {
+            bits.push_str("000000000001");
+        }
+        if tag {
+            bits.push('1');
+        }
+        row.iter().enumerate().for_each(|(i, run)| bits.push_str(code(i % 2 == 0, *run)));
+    }
     bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
 }
 
@@ -1726,11 +1740,19 @@ fn group_3_ccitt_masks_and_parameters_by_reference_export_as_their_picture() {
     };
     let grey = |bits: i64| [("BitsPerComponent", Object::Int(bits)), ("ColorSpace", Object::name("DeviceGray"))];
 
-    let d = image(&[&grey(1)[..], &fax(0)].concat());
-    doc.set(r, Object::Stream(Stream::from_raw(d, group_3(&rows))));
-    let out = extract_images(&doc, &[0], 0);
-    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
-    assert_eq!(exported_white(&out.images[0].data), picture, "Group 3");
+    // One-dimensional (/K 0) plain, with end-of-line codes, with each row on a byte, and with
+    // both; mixed (/K 1, each row tagged one-dimensional) with end-of-line codes and without.
+    for (k, eol, align) in [(0, false, false), (0, true, false), (0, false, true), (0, true, true), (1, true, false), (1, false, false)] {
+        let mut d = image(&[&grey(1)[..], &fax(k)].concat());
+        if let Some(Object::Dict(parms)) = d.get_mut(b"DecodeParms") {
+            parms.set(b"EndOfLine".to_vec(), Object::Bool(eol));
+            parms.set(b"EncodedByteAlign".to_vec(), Object::Bool(align));
+        }
+        doc.set(r, Object::Stream(Stream::from_raw(d, group_3(&rows, eol, k > 0, align))));
+        let out = extract_images(&doc, &[0], 0);
+        assert!(out.skipped.is_empty(), "/K {k}, EndOfLine {eol}, EncodedByteAlign {align}: {:?}", out.skipped);
+        assert_eq!(exported_white(&out.images[0].data), picture, "/K {k}, EndOfLine {eol}, EncodedByteAlign {align}");
+    }
 
     // A grey picture under the same bits as a soft mask, then as a stencil mask: CCITT against Flate.
     let g4 = pdfcraft_filters::encode_g4(&bits, w, h).unwrap();
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 73ed54d6b1..c9a5203ab6 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -671,6 +671,34 @@ fn eight_bit_black_and_white_takes_the_smaller_of_one_bit_and_the_grey_settings(
     }
 }
 
+/// The smaller of one bit and the grey settings counts the soft mask each leaves: packed, the
+/// image keeps its mask as it is; resampled by the grey settings, the mask is resampled with it.
+/// Here clean text, which packs to well under its JPEG, under a noisy mask the grey settings
+/// shrink by far more than the image's saving: the grey settings win.
+#[test]
+fn eight_bit_black_and_white_with_a_soft_mask_counts_the_mask() {
+    let (w, h) = (1200u32, 1500u32);
+    let mut doc = Document::new_empty();
+    let mut seed = 0x2545_F491_4F6C_DD1Du64;
+    let noise: Vec<u8> = (0..w * h)
+        .map(|_| {
+            seed ^= seed << 13;
+            seed ^= seed >> 7;
+            seed ^= seed << 17;
+            (seed >> 24) as u8
+        })
+        .collect();
+    let mask = mono_image(&mut doc, w, h, &noise, None, &[("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let grey = [("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray")), ("SMask", Object::Ref(mask))];
+    let img = mono_image(&mut doc, w, h, &eight_bit(&bilevel(w, h, false), w, h), None, &grey);
+    // 288 × 360 pt is 300 ppi, above where the grey settings downsample.
+    page(&mut doc, &[("A", img)], "q 288 0 0 360 20 400 cm /A Do Q");
+    optimize(&mut doc, &Settings::default()).unwrap();
+    let s = stream(&doc, img);
+    assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), (Some(8), Some(&b"DCTDecode"[..])), "{:?}", s.dict);
+    assert!(stream(&doc, mask).raw.len() < (w * h) as usize / 2, "the mask resampled with it");
+}
+
 /// Eight-bit grey images of only black and white (as some scanners and converters write scans)
 /// become one-bit Group 4, losslessly: the page looks the same, an inverting decode array
 /// included. Not touched by this: a grey image with any other shade, an indexed image (its samples
@@ -724,8 +752,11 @@ fn eight_bit_black_and_white_images_become_one_bit() {
     assert_eq!(r.images_recompressed, 0, "Retain keeps every image as it is");
 
     let untouched = [shade, indexed, keyed].map(|r| raw(&doc, r));
+    let old: usize = [plain, inverted].map(|r| raw(&doc, r).len()).iter().sum();
     let r = optimize(&mut doc, &settings).unwrap();
     assert_eq!(r.images_recompressed, 2);
+    let new: usize = [plain, inverted].map(|r| raw(&doc, r).len()).iter().sum();
+    assert_eq!((r.image_bytes_before, r.image_bytes_after), (old, new), "the byte totals count both");
     for i in [plain, inverted] {
         let s = stream(&doc, i);
         assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])));

From 2c7bbbae05fc4cc3915d35a57fb96c52a703d5fa Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:26:10 +0100
Subject: [PATCH 176/270] M11: the progress logs say eight-bit black-and-white
 packs unless the grey settings make it smaller

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 ROADMAP.md      | 2 +-
 docs/roadmap.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 9d6b7a43fe..9013e526ea 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,7 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
-- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit, and Export ▸ Images reads CCITT fax images.
+- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller (a dithered scan), and Export ▸ Images reads CCITT fax images.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 1ebbb025ad..a5d6627fbc 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -257,7 +257,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them; Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
+| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller (a dithered scan); Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |

From e8f3c6bc3efa61d878b83069a2dd0ffab1407391 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:54:03 +0100
Subject: [PATCH 177/270] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20re?=
 =?UTF-8?q?ads=20byte-aligned=20Group=203=20whichever=20way=20its=20fill?=
 =?UTF-8?q?=20falls?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With /EncodedByteAlign and end-of-line codes, the fill may start each
code on a byte or end it on one (T.4's fill, as TIFF writes it); the
second was misread, and the image refused as short. With end-of-line
codes the decoder now reads unaligned, as the codes mark the rows either
way (probed black-box for /K 0, 1 and 2); codes laid out so under
/EndOfLine false are still misread. The Group 3 test covers both
layouts, /EncodedByteAlign given by reference, and a /BlackIs1 that
inverts the picture given by reference (with_direct_parms resolves both
before the decoder reads them).

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/create/src/extract.rs | 48 ++++++++++++++++++++++--------------
 crates/create/src/tests.rs   | 48 +++++++++++++++++++++++++++++-------
 2 files changed, 69 insertions(+), 27 deletions(-)

diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index d9895ffdd2..95019467b0 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -196,25 +196,37 @@ fn ccitt(doc: &Document, s: &Stream, data: &[u8], p: Dict) -> Result<Vec<u8>, St
     // As many rows as the image has, whatever /Rows says: one below /Height would cut the picture
     // short, and rows past /Height aren't drawn.
     let rows = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
-    let settings = hayro_ccitt::DecodeSettings {
-        columns,
-        rows,
-        end_of_block: flag(b"EndOfBlock", true),
-        end_of_line: flag(b"EndOfLine", false),
-        rows_are_byte_aligned: flag(b"EncodedByteAlign", false),
-        encoding: match k {
-            ..0 => hayro_ccitt::EncodingMode::Group4,
-            0 => hayro_ccitt::EncodingMode::Group3_1D,
-            k => hayro_ccitt::EncodingMode::Group3_2D { k: u32::try_from(k).unwrap_or(u32::MAX) },
-        },
-        invert_black: false,
-    };
     let stride = (columns as usize).div_ceil(8);
-    let mut out =
-        Rows { out: Vec::new(), row: vec![0; stride], x: 0, columns: columns as usize, rows: rows as usize, black_is_1: flag(b"BlackIs1", false) };
-    // Rows decoded before damaged data are kept; too few rows are refused by the caller.
-    let _ = hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
-    Ok(out.out)
+    let decode = |aligned: bool| {
+        let settings = hayro_ccitt::DecodeSettings {
+            columns,
+            rows,
+            end_of_block: flag(b"EndOfBlock", true),
+            end_of_line: flag(b"EndOfLine", false),
+            rows_are_byte_aligned: aligned,
+            encoding: match k {
+                ..0 => hayro_ccitt::EncodingMode::Group4,
+                0 => hayro_ccitt::EncodingMode::Group3_1D,
+                k => hayro_ccitt::EncodingMode::Group3_2D { k: u32::try_from(k).unwrap_or(u32::MAX) },
+            },
+            invert_black: false,
+        };
+        let mut out = Rows {
+            out: Vec::new(),
+            row: vec![0; stride],
+            x: 0,
+            columns: columns as usize,
+            rows: rows as usize,
+            black_is_1: flag(b"BlackIs1", false),
+        };
+        // Rows decoded before damaged data are kept; too few rows are refused by the caller.
+        let _ = hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
+        out.out
+    };
+    // Byte-aligned rows with end-of-line codes may have the fill end each code on a byte (T.4's
+    // fill, as TIFF writes it) rather than start it on one; read unaligned, the codes mark the rows
+    // either way. Codes laid out so under `/EndOfLine false` are misread.
+    Ok(decode(flag(b"EncodedByteAlign", false) && !flag(b"EndOfLine", false)))
 }
 
 /// The file for one image: its JPEG data as is, or a PNG. An image with transparency (a soft
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 212fa3ca71..19a7e76e37 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1666,9 +1666,9 @@ fn ccitt_fax_images_export_as_their_picture() {
 
 /// Group 3 data: rows of run lengths, white first, coded one-dimensionally (ITU-T T.4), from the
 /// few codes these runs need. Each row starts with an end-of-line code with `eol`, then with
-/// `tag` a 1 bit (the next row one-dimensional, as `/K` above 0 has it). With `align` each row
-/// starts on a byte, its end-of-line code too.
-fn group_3(rows: &[&[u32]], eol: bool, tag: bool, align: bool) -> Vec<u8> {
+/// `tag` a 1 bit (the next row one-dimensional, as `/K` above 0 has it). Fill bits (0s) go where
+/// `fill` says.
+fn group_3(rows: &[&[u32]], eol: bool, tag: bool, fill: Fill) -> Vec<u8> {
     let code = |white: bool, run: u32| match (white, run) {
         (true, 16) => "101010",
         (true, 32) => "00011011",
@@ -1678,7 +1678,9 @@ fn group_3(rows: &[&[u32]], eol: bool, tag: bool, align: bool) -> Vec<u8> {
     };
     let mut bits = String::new();
     for row in rows {
-        while align && !bits.len().is_multiple_of(8) {
+        // The end-of-line code is 12 bits.
+        let ends_code = if fill == Fill::CodeEnd && eol { 12 } else { 0 };
+        while fill != Fill::None && !(bits.len() + ends_code).is_multiple_of(8) {
             bits.push('0');
         }
         if eol {
@@ -1692,6 +1694,15 @@ fn group_3(rows: &[&[u32]], eol: bool, tag: bool, align: bool) -> Vec<u8> {
     bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
 }
 
+/// Where [`group_3`] puts fill bits: none; so each row, its end-of-line code first, starts on a
+/// byte; or so each end-of-line code ends on one (T.4's fill, as TIFF writes it).
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Fill {
+    None,
+    RowStart,
+    CodeEnd,
+}
+
 /// What Export ▸ Images claims for CCITT and for parameters given by reference, each checked
 /// against the same picture stored another way: Group 3 one-dimensional data (`/K 0`) exports as
 /// its picture; a CCITT soft mask and a CCITT stencil `/Mask` export as the same masks in Flate;
@@ -1742,16 +1753,35 @@ fn group_3_ccitt_masks_and_parameters_by_reference_export_as_their_picture() {
 
     // One-dimensional (/K 0) plain, with end-of-line codes, with each row on a byte, and with
     // both; mixed (/K 1, each row tagged one-dimensional) with end-of-line codes and without.
-    for (k, eol, align) in [(0, false, false), (0, true, false), (0, false, true), (0, true, true), (1, true, false), (1, false, false)] {
+    // Byte-aligned with end-of-line codes either way: each code starting on a byte, or ending on
+    // one (T.4's fill, as TIFF writes it). /EncodedByteAlign is given by reference once, and so is
+    // a /BlackIs1 that inverts the picture.
+    let inverted: Vec<bool> = picture.iter().map(|white| !white).collect();
+    for (k, eol, fill, align_by_reference, black_is_1) in [
+        (0, false, Fill::None, false, false),
+        (0, true, Fill::None, false, false),
+        (0, false, Fill::RowStart, true, false),
+        (0, true, Fill::RowStart, false, false),
+        (0, true, Fill::CodeEnd, false, false),
+        (1, true, Fill::None, false, false),
+        (1, false, Fill::None, false, false),
+        (1, true, Fill::CodeEnd, false, false),
+        (0, false, Fill::None, false, true),
+    ] {
         let mut d = image(&[&grey(1)[..], &fax(k)].concat());
+        let align = Object::Bool(fill != Fill::None);
+        let align = if align_by_reference { Object::Ref(doc.add(align)) } else { align };
+        let inverts = Object::Ref(doc.add(Object::Bool(black_is_1)));
         if let Some(Object::Dict(parms)) = d.get_mut(b"DecodeParms") {
             parms.set(b"EndOfLine".to_vec(), Object::Bool(eol));
-            parms.set(b"EncodedByteAlign".to_vec(), Object::Bool(align));
+            parms.set(b"EncodedByteAlign".to_vec(), align);
+            parms.set(b"BlackIs1".to_vec(), inverts);
         }
-        doc.set(r, Object::Stream(Stream::from_raw(d, group_3(&rows, eol, k > 0, align))));
+        doc.set(r, Object::Stream(Stream::from_raw(d, group_3(&rows, eol, k > 0, fill))));
+        let case = format!("/K {k}, EndOfLine {eol}, fill {fill:?}, BlackIs1 {black_is_1}");
         let out = extract_images(&doc, &[0], 0);
-        assert!(out.skipped.is_empty(), "/K {k}, EndOfLine {eol}, EncodedByteAlign {align}: {:?}", out.skipped);
-        assert_eq!(exported_white(&out.images[0].data), picture, "/K {k}, EndOfLine {eol}, EncodedByteAlign {align}");
+        assert!(out.skipped.is_empty(), "{case}: {:?}", out.skipped);
+        assert_eq!(exported_white(&out.images[0].data), if black_is_1 { inverted.clone() } else { picture.clone() }, "{case}");
     }
 
     // A grey picture under the same bits as a soft mask, then as a stencil mask: CCITT against Flate.

From ec4b265b57fa0a40c91b7f6b5e18ba9bf910875b Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:54:04 +0100
Subject: [PATCH 178/270] M11: "the smaller wins" counts the soft mask in the
 tests and the docs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- A noisy 640 × 800 soft mask under 1200 × 1500 text: resampled to the
  image's new size it shrinks only a little, by less than the grey
  settings' JPEG adds over the packed image, so packing wins; not
  counting the new mask passed every test before.
- The hex-text half of the bomb test also stores eight-bit
  black-and-white, which must pack, as its comment says.
- The optimize README, the mono-compression parity note and both
  progress logs say the soft mask counts.
- The Copy Image parity note no longer lists CCITT as missing: it
  copies through Export's decoder, which reads CCITT now.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 ROADMAP.md                        |  2 +-
 crates/optimize/README.md         |  4 +--
 crates/optimize/tests/optimize.rs | 53 ++++++++++++++++++-------------
 docs/roadmap.md                   |  2 +-
 parity/acrobat-features.toml      |  4 +--
 5 files changed, 37 insertions(+), 28 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 9013e526ea..0d1332e862 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,7 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
-- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller (a dithered scan), and Export ▸ Images reads CCITT fax images.
+- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller, soft mask counted (a dithered scan), and Export ▸ Images reads CCITT fax images.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 518910fea4..1f184f0ffb 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -39,8 +39,8 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
   that is smaller as stored. An eight-bit grey image of only 0 and 255 is packed to one bit first
   (not an indexed image, whose samples are palette indices, nor one with a colour-key `/Mask`),
-  unless the grey settings make it smaller still, as they can a dithered scan by downsampling it
-  to JPEG. It is lossless: the samples decode to the same bits, so the colour
+  unless the grey settings make it smaller still, its soft mask counted (resampled with it there,
+  kept as it is here), as they can a dithered scan by downsampling it to JPEG. It is lossless: the samples decode to the same bits, so the colour
   space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
   JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index c9a5203ab6..9e82858776 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -602,10 +602,16 @@ fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
     let page_scan = bilevel(2560, 1200, false);
     let one_bit = as_hex(&mut doc, &page_scan, 1, (2560, 1200));
     let eight_bit = as_hex(&mut doc, &shades, 8, (w, h));
-    page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 460.8 0 0 216 20 500 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
+    let packed = as_hex(&mut doc, &self::eight_bit(&text, w, h), 8, (w, h));
+    page(
+        &mut doc,
+        &[("A", one_bit), ("B", eight_bit), ("C", packed)],
+        "q 460.8 0 0 216 20 500 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q q 300 0 0 120 20 200 cm /C Do Q",
+    );
     optimize(&mut doc, &Settings::default()).unwrap();
     assert_eq!(stream(&doc, one_bit).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "1-bit hex text in lines: Group 4");
     assert!(stream(&doc, eight_bit).dict.int(b"Width").is_some_and(|nw| nw < i64::from(w)), "8-bit hex text in lines: resampled");
+    assert_eq!(stream(&doc, packed).dict.int(b"BitsPerComponent"), Some(1), "8-bit black-and-white hex text in lines: packed");
 }
 
 /// Eight-bit samples (0 or 255) from rows of one-bit ones.
@@ -673,30 +679,33 @@ fn eight_bit_black_and_white_takes_the_smaller_of_one_bit_and_the_grey_settings(
 
 /// The smaller of one bit and the grey settings counts the soft mask each leaves: packed, the
 /// image keeps its mask as it is; resampled by the grey settings, the mask is resampled with it.
-/// Here clean text, which packs to well under its JPEG, under a noisy mask the grey settings
-/// shrink by far more than the image's saving: the grey settings win.
+/// Clean text, 1200 × 1500 at 300 ppi, under a noisy mask. A mask as large: the grey settings
+/// shrink it by far more than packing saves on the image, and win. A mask of 640 × 800 (a soft
+/// mask may be another size than its image): resampled to the image's new size it shrinks only a
+/// little, by less than the grey settings' JPEG adds over the packed image, and packing wins.
 #[test]
 fn eight_bit_black_and_white_with_a_soft_mask_counts_the_mask() {
     let (w, h) = (1200u32, 1500u32);
-    let mut doc = Document::new_empty();
-    let mut seed = 0x2545_F491_4F6C_DD1Du64;
-    let noise: Vec<u8> = (0..w * h)
-        .map(|_| {
-            seed ^= seed << 13;
-            seed ^= seed >> 7;
-            seed ^= seed << 17;
-            (seed >> 24) as u8
-        })
-        .collect();
-    let mask = mono_image(&mut doc, w, h, &noise, None, &[("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray"))]);
-    let grey = [("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray")), ("SMask", Object::Ref(mask))];
-    let img = mono_image(&mut doc, w, h, &eight_bit(&bilevel(w, h, false), w, h), None, &grey);
-    // 288 × 360 pt is 300 ppi, above where the grey settings downsample.
-    page(&mut doc, &[("A", img)], "q 288 0 0 360 20 400 cm /A Do Q");
-    optimize(&mut doc, &Settings::default()).unwrap();
-    let s = stream(&doc, img);
-    assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), (Some(8), Some(&b"DCTDecode"[..])), "{:?}", s.dict);
-    assert!(stream(&doc, mask).raw.len() < (w * h) as usize / 2, "the mask resampled with it");
+    for ((mw, mh), grey_wins) in [((w, h), true), ((640, 800), false)] {
+        let mut doc = Document::new_empty();
+        let mut seed = 0x2545_F491_4F6C_DD1Du64;
+        let noise: Vec<u8> = (0..mw * mh)
+            .map(|_| {
+                seed ^= seed << 13;
+                seed ^= seed >> 7;
+                seed ^= seed << 17;
+                (seed >> 24) as u8
+            })
+            .collect();
+        let mask = mono_image(&mut doc, mw, mh, &noise, None, &[("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+        let grey = [("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray")), ("SMask", Object::Ref(mask))];
+        let img = mono_image(&mut doc, w, h, &eight_bit(&bilevel(w, h, false), w, h), None, &grey);
+        page(&mut doc, &[("A", img)], "q 288 0 0 360 20 400 cm /A Do Q");
+        optimize(&mut doc, &Settings::default()).unwrap();
+        let s = stream(&doc, img);
+        let expected = if grey_wins { (Some(8), Some(&b"DCTDecode"[..])) } else { (Some(1), Some(&b"CCITTFaxDecode"[..])) };
+        assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), expected, "mask {mw} × {mh}: {:?}", s.dict);
+    }
 }
 
 /// Eight-bit grey images of only black and white (as some scanners and converters write scans)
diff --git a/docs/roadmap.md b/docs/roadmap.md
index a5d6627fbc..c4efe2f004 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -257,7 +257,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller (a dithered scan); Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
+| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller, soft mask counted (a dithered scan); Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 7310893697..6b593363c7 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1599,7 +1599,7 @@ status = "partial"
 commands = []
 tools = []
 evidence = ["crates/ui-egui/tests/it/viewer.rs::a_clicked_picture_is_selected_and_copied_in_its_original_format", "crates/ui-egui/tests/it/viewer.rs::right_click_on_a_picture_copies_it_at_full_size", "crates/ui-egui/tests/it/viewer.rs::a_picture_inside_form_artwork_under_text_is_selected_and_copied", "crates/engine/src/tests.rs::copy_image_finds_a_picture_inside_form_artwork_under_text"]
-notes = "Select tool: a click selects a raster image (also inside Form artwork or under text) and ⌘C copies it as a file in its original format (JPEG as stored, else PNG); right-click ▸ Copy Image copies its pixels at full resolution. Missing: inline images (BI/ID/EI), JPEG 2000/JBIG2/CCITT images, multi-format clipboard (file and bitmap at once), the web build"
+notes = "Select tool: a click selects a raster image (also inside Form artwork or under text) and ⌘C copies it as a file in its original format (JPEG as stored, else PNG); right-click ▸ Copy Image copies its pixels at full resolution. Missing: inline images (BI/ID/EI), JPEG 2000/JBIG2 images, multi-format clipboard (file and bitmap at once), the web build"
 
 [[feature]]
 id = "view.rulers"
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still (a dithered scan downsampled to JPEG). Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, its soft mask counted (a dithered scan downsampled to JPEG). Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 8c720e480844649e782c7a2617d6376b0f7bb818 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 18:49:05 +0100
Subject: [PATCH 179/270] M11: Export reads byte-aligned Group 3 by the codes
 in its data
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"Export ▸ Images reads byte-aligned Group 3 whichever way its fill
falls" read byte-aligned rows unaligned whenever /EndOfLine was set.
That broke byte-aligned Group 4 with /EndOfLine (refused); read Group 3
that says /EndOfLine but has no codes unaligned, and wrongly; and read
codes with the fill before them, but no /EndOfLine, on bytes: every row,
the wrong picture, nothing said. Now:
- Group 4, and rows not on bytes, read as the parameters say;
- Group 3 rows on bytes are read by the data: T.4 sends an end-of-line
  code before the first row when it sends them at all, and no other code
  starts with more than eight zeros. Data that starts with 11 zeros or
  more (fill included) and a 1 has codes, and is read unaligned, where
  the codes mark the rows whether the fill starts each code on a byte or
  ends it on one; other data is read on bytes, whatever /EndOfLine says.
  A reading that comes up short is reported rather than tried the other
  way, where data cut short would read as other rows.

The Group 3 test exports nine pictures, stripes and eight of random
text-like runs (how a misreading comes out depends on the picture),
coded with T.4's terminating codes at /K 0 and 1: no codes, with
/EndOfLine and without; codes each starting on a byte or ending on one,
with /EndOfLine and without. Each exports as its picture, and each a
byte short is reported; at /K 1, codes with none before the first row
(not as T.4 sends them) export as their picture or are reported.
Byte-aligned Group 4 still reads with and without /EndOfLine. The
create.export-all-images parity note says what is still limited: such
codes may export wrong at /K 0, as the create README says. A rule tried
first, reading both ways and refusing an image that gave every row both
ways differently, failed on the stripes without codes (TIFF's Modified
Huffman layout): its unaligned reading gives every row too, wrongly. So
did one that read the other way when the first reading came up short: it
drew data cut short as other rows. cargo-mutants leaves no mutant of the
new lines alive.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/create/README.md      |   7 +-
 crates/create/src/extract.rs |  23 +++++--
 crates/create/src/tests.rs   | 128 +++++++++++++++++++++++++++++++----
 parity/acrobat-features.toml |   4 +-
 4 files changed, 142 insertions(+), 20 deletions(-)

diff --git a/crates/create/README.md b/crates/create/README.md
index 14d42e0a18..b63dc933b0 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -36,4 +36,9 @@ The existing 16-bit path still uses each sample's high byte.
 JPEG image Decode handling remains limited.
 ICC transforms and calibrated color conversion remain outside this export path.
 CCITT fax images (Group 3 and 4) are decoded for export through `hayro-ccitt` with their `/DecodeParms`
-(`/Columns` has to be the image's width), behind other filters such as `ASCII85Decode` too; JPEG 2000 and JBIG2 images are still reported, not exported.
+(`/Columns` has to be the image's width), behind other filters such as `ASCII85Decode` too.
+Byte-aligned Group 3 rows are read by their end-of-line codes, whether the fill starts each code on
+a byte or ends it on one, when the data starts with one (T.4 sends one before the first row), and on
+bytes otherwise, whatever `/EndOfLine` says; data that comes up short is reported. Data with codes
+but none before the first row is read on bytes, and is reported or, at `/K 0`, may come out wrong.
+JPEG 2000 and JBIG2 images are still reported, not exported.
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 95019467b0..814b68aea2 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -223,10 +223,25 @@ fn ccitt(doc: &Document, s: &Stream, data: &[u8], p: Dict) -> Result<Vec<u8>, St
         let _ = hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
         out.out
     };
-    // Byte-aligned rows with end-of-line codes may have the fill end each code on a byte (T.4's
-    // fill, as TIFF writes it) rather than start it on one; read unaligned, the codes mark the rows
-    // either way. Codes laid out so under `/EndOfLine false` are misread.
-    Ok(decode(flag(b"EncodedByteAlign", false) && !flag(b"EndOfLine", false)))
+    let aligned = flag(b"EncodedByteAlign", false);
+    // Group 4 reads as its parameters say, and so do rows not on bytes.
+    if k < 0 || !aligned {
+        return Ok(decode(aligned));
+    }
+    // Group 3 rows on bytes may have end-of-line codes whatever /EndOfLine says (the filter always
+    // accepts them), with the fill starting each code on a byte or ending it on one (T.4's fill, as
+    // TIFF writes it). Read unaligned, the codes mark the rows either way; without codes, the rows
+    // are read on bytes. A reading that comes up short isn't tried the other way: data cut short
+    // would then read as other rows, and is refused instead.
+    Ok(decode(!starts_with_end_of_line(data)))
+}
+
+/// Whether CCITT fax `data` starts with an end-of-line code: a 1 after 11 zeros or more, fill
+/// included. T.4 sends one before the first row when it sends them at all, and no other code starts
+/// with more than eight zeros.
+fn starts_with_end_of_line(data: &[u8]) -> bool {
+    let Some((i, b)) = data.iter().enumerate().find(|(_, b)| **b != 0) else { return false };
+    i.saturating_mul(8).saturating_add(b.leading_zeros() as usize) >= 11
 }
 
 /// The file for one image: its JPEG data as is, or a PNG. An image with transparency (a soft
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 19a7e76e37..fc47e78adf 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1664,18 +1664,29 @@ fn ccitt_fax_images_export_as_their_picture() {
     assert!(out.images.is_empty() && out.skipped.len() == 1, "columns other than the width: skipped");
 }
 
-/// Group 3 data: rows of run lengths, white first, coded one-dimensionally (ITU-T T.4), from the
-/// few codes these runs need. Each row starts with an end-of-line code with `eol`, then with
-/// `tag` a 1 bit (the next row one-dimensional, as `/K` above 0 has it). Fill bits (0s) go where
-/// `fill` says.
-fn group_3(rows: &[&[u32]], eol: bool, tag: bool, fill: Fill) -> Vec<u8> {
-    let code = |white: bool, run: u32| match (white, run) {
-        (true, 16) => "101010",
-        (true, 32) => "00011011",
-        (false, 16) => "0000010111",
-        (false, 32) => "000001101010",
-        _ => panic!("no code here for a run of {run}"),
-    };
+/// Group 3 data: rows of run lengths below 64, white first, coded one-dimensionally with T.4's
+/// terminating codes (ITU-T T.4 Tables 2 and 3). Each row starts with an end-of-line code with
+/// `eol`, then with `tag` a 1 bit (the next row one-dimensional, as `/K` above 0 has it). Fill bits
+/// (0s) go where `fill` says.
+fn group_3(rows: &[impl AsRef<[u32]>], eol: bool, tag: bool, fill: Fill) -> Vec<u8> {
+    // The codes for runs 0 to 63, in order.
+    const WHITE: &str = concat!(
+        "00110101 000111 0111 1000 1011 1100 1110 1111 10011 10100 00111 01000 001000 000011 110100 110101 101010 101011 ",
+        "0100111 0001100 0001000 0010111 0000011 0000100 0101000 0101011 0010011 0100100 0011000 00000010 00000011 00011010 ",
+        "00011011 00010010 00010011 00010100 00010101 00010110 00010111 00101000 00101001 00101010 00101011 00101100 00101101 ",
+        "00000100 00000101 00001010 00001011 01010010 01010011 01010100 01010101 00100100 00100101 01011000 01011001 01011010 ",
+        "01011011 01001010 01001011 00110010 00110011 00110100",
+    );
+    const BLACK: &str = concat!(
+        "0000110111 010 11 10 011 0011 0010 00011 000101 000100 0000100 0000101 0000111 00000100 00000111 000011000 0000010111 ",
+        "0000011000 0000001000 00001100111 00001101000 00001101100 00000110111 00000101000 00000010111 00000011000 ",
+        "000011001010 000011001011 000011001100 000011001101 000001101000 000001101001 000001101010 000001101011 000011010010 ",
+        "000011010011 000011010100 000011010101 000011010110 000011010111 000001101100 000001101101 000011011010 000011011011 ",
+        "000001010100 000001010101 000001010110 000001010111 000001100100 000001100101 000001010010 000001010011 000000100100 ",
+        "000000110111 000000111000 000000100111 000000101000 000001011000 000001011001 000000101011 000000101100 000001011010 ",
+        "000001100110 000001100111",
+    );
+    let code = |white: bool, run: u32| (if white { WHITE } else { BLACK }).split(' ').nth(run as usize).expect("a run below 64");
     let mut bits = String::new();
     for row in rows {
         // The end-of-line code is 12 bits.
@@ -1689,11 +1700,50 @@ fn group_3(rows: &[&[u32]], eol: bool, tag: bool, fill: Fill) -> Vec<u8> {
         if tag {
             bits.push('1');
         }
-        row.iter().enumerate().for_each(|(i, run)| bits.push_str(code(i % 2 == 0, *run)));
+        row.as_ref().iter().enumerate().for_each(|(i, run)| bits.push_str(code(i % 2 == 0, *run)));
     }
     bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
 }
 
+/// `count` text-like pictures `w` by `h` for [`group_3`], from a fixed seed: rows of random runs,
+/// long white ones and short black ones, and a row may start black.
+fn random_pictures(w: u32, h: u32, count: usize) -> Vec<Vec<Vec<u32>>> {
+    let mut seed = 0x9E37_79B9_7F4A_7C15u64;
+    let mut random = |n: u64| {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        (seed % n) as u32
+    };
+    let mut row = || {
+        let (mut runs, mut left) = (Vec::new(), w);
+        while left > 0 {
+            let run = match runs.len() % 2 {
+                0 if runs.is_empty() => random(31),
+                0 => 1 + random(30),
+                _ => 1 + random(5),
+            };
+            runs.push(run.min(left));
+            left -= run.min(left);
+        }
+        runs
+    };
+    (0..count).map(|_| (0..h).map(|_| row()).collect()).collect()
+}
+
+/// The picture `rows` of runs (white first) make, `w` by `h`, true where white.
+fn white_of(rows: &[Vec<u32>], w: u32, h: u32) -> Vec<bool> {
+    let mut white = vec![false; (w * h) as usize];
+    for (y, row) in rows.iter().enumerate() {
+        let mut x = y * w as usize;
+        for (i, run) in row.iter().enumerate() {
+            white[x..x + *run as usize].fill(i % 2 == 0);
+            x += *run as usize;
+        }
+    }
+    white
+}
+
 /// Where [`group_3`] puts fill bits: none; so each row, its end-of-line code first, starts on a
 /// byte; or so each end-of-line code ends on one (T.4's fill, as TIFF writes it).
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -1783,6 +1833,58 @@ fn group_3_ccitt_masks_and_parameters_by_reference_export_as_their_picture() {
         assert!(out.skipped.is_empty(), "{case}: {:?}", out.skipped);
         assert_eq!(exported_white(&out.images[0].data), if black_is_1 { inverted.clone() } else { picture.clone() }, "{case}");
     }
+    // Byte-aligned rows against /EndOfLine, over several pictures, as how a misreading comes out
+    // depends on the picture: no codes (as TIFF's Modified Huffman has it), and /EndOfLine without
+    // them; codes, each starting on a byte or ending on one, /EndOfLine or not. Each exports as its
+    // picture, and a byte short is reported. The first picture is stripes, every row 32 white then
+    // 32 black; the others are text-like rows of random runs.
+    let image_with = |doc: &mut Document, k: i64, eol: bool, data: Vec<u8>| {
+        let mut d = image(&[&grey(1)[..], &fax(k)].concat());
+        if let Some(Object::Dict(parms)) = d.get_mut(b"DecodeParms") {
+            parms.set(b"EndOfLine".to_vec(), Object::Bool(eol));
+            parms.set(b"EncodedByteAlign".to_vec(), Object::Bool(true));
+        }
+        doc.set(r, Object::Stream(Stream::from_raw(d, data)));
+        extract_images(doc, &[0], 0)
+    };
+    let mut pictures = vec![vec![vec![32u32, 32]; h as usize]];
+    pictures.extend(random_pictures(w, h, 8));
+    for (n, runs) in pictures.iter().enumerate() {
+        let white = white_of(runs, w, h);
+        for k in [0, 1] {
+            for (codes, fill, eol) in [
+                (false, Fill::RowStart, false),
+                (false, Fill::RowStart, true),
+                (true, Fill::RowStart, false),
+                (true, Fill::RowStart, true),
+                (true, Fill::CodeEnd, false),
+                (true, Fill::CodeEnd, true),
+            ] {
+                let out = image_with(&mut doc, k, eol, group_3(runs, codes, k > 0, fill));
+                let case = format!("picture {n}, /K {k}, codes {codes}, fill {fill:?}, /EndOfLine {eol}");
+                assert!(out.skipped.is_empty(), "{case}: {:?}", out.skipped);
+                assert_eq!(exported_white(&out.images[0].data), white, "{case}");
+                // A byte short, it is reported, not read the other way into other rows.
+                let mut short = group_3(runs, codes, k > 0, fill);
+                short.pop();
+                let out = image_with(&mut doc, k, eol, short);
+                assert!(out.images.is_empty() && out.skipped.len() == 1, "{case}, a byte short: {:?}", out.skipped);
+                // At /K 1, codes with none before the first row (the first code and its fill are 2
+                // bytes here) are read on bytes: the picture or reported, never another picture.
+                if k == 1 && fill == Fill::CodeEnd {
+                    let out = image_with(&mut doc, k, eol, group_3(runs, codes, true, fill).split_off(2));
+                    assert!(out.images.iter().all(|i| exported_white(&i.data) == white), "{case}, no code first");
+                }
+            }
+        }
+    }
+    // Group 4 rows on bytes keep their aligned read, /EndOfLine or not: here white rows, each the
+    // one code 1 (vertical, no change) and its fill.
+    for eol in [false, true] {
+        let out = image_with(&mut doc, -1, eol, vec![0x80; h as usize]);
+        assert!(out.skipped.is_empty(), "byte-aligned Group 4, /EndOfLine {eol}: {:?}", out.skipped);
+        assert!(exported_white(&out.images[0].data).iter().all(|white| *white), "byte-aligned Group 4, /EndOfLine {eol}");
+    }
 
     // A grey picture under the same bits as a soft mask, then as a stencil mask: CCITT against Flate.
     let g4 = pdfcraft_filters::encode_g4(&bits, w, h).unwrap();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 6b593363c7..6c5547c06e 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7164,8 +7164,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["export.all_images"]
 tools = ["doc_export_all_images"]
-evidence = ["crates/create/src/tests.rs::ccitt_fax_images_export_as_their_picture", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps"]
-notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2 masks are left out (image exported opaque); JPX/JBIG2/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported. CCITT fax images (Group 3 and 4, with their /DecodeParms, behind other filters too) export as their picture, masks included."
+evidence = ["crates/create/src/tests.rs::ccitt_fax_images_export_as_their_picture", "crates/create/src/tests.rs::group_3_ccitt_masks_and_parameters_by_reference_export_as_their_picture", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps"]
+notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2 masks are left out (image exported opaque); JPX/JBIG2/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported. CCITT fax images (Group 3 and 4, with their /DecodeParms, behind other filters too) export as their picture, masks included; byte-aligned Group 3 is read by the end-of-line codes when the data starts with one and on bytes otherwise, and one cut short is reported. Still limited: byte-aligned Group 3 with codes but none before the first row (not as T.4 sends them) is reported, or at /K 0 may export wrong."
 
 [[feature]]
 id = "create.export-html"

From 907a9fa917da5174a59fae5f3c5babba051d9baa Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 02:24:54 +0200
Subject: [PATCH 180/270] M11: monochrome downsampling: black-and-white images
 above 450 ppi are averaged down to 300
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The PDF Optimizer and Reduce File Size downsampled colour and grey images
but not black-and-white ones. Settings::mono is now MonoSettings {
downsample, target_ppi, above_ppi, compression }, 300 ppi above 450 ppi
and CCITT Group 4 by default (Monochrome Images ▸ Downsample to;
doc_optimize mono: { downsample, ppi, above_ppi, compression }).

A 1-bit image or image mask (no filter, general-purpose filters, or CCITT
fax after any of them) and eight-bit grey of only black and white are averaged by
area: each new pixel takes the sample covering more of it, a tie 0, so a
dark line half a new pixel wide stays. They are stored as Group 4, or as
1-bit Flate when that is smaller; with Retain a resampled image keeps its
kind of compression. Images with a soft mask keep their size.

CCITT decoding moves from Export ▸ Images into pdfcraft-filters
(decode_ccitt, CcittParams, through hayro-ccitt), and
pdfcraft_cos::Document::decoded_image reads a fax image's /DecodeParms
for it (undoing filters before CCITT, such as ASCII85Decode, with any
/DecodeParms given by reference made direct first), so export
and the optimizer share one reader, and Group 4 scans can be
downsampled. A 600 ppi text page went from 79 KB to 40 KB.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 Cargo.lock                                  |   1 +
 Cargo.toml                                  |   4 +-
 ROADMAP.md                                  |   1 +
 crates/automation/src/documents.rs          |  25 +-
 crates/automation/src/tools.rs              |   2 +-
 crates/automation/tests/it/automation.rs    |  40 ++-
 crates/cos/README.md                        |   6 +-
 crates/cos/src/document.rs                  |   2 +-
 crates/cos/src/document/objects.rs          |  56 +++-
 crates/cos/src/document/tests.rs            |  77 +++++
 crates/cos/src/object.rs                    |   2 +-
 crates/create/Cargo.toml                    |   4 +-
 crates/create/README.md                     |  13 +-
 crates/create/src/extract.rs                | 148 +--------
 crates/filters/Cargo.toml                   |   3 +-
 crates/filters/README.md                    |  10 +-
 crates/filters/src/ccitt.rs                 | 178 ++++++++++-
 crates/filters/src/lib.rs                   |   2 +-
 crates/optimize/Cargo.toml                  |   1 +
 crates/optimize/README.md                   |  36 ++-
 crates/optimize/src/images.rs               | 332 ++++++++++++++------
 crates/optimize/src/lib.rs                  |  28 +-
 crates/optimize/tests/optimize.rs           | 158 +++++++++-
 crates/ui-egui/src/workflows/optimize_ui.rs |  19 +-
 crates/ui-egui/tests/it/create.rs           |   6 +-
 docs/pdf-spec-parity.md                     |   5 +-
 docs/roadmap.md                             |   3 +-
 parity/acrobat-features.toml                |  10 +-
 28 files changed, 867 insertions(+), 305 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e2427a1b0a..f9280eff06 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4511,6 +4511,7 @@ dependencies = [
  "pdfcraft-filters",
  "pdfcraft-model",
  "pdfcraft-render",
+ "proptest",
  "thiserror 2.0.21",
  "zune-jpeg",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index b2380a7496..f0995622b9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -67,8 +67,8 @@ flate2 = { version = "1.1", default-features = false, features = ["rust_backend"
 weezl = "0.2"
 # CCITT Group 4 encoding (pdfcraft-filters); already in the tree through tiff.
 fax = "0.2.7"
-# A CCITT decoder: Export ▸ Images decodes fax images with it, and the encoder's round-trip tests
-# check against it; already in the tree through hayro.
+# CCITT fax decoding (pdfcraft-filters' decode_ccitt), also the independent decoder in its
+# encoder's round-trip tests; already in the tree through hayro.
 hayro-ccitt = "0.3"
 
 # foundation
diff --git a/ROADMAP.md b/ROADMAP.md
index 2b2f785167..baae83997d 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,6 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
+- **2026-10-24 (M11, monochrome downsampling):** The PDF Optimizer and Reduce File Size average black-and-white images above 450 ppi down to 300 ppi (Monochrome Images ▸ Downsample to), Group 4 scans included, so a 600 ppi text page goes from 79 KB to 40 KB. CCITT decoding moved into `pdfcraft-filters` (`decode_ccitt`), shared by Export ▸ Images and the optimizer through `Document::decoded_image`.
 - **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller, as they can a dithered scan, soft mask counted, and Export ▸ Images reads CCITT fax images.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
index 40aa4ac522..5d2c416ee5 100644
--- a/crates/automation/src/documents.rs
+++ b/crates/automation/src/documents.rs
@@ -280,6 +280,7 @@ impl Automation {
 
     pub(crate) fn doc_optimize(&mut self, a: &Args) -> Result<Value> {
         use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, MonoCompression, Preset};
+        const MONO_KEYS: [&str; 4] = ["downsample", "ppi", "above_ppi", "compression"];
         let id = self.doc(a)?.id;
         let before = self.doc(a)?.bytes.len();
         let path = self.resolve(a.str("path")?, true)?;
@@ -319,13 +320,29 @@ impl Automation {
         settings.gray = images("gray", settings.gray)?;
         if let Some(mono) = a.get("mono") {
             let unknown = |c: &Value| ToolError::InvalidArgs(format!("unknown mono compression {c} (ccitt_g4, retain)"));
-            let mono = mono.as_object().ok_or_else(|| ToolError::InvalidArgs("mono must be an object: { compression: ccitt_g4|retain }".into()))?;
+            let mono = mono.as_object().ok_or_else(|| {
+                ToolError::InvalidArgs("mono must be an object: { downsample, ppi, above_ppi, compression: ccitt_g4|retain }".into())
+            })?;
             // A misspelled key would otherwise leave the preset's setting in place unnoticed.
-            if let Some(key) = mono.keys().find(|k| *k != "compression") {
-                return Err(ToolError::InvalidArgs(format!("unknown mono key {key:?} (compression)")));
+            if let Some(key) = mono.keys().find(|k| !MONO_KEYS.contains(&k.as_str())) {
+                return Err(ToolError::InvalidArgs(format!("unknown mono key {key:?} ({})", MONO_KEYS.join(", "))));
             }
+            let m = &mut settings.mono;
+            if let Some(d) = mono.get("downsample") {
+                m.downsample = d.as_bool().ok_or_else(|| ToolError::InvalidArgs(format!("mono downsample must be true or false, not {d}")))?;
+            }
+            for (key, ppi) in [("ppi", &mut m.target_ppi), ("above_ppi", &mut m.above_ppi)] {
+                if let Some(p) = mono.get(key) {
+                    *ppi = p
+                        .as_f64()
+                        .filter(|p| p.is_finite())
+                        .ok_or_else(|| ToolError::InvalidArgs(format!("mono {key} must be a number, not {p}")))?
+                        .clamp(9.0, 2400.0);
+                }
+            }
+            m.above_ppi = m.above_ppi.max(m.target_ppi);
             if let Some(c) = mono.get("compression") {
-                settings.mono = match c.as_str() {
+                m.compression = match c.as_str() {
                     Some("ccitt_g4" | "ccitt" | "g4") => MonoCompression::CcittG4,
                     Some("retain") => MonoCompression::Retain,
                     _ => return Err(unknown(c)),
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 15530229fd..79555f1548 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1433,7 +1433,7 @@ pub fn tools() -> Vec<ToolDef> {
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
             .with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
-        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { compression: ccitt_g4|retain } (default ccitt_g4: black-and-white images and image masks are stored losslessly as CCITT Group 4 when that is smaller; counted in images_recompressed). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
+        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 when that is smaller, counted in images_recompressed; retain resamples only, keeping each image's kind of compression). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
             .cmd("optimize.advanced")
             .with(schema(
                 json!({
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index ea943eff79..e68da784d6 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6375,6 +6375,11 @@ fn lzw_streams_are_stored_with_flate_through_tools() {
 /// A one-page PDF drawing a 1-bit scan of text (glyph strokes with ragged edges, as a scanner
 /// leaves them) of 1000 × 400 samples, stored with Flate.
 fn scanned_page() -> Vec<u8> {
+    scan_drawn(b"q 500 0 0 200 50 500 cm /Scan Do Q")
+}
+
+/// [`scanned_page`]'s scan, drawn by `content` (which names it `/Scan`).
+fn scan_drawn(content: &[u8]) -> Vec<u8> {
     use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_full};
     let (w, h) = (1000usize, 400usize);
     let stride = w.div_ceil(8);
@@ -6415,7 +6420,7 @@ fn scanned_page() -> Vec<u8> {
     x.set(b"Scan".to_vec(), Object::Ref(image));
     let mut res = Dict::new();
     res.set(b"XObject".to_vec(), Object::Dict(x));
-    let content = doc.add(Object::Stream(Stream::from_raw(Dict::new(), b"q 500 0 0 200 50 500 cm /Scan Do Q".to_vec())));
+    let content = doc.add(Object::Stream(Stream::from_raw(Dict::new(), content.to_vec())));
     let mut p = Dict::new();
     p.set(b"Type".to_vec(), Object::name("Page"));
     p.set(b"Parent".to_vec(), Object::Ref(pages));
@@ -6511,6 +6516,39 @@ fn doc_optimize_stores_black_and_white_images_as_ccitt_group_4() {
     }
 }
 
+/// A scan drawn at 600 ppi is averaged down to 300 ppi by default. `mono: { downsample: false }`
+/// keeps its size, `ppi` and `above_ppi` choose others, and values of the wrong type are refused.
+#[test]
+fn doc_optimize_averages_black_and_white_scans_down() {
+    let dir = workdir("optimize-mono-downsample");
+    // 1000 × 400 samples on 120 × 48 pt: 600 ppi.
+    std::fs::write(dir.join("scan.pdf"), scan_drawn(b"q 120 0 0 48 50 500 cm /Scan Do Q")).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "scan.pdf" }))["doc"].as_u64().unwrap();
+    let sizes = |name: &str| -> Vec<(Option<i64>, Option<i64>)> {
+        let written = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join(name)).unwrap())).unwrap();
+        written
+            .object_numbers()
+            .into_iter()
+            .filter_map(|num| match &*written.get(pdfcraft_cos::ObjRef { num, generation: written.generation(num) }) {
+                pdfcraft_cos::Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => Some((s.dict.int(b"Width"), s.dict.int(b"Height"))),
+                _ => None,
+            })
+            .collect()
+    };
+    let r = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "small.pdf" }));
+    assert_eq!(r["images_resampled"].as_u64(), Some(1), "{r}");
+    assert_eq!(sizes("small.pdf"), [(Some(500), Some(200))]);
+    let r = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "kept.pdf", "mono": { "downsample": false } }));
+    assert_eq!(r["images_resampled"].as_u64(), Some(0), "{r}");
+    assert_eq!(sizes("kept.pdf"), [(Some(1000), Some(400))]);
+    ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "200.pdf", "mono": { "ppi": 200, "above_ppi": 250 } }));
+    assert_eq!(sizes("200.pdf"), [(Some(333), Some(133))]);
+    for mono in [json!({ "downsample": "yes" }), json!({ "ppi": "300" }), json!({ "above": 450 })] {
+        assert!(matches!(a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "mono": mono })), Err(ToolError::InvalidArgs(_))), "{mono}");
+    }
+}
+
 /// A one-page PDF whose page picture is drawn as `rows` grey images one pixel row high, 600 px
 /// wide on a 72 pt square (600 ppi), as some PDF printers write it.
 fn printed_in_strips(rows: usize) -> Vec<u8> {
diff --git a/crates/cos/README.md b/crates/cos/README.md
index 89b6826a8a..8358a220a0 100644
--- a/crates/cos/README.md
+++ b/crates/cos/README.md
@@ -25,6 +25,7 @@ let real = doc.resolve(&obj);                        // follow one indirect refe
 let d    = doc.dict(&obj);                           // Option<Dict>, resolving first
 let data = stream.decoded()?;                        // filters applied on demand
 let data = doc.with_direct_parms(&stream).decoded()?; // /DecodeParms given by reference too
+let px   = doc.decoded_image(&stream)?;              // an image's samples, a CCITT fax image's too
 
 doc.set(r, Object::Dict(d));                         // edit: lands in the overlay
 let r = doc.add(obj);                                // append a new object
@@ -88,5 +89,6 @@ recognisable in a diff and byte-stable when re-serialized.
 - Linearized output, Fast Web View (`core.linearization`, M11).
 - Structural validation against the Arlington model (`core.arlington-validation`), which will live
   in the reserved `arlington` crate.
-- Image codecs. `pdfcraft-filters` carries the non-image filters; DCT, JPX, JBIG2 and CCITT are
-  still decoded through the bootstrap renderer (`core.image-filters`, M2.6).
+- Image codecs. `pdfcraft-filters` carries the non-image filters and CCITT fax decoding
+  (`Document::decoded_image`); DCT, JPX and JBIG2 are still decoded through the bootstrap renderer
+  (`core.image-filters`, M2.6).
diff --git a/crates/cos/src/document.rs b/crates/cos/src/document.rs
index 4c7748cc95..0d9b84b749 100644
--- a/crates/cos/src/document.rs
+++ b/crates/cos/src/document.rs
@@ -10,7 +10,7 @@ use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::{Arc, Mutex, Weak};
 
 use crate::CosError;
-use crate::object::{Dict, ObjRef, Object, Stream};
+use crate::object::{Dict, MAX_DECODED, ObjRef, Object, Stream};
 use crate::parser::{EndstreamIndex, Lexer, is_whitespace, parse_indirect, parse_indirect_shared};
 
 mod objects;
diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index fb20b50cf1..bcbf8bbf41 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -1,7 +1,7 @@
 use super::reader::find;
 use super::state::{LENGTHS, LoadGuard, ObjStm, ObjectReader, ReadState, Slot, SourceIdentity, objstm_member, owned_bytes};
 use super::xref::{Revision, XrefEntry};
-use super::{Arc, CosError, Cow, Dict, Document, Lexer, ObjRef, Object, Stream, is_whitespace, parse_indirect_shared};
+use super::{Arc, CosError, Cow, Dict, Document, Lexer, MAX_DECODED, ObjRef, Object, Stream, is_whitespace, parse_indirect_shared};
 
 impl Document {
     pub fn bytes(&self) -> &Arc<Vec<u8>> {
@@ -224,6 +224,60 @@ impl Document {
         self.resolve(o).as_dict().cloned()
     }
 
+    /// The samples of image `s`, decoded: through its filters ([`Stream::decoded`]), or, for a
+    /// CCITT fax image (its last filter), through the filters before it and then
+    /// [`pdfcraft_filters::decode_ccitt`] with its `/DecodeParms` (resolved; the dictionary of a
+    /// lone filter, or its entry in an array), as `CCITTFaxDecode` gives them (ISO 32000-2 §7.4.6).
+    /// Parameters given by reference count, for every filter ([`Document::with_direct_parms`]).
+    /// A fax image's `/Columns` has to be its `/Width`. Up to its `/Height` rows are decoded,
+    /// whatever `/Rows` says, within [`MAX_DECODED`] bytes; damaged data gives fewer, so a caller
+    /// checks it has the rows it needs.
+    pub fn decoded_image(&self, s: &Stream) -> Result<Vec<u8>, CosError> {
+        let s = &*self.with_direct_parms(s);
+        let chain = s.readable_filters().map_err(|e| CosError::Filter(e.to_string()))?;
+        let Some(((pdfcraft_filters::Filter::CcittFax, _), before)) = chain.split_last() else { return s.decoded() };
+        // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1).
+        let index = match s.dict.get(b"Filter") {
+            Some(Object::Array(a)) => a.len().saturating_sub(1),
+            _ => 0,
+        };
+        let parms = match s.dict.get(b"DecodeParms").map(|p| self.resolve(p)).as_deref() {
+            Some(Object::Array(a)) => a.get(index).and_then(|p| self.dict(p)),
+            Some(p) if index == 0 => p.as_dict().cloned(),
+            _ => None,
+        }
+        .unwrap_or_default();
+        let int = |key: &[u8], default: i64| parms.get(key).and_then(|v| self.resolve(v).as_int()).unwrap_or(default);
+        let flag = |key: &[u8], default: bool| match parms.get(key).map(|v| self.resolve(v)).as_deref() {
+            Some(Object::Bool(b)) => *b,
+            _ => default,
+        };
+        let d = pdfcraft_filters::CcittParams::default();
+        let p = pdfcraft_filters::CcittParams {
+            k: int(b"K", d.k),
+            columns: int(b"Columns", d.columns),
+            // As many rows as the image has: a /Rows below /Height would cut the picture short,
+            // and rows past /Height aren't drawn.
+            rows: 0,
+            end_of_line: flag(b"EndOfLine", d.end_of_line),
+            encoded_byte_align: flag(b"EncodedByteAlign", d.encoded_byte_align),
+            end_of_block: flag(b"EndOfBlock", d.end_of_block),
+            black_is_1: flag(b"BlackIs1", d.black_is_1),
+        };
+        if s.dict.int(b"Width") != Some(p.columns) {
+            return Err(CosError::Filter("a fax image's /Columns aren't its /Width".into()));
+        }
+        let height = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
+        let stride = usize::try_from(p.columns).unwrap_or(usize::MAX).div_ceil(8).max(1);
+        let rows = u32::try_from(MAX_DECODED / stride).unwrap_or(u32::MAX).min(height);
+        // The filters before it, such as ASCII85Decode, are undone first.
+        let data = match before {
+            [] => Cow::Borrowed(&s.raw[..]),
+            _ => Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, MAX_DECODED).map_err(|e| CosError::Filter(e.to_string()))?.0),
+        };
+        pdfcraft_filters::decode_ccitt(&data, &p, rows).map_err(|e| CosError::Filter(e.to_string()))
+    }
+
     pub fn try_get(&self, num: u32) -> Result<Arc<Object>, CosError> {
         match self.overlay.get(&num) {
             Some(Slot::Set(_, o)) => return Ok(o.clone()),
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index d8d75c4af1..49baeccec8 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -79,6 +79,83 @@ fn decode_parms_given_by_reference_are_read_once_direct() {
     }
 }
 
+/// A CCITT fax image reads through its /DecodeParms, given directly, in an array or by
+/// reference (its numbers too), with /BlackIs1, and behind other filters; one whose /Columns
+/// aren't its /Width is refused, /Height rows are decoded whatever /Rows says, and other images
+/// decode through their filters.
+#[test]
+fn fax_images_decode_with_their_parameters() {
+    // 10 × 3: the first five samples of each row white, the rest black.
+    let bits = [0b1111_1000, 0, 0b1111_1000, 0, 0b1111_1000, 0];
+    let coded = pdfcraft_filters::encode_g4(&bits, 10, 3).unwrap();
+    let mut doc = Document::new_empty();
+    let mut parms = Dict::new();
+    parms.set(b"K".to_vec(), Object::Int(-1));
+    parms.set(b"Columns".to_vec(), Object::Int(10));
+    let indirect = doc.add(Object::Dict(parms.clone()));
+    let image = |doc: &Document, parms: Option<Object>, width: i64, height: i64| {
+        let mut d = Dict::new();
+        d.set(b"Width".to_vec(), Object::Int(width));
+        d.set(b"Height".to_vec(), Object::Int(height));
+        d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+        if let Some(p) = parms {
+            d.set(b"DecodeParms".to_vec(), p);
+        }
+        doc.decoded_image(&Stream::from_raw(d, coded.clone()))
+    };
+    for p in [
+        Object::Dict(parms.clone()),
+        Object::Array(vec![Object::Dict(parms.clone())]),
+        Object::Ref(indirect),
+        Object::Array(vec![Object::Ref(indirect)]),
+    ] {
+        assert_eq!(image(&doc, Some(p.clone()), 10, 3).unwrap(), bits, "{p:?}");
+    }
+    let mut inverted = parms.clone();
+    inverted.set(b"BlackIs1".to_vec(), Object::Bool(true));
+    assert_eq!(
+        image(&doc, Some(Object::Dict(inverted)), 10, 3).unwrap(),
+        [0b0000_0111, 0b1100_0000, 0b0000_0111, 0b1100_0000, 0b0000_0111, 0b1100_0000]
+    );
+    assert_eq!(image(&doc, Some(Object::Dict(parms.clone())), 10, 2).unwrap(), bits[..4], "at most /Height rows");
+    let mut by_reference = Dict::new();
+    by_reference.set(b"K".to_vec(), Object::Ref(doc.add(Object::Int(-1))));
+    by_reference.set(b"Columns".to_vec(), Object::Ref(doc.add(Object::Int(10))));
+    assert_eq!(image(&doc, Some(Object::Dict(by_reference)), 10, 3).unwrap(), bits, "/K and /Columns by reference");
+    let mut understated = parms.clone();
+    understated.set(b"Rows".to_vec(), Object::Int(1));
+    assert_eq!(image(&doc, Some(Object::Dict(understated)), 10, 3).unwrap(), bits, "/Height rows, whatever /Rows says");
+    assert!(matches!(image(&doc, Some(Object::Dict(parms.clone())), 12, 3), Err(CosError::Filter(_))), "/Columns other than /Width");
+    assert!(matches!(image(&doc, None, 10, 3), Err(CosError::Filter(_))), "the default 1728 /Columns");
+    let mut plain = Dict::new();
+    plain.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+    assert_eq!(doc.decoded_image(&Stream::from_raw(plain, pdfcraft_filters::encode_flate(&bits))).unwrap(), bits);
+
+    // Behind other filters, its parameters at its own place in the array (/Crypt counts).
+    let behind = |filters: &[Object], parms: &[Object], data: Vec<u8>| {
+        let mut d = Dict::new();
+        d.set(b"Width".to_vec(), Object::Int(10));
+        d.set(b"Height".to_vec(), Object::Int(3));
+        d.set(b"Filter".to_vec(), Object::Array(filters.to_vec()));
+        d.set(b"DecodeParms".to_vec(), Object::Array(parms.to_vec()));
+        doc.decoded_image(&Stream::from_raw(d, data))
+    };
+    let (fax, null, own) = (Object::name("CCITTFaxDecode"), Object::Null, Object::Dict(parms.clone()));
+    let hex = coded.iter().map(|b| format!("{b:02x}")).chain([">".to_string()]).collect::<String>().into_bytes();
+    let flated = pdfcraft_filters::encode_flate(&coded);
+    let ahx = [Object::name("AHx"), fax.clone()];
+    assert_eq!(behind(&ahx, &[null.clone(), Object::Ref(indirect)], hex.clone()).unwrap(), bits, "behind ASCIIHexDecode");
+    assert_eq!(
+        behind(&[Object::name("FlateDecode"), Object::name("CCF")], &[null.clone(), own.clone()], flated.clone()).unwrap(),
+        bits,
+        "behind Flate"
+    );
+    assert_eq!(behind(&[Object::name("Crypt"), fax.clone()], &[null.clone(), own.clone()], coded.clone()).unwrap(), bits, "after /Crypt");
+    assert!(behind(&ahx, &[own.clone(), null.clone()], hex).is_err(), "the first entry is the other filter's");
+    assert!(behind(&[fax.clone(), Object::name("FlateDecode")], &[own.clone(), null.clone()], flated).is_err(), "CCITT, then Flate");
+    assert!(behind(&[Object::Int(5), fax], &[null, own], coded.clone()).is_err(), "a /Filter entry that isn't a name");
+}
+
 #[test]
 fn a_read_state_matches_a_clone_and_no_changed_document() {
     let mut doc = Document::new_empty();
diff --git a/crates/cos/src/object.rs b/crates/cos/src/object.rs
index c9b2ff9a36..17ee7844cf 100644
--- a/crates/cos/src/object.rs
+++ b/crates/cos/src/object.rs
@@ -261,7 +261,7 @@ impl Stream {
     /// [`Stream::filters`], or an error when `/Filter` is present but is not a name or an
     /// array of names (an indirect reference, say): the data is not unfiltered, so it must not
     /// read as decoded.
-    fn readable_filters(&self) -> Result<Vec<(Filter, Params)>, pdfcraft_filters::FilterError> {
+    pub(crate) fn readable_filters(&self) -> Result<Vec<(Filter, Params)>, pdfcraft_filters::FilterError> {
         let readable = match self.dict.get(b"Filter") {
             None | Some(Object::Null | Object::Name(_)) => true,
             Some(Object::Array(a)) => a.iter().all(|f| f.as_name().is_some()),
diff --git a/crates/create/Cargo.toml b/crates/create/Cargo.toml
index e60e554ba8..3648c3be00 100644
--- a/crates/create/Cargo.toml
+++ b/crates/create/Cargo.toml
@@ -11,8 +11,6 @@ workspace = true
 [dependencies]
 pdfcraft-cos = { workspace = true }
 pdfcraft-filters = { workspace = true }
-# Already in the graph through hayro: decodes CCITT fax images for Export ▸ Images.
-hayro-ccitt.workspace = true
 pdfcraft-model = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 # For `image::bmp_with_pixel_offset`, shared with XFA pictures.
@@ -27,5 +25,7 @@ thiserror = { workspace = true }
 encoding_rs = "0.8"
 
 [dev-dependencies]
+# An independent CCITT decoder, to check Create PDF's Group 4 images.
+hayro-ccitt.workspace = true
 image = { version = "0.25", default-features = false, features = ["bmp", "gif", "jpeg"] }
 hayro-syntax = { workspace = true }
diff --git a/crates/create/README.md b/crates/create/README.md
index b63dc933b0..05131d9038 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -35,10 +35,9 @@ Soft-mask Decode intervals map samples to opacity before the mask is resized, in
 The existing 16-bit path still uses each sample's high byte.
 JPEG image Decode handling remains limited.
 ICC transforms and calibrated color conversion remain outside this export path.
-CCITT fax images (Group 3 and 4) are decoded for export through `hayro-ccitt` with their `/DecodeParms`
-(`/Columns` has to be the image's width), behind other filters such as `ASCII85Decode` too.
-Byte-aligned Group 3 rows are read by their end-of-line codes, whether the fill starts each code on
-a byte or ends it on one, when the data starts with one (T.4 sends one before the first row), and on
-bytes otherwise, whatever `/EndOfLine` says; data that comes up short is reported. Data with codes
-but none before the first row is read on bytes, and is reported or, at `/K 0`, may come out wrong.
-JPEG 2000 and JBIG2 images are still reported, not exported.
+CCITT fax images (Group 3 and 4) are decoded for export through `pdfcraft_cos::Document::decoded_image` with their
+`/DecodeParms` (`/Columns` has to be the image's width; up to `/Height` rows, whatever `/Rows` says), behind other filters such as
+`ASCII85Decode` too. Byte-aligned Group 3 rows are read by their end-of-line codes, whether the fill starts each code on a byte or
+ends it on one, when the data starts with one (T.4 sends one before the first row), and on bytes otherwise, whatever `/EndOfLine`
+says; data that comes up short is reported. Data with codes but none before the first row is read on bytes, and is reported or,
+at `/K 0`, may come out wrong. JPEG 2000 and JBIG2 images are still reported, not exported.
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 814b68aea2..e62eae31d2 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -4,7 +4,6 @@
 //! key as alpha. Images PdfCraft can't decode yet (JPEG 2000, JBIG2, separations) are
 //! reported, never silently left out.
 
-use std::borrow::Cow;
 use std::collections::HashSet;
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
@@ -101,149 +100,6 @@ fn filters(s: &Stream) -> Vec<Vec<u8>> {
     }
 }
 
-/// The samples of image `s`, decoded: through its filters, or, for a CCITT fax image (its last
-/// filter), through the filters before it and then a CCITT decoder, as rows of one-bit samples
-/// each starting on a byte, with black as 0 unless `/BlackIs1` says 1, as `CCITTFaxDecode` gives
-/// them (ISO 32000-2 §7.4.6).
-fn decoded(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
-    // Parameters given by reference, which the filters read only once direct.
-    let s = &*doc.with_direct_parms(s);
-    let names = filters(s);
-    match names.split_last() {
-        Some((f, outer)) if f == b"CCITTFaxDecode" || f == b"CCF" => {
-            // Such as ASCII85Decode, undone first (7.4.1).
-            let chain = s.filters();
-            let data = match chain.split_last() {
-                Some((_, before)) if !before.is_empty() => {
-                    Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, pdfcraft_cos::MAX_DECODED).map_err(|e| e.to_string())?.0)
-                }
-                _ => Cow::Borrowed(&s.raw[..]),
-            };
-            ccitt(doc, s, &data, decode_parms(doc, s, outer.len()))
-        }
-        _ => s.decoded().map_err(|e| e.to_string()),
-    }
-}
-
-/// The `/DecodeParms` of filter `index` of a stream: the dictionary of a stream with one filter,
-/// or that entry of an array (7.4.2).
-fn decode_parms(doc: &Document, s: &Stream, index: usize) -> Dict {
-    let Some(p) = s.dict.get(b"DecodeParms").map(|p| doc.resolve(p)) else { return Dict::default() };
-    let p = match &*p {
-        Object::Array(a) => match a.get(index) {
-            Some(entry) => doc.resolve(entry),
-            None => return Dict::default(),
-        },
-        _ if index == 0 => p,
-        _ => return Dict::default(),
-    };
-    p.as_dict().cloned().unwrap_or_default()
-}
-
-/// [`decoded`] for a CCITT fax image: `data`, coded with parameters `p` (Table 11 defaults).
-/// `/Columns` has to be the image's width; pixels past it and rows past the image's height are
-/// dropped, so the output is bounded by the size the caller already checked. A stream that ends
-/// early gives fewer rows, which the caller refuses.
-fn ccitt(doc: &Document, s: &Stream, data: &[u8], p: Dict) -> Result<Vec<u8>, String> {
-    struct Rows {
-        out: Vec<u8>,
-        row: Vec<u8>,
-        x: usize,
-        columns: usize,
-        rows: usize,
-        black_is_1: bool,
-    }
-    impl Rows {
-        fn push(&mut self, white: bool, count: usize) {
-            for _ in 0..count {
-                if self.x < self.columns
-                    && white != self.black_is_1
-                    && let Some(b) = self.row.get_mut(self.x / 8)
-                {
-                    *b |= 0x80 >> (self.x % 8);
-                }
-                self.x = self.x.saturating_add(1);
-            }
-        }
-    }
-    impl hayro_ccitt::Decoder for Rows {
-        fn push_pixel(&mut self, white: bool) {
-            self.push(white, 1);
-        }
-        fn push_pixel_chunk(&mut self, white: bool, chunks: u32) {
-            self.push(white, (chunks as usize).saturating_mul(8));
-        }
-        fn next_line(&mut self) {
-            if self.out.len() / self.row.len().max(1) < self.rows {
-                self.out.extend_from_slice(&self.row);
-            }
-            self.row.fill(0);
-            self.x = 0;
-        }
-    }
-    let flag = |key: &[u8], default: bool| match p.get(key).map(|v| doc.resolve(v)).as_deref() {
-        Some(Object::Bool(b)) => *b,
-        _ => default,
-    };
-    let int = |key: &[u8]| p.get(key).and_then(|v| doc.resolve(v).as_int());
-    let k = int(b"K").unwrap_or(0);
-    // A row is the image's width: that was checked against the export's size limit, so a hostile
-    // /Columns can't size the buffers.
-    let columns = u32::try_from(int(b"Columns").unwrap_or(1728)).ok().filter(|c| *c > 0).ok_or("the fax image has no columns")?;
-    if s.dict.int(b"Width") != Some(i64::from(columns)) {
-        return Err("the fax image's columns aren't its width".into());
-    }
-    // As many rows as the image has, whatever /Rows says: one below /Height would cut the picture
-    // short, and rows past /Height aren't drawn.
-    let rows = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
-    let stride = (columns as usize).div_ceil(8);
-    let decode = |aligned: bool| {
-        let settings = hayro_ccitt::DecodeSettings {
-            columns,
-            rows,
-            end_of_block: flag(b"EndOfBlock", true),
-            end_of_line: flag(b"EndOfLine", false),
-            rows_are_byte_aligned: aligned,
-            encoding: match k {
-                ..0 => hayro_ccitt::EncodingMode::Group4,
-                0 => hayro_ccitt::EncodingMode::Group3_1D,
-                k => hayro_ccitt::EncodingMode::Group3_2D { k: u32::try_from(k).unwrap_or(u32::MAX) },
-            },
-            invert_black: false,
-        };
-        let mut out = Rows {
-            out: Vec::new(),
-            row: vec![0; stride],
-            x: 0,
-            columns: columns as usize,
-            rows: rows as usize,
-            black_is_1: flag(b"BlackIs1", false),
-        };
-        // Rows decoded before damaged data are kept; too few rows are refused by the caller.
-        let _ = hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
-        out.out
-    };
-    let aligned = flag(b"EncodedByteAlign", false);
-    // Group 4 reads as its parameters say, and so do rows not on bytes.
-    if k < 0 || !aligned {
-        return Ok(decode(aligned));
-    }
-    // Group 3 rows on bytes may have end-of-line codes whatever /EndOfLine says (the filter always
-    // accepts them), with the fill starting each code on a byte or ending it on one (T.4's fill, as
-    // TIFF writes it). Read unaligned, the codes mark the rows either way; without codes, the rows
-    // are read on bytes. A reading that comes up short isn't tried the other way: data cut short
-    // would then read as other rows, and is refused instead.
-    Ok(decode(!starts_with_end_of_line(data)))
-}
-
-/// Whether CCITT fax `data` starts with an end-of-line code: a 1 after 11 zeros or more, fill
-/// included. T.4 sends one before the first row when it sends them at all, and no other code starts
-/// with more than eight zeros.
-fn starts_with_end_of_line(data: &[u8]) -> bool {
-    let Some((i, b)) = data.iter().enumerate().find(|(_, b)| **b != 0) else { return false };
-    i.saturating_mul(8).saturating_add(b.leading_zeros() as usize) >= 11
-}
-
 /// The file for one image: its JPEG data as is, or a PNG. An image with transparency (a soft
 /// mask, a stencil `/Mask` or a colour-key `/Mask`) is always a PNG with that transparency as
 /// alpha, JPEG images included, so cut-out images keep their transparent background.
@@ -291,7 +147,7 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String>
         space = decoded;
         (samples, 8)
     } else {
-        let data = decoded(doc, s)?;
+        let data = doc.decoded_image(s).map_err(|e| e.to_string())?;
         let bpc = if mask { 1 } else { s.dict.int(b"BitsPerComponent").unwrap_or(8) };
         let bpc = match bpc {
             1 => 1,
@@ -633,7 +489,7 @@ fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>>
                 _ => return None,
             };
             let max = (1u32 << bpc.min(8)) - 1;
-            unpack(&decoded(doc, m).ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
+            unpack(&doc.decoded_image(m).ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
         }
     };
     if let Some([lo, hi]) = decode(doc, m, 1).and_then(|pairs| pairs.first().copied()) {
diff --git a/crates/filters/Cargo.toml b/crates/filters/Cargo.toml
index 2ed64eb8bd..91b5d3d578 100644
--- a/crates/filters/Cargo.toml
+++ b/crates/filters/Cargo.toml
@@ -12,10 +12,11 @@ workspace = true
 
 [dependencies]
 fax.workspace = true
+# CCITT fax decoding (`decode_ccitt`); already in the tree through hayro.
+hayro-ccitt.workspace = true
 flate2.workspace = true
 thiserror.workspace = true
 
 [dev-dependencies]
-hayro-ccitt.workspace = true
 proptest.workspace = true
 weezl.workspace = true
diff --git a/crates/filters/README.md b/crates/filters/README.md
index 413dff37c1..b59b170c90 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -3,7 +3,7 @@
 PDF stream filters: the decoders and encoders behind `/Filter` and `/DecodeParms`.
 
 - **Layer:** L0, standalone. No dependency on any other PdfCraft crate. `cos` depends on it (architecture §3 rule 3).
-- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder.
+- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder; CCITT decoding (T.4 and T.6) is the `hayro-ccitt` crate's (MIT OR Apache-2.0, already in the tree through hayro), bounded here.
 - `#![forbid(unsafe_code)]`. Builds for `wasm32-unknown-unknown`.
 
 ## API
@@ -23,6 +23,8 @@ decode_tolerant_counted(chain, data, max_output) -> Result<(Vec<u8>, bool /*part
 encode(filter, params, data) -> Result<Vec<u8>, FilterError>
 encode_flate(data) -> Vec<u8>   // zlib, level 6
 encode_g4(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as CCITT Group 4; columns <= MAX_G4_COLUMNS
+pub struct CcittParams { k, columns, rows, end_of_line, encoded_byte_align, end_of_block, black_is_1 }  // Table 11; Default = its defaults
+decode_ccitt(data, &params, max_rows) -> Result<Vec<u8>, FilterError>   // CCITT fax as CCITTFaxDecode gives it; columns <= MAX_CCITT_COLUMNS
 ```
 
 - `chain` is applied first to last, as in a `/Filter` array.
@@ -41,16 +43,16 @@ encode_g4(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows a
 | ASCIIHexDecode | white space ignored, odd digit padded with 0, `>` EOD (optional), other characters → Corrupt | upper case, newline every 64 digits, `>` |
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
-| CCITTFaxDecode | not here (`Unsupported`; renderers decode it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
+| CCITTFaxDecode | not in a chain (`Unsupported`); `decode_ccitt` decodes Group 3 and Group 4 on its own, as rows of 1-bit samples each on a new byte, black 0 unless `black_is_1`, at most `max_rows` rows (fewer with `/Rows`), the rows before any damage, up to 1,048,576 samples a row (`pdfcraft_cos::Document::decoded_image` calls it for a fax image, after the filters before it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
 
 ## Tests
 
 - Unit tests per filter with hand-computed vectors (the ISO 32000-2 LZW example, RFC 1951 stored blocks, PNG/TIFF rows).
 - LZW is cross-checked against `weezl` (dev-dependency) in both directions for both early-change settings.
 - `tests/proptests.rs`: encode→decode round trips for every encodable filter × predictor × colors × bpc × columns, two-filter chains, output-limit checks, and fuzz-style no-panic tests (random bytes, random/nonsense params, bit-flipped valid streams).
-- `ccitt.rs`: Group 4 output decoded by `hayro-ccitt` (dev-dependency, an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
+- `ccitt.rs`: `decode_ccitt` gives back the rows `encode_g4` was given (with `/BlackIs1`, `/Rows` and a row limit), refuses bad widths, and bounds its output for any input. Group 4 output decoded by `hayro-ccitt` (an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
 - `fuzz/`: a detached cargo-fuzz crate (`cargo +nightly fuzz run decode`, run from `crates/filters/`).
 
 ## Status
 
-M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image codecs (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2, CCITT G3/G4 decode, DCT encode), CCITT Group 3 encoding and Flate encode levels other than 6.
+M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image codecs (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2, DCT encode), CCITT Group 3 encoding and Flate encode levels other than 6.
diff --git a/crates/filters/src/ccitt.rs b/crates/filters/src/ccitt.rs
index 3c8018525a..731a1a6de5 100644
--- a/crates/filters/src/ccitt.rs
+++ b/crates/filters/src/ccitt.rs
@@ -1,5 +1,6 @@
-//! CCITT Group 4 (ITU-T T.6) encoding, for `CCITTFaxDecode` with `/K -1` (ISO 32000-2 §7.4.6).
-//! The coding is the `fax` crate's; this module checks what it is given.
+//! CCITT fax for `CCITTFaxDecode` (ISO 32000-2 §7.4.6): Group 4 (ITU-T T.6) encoding, with `/K -1`,
+//! and decoding of Group 3 (T.4) and Group 4. The coding is the `fax` crate's and the decoding the
+//! `hayro-ccitt` crate's; this module checks what they are given and bounds what they give.
 
 use fax::encoder::Encoder;
 use fax::{Color, VecWriter};
@@ -49,6 +50,133 @@ pub fn encode_g4(data: &[u8], columns: u32, rows: u32) -> Result<Vec<u8>, Filter
     }
 }
 
+/// The widest row [`decode_ccitt`] decodes: its row buffer stays within 128 KiB.
+pub const MAX_CCITT_COLUMNS: u32 = 1 << 20;
+
+/// A `CCITTFaxDecode` stream's `/DecodeParms` (ISO 32000-2 Table 11). [`Default`] gives the
+/// table's defaults.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct CcittParams {
+    /// `/K`: negative for Group 4, 0 for Group 3 one-dimensional, positive for Group 3 mixed.
+    pub k: i64,
+    pub columns: i64,
+    /// `/Rows`: 0 when not given.
+    pub rows: i64,
+    pub end_of_line: bool,
+    pub encoded_byte_align: bool,
+    pub end_of_block: bool,
+    pub black_is_1: bool,
+}
+
+impl Default for CcittParams {
+    fn default() -> Self {
+        CcittParams { k: 0, columns: 1728, rows: 0, end_of_line: false, encoded_byte_align: false, end_of_block: true, black_is_1: false }
+    }
+}
+
+/// CCITT fax `data` decoded as `CCITTFaxDecode` gives it: rows of `columns` 1-bit samples, most
+/// significant bit first, each starting on a new byte, with black as 0 (as 1 with `black_is_1`).
+///
+/// At most `max_rows` rows are decoded (fewer when `rows` says so), so the output is bounded by
+/// the caller. Damaged data gives the rows decoded before the damage, as viewers show them: a
+/// caller that needs a number of rows checks it got them.
+///
+/// Group 3 rows on bytes (`k` from 0, `encoded_byte_align`) are read by their end-of-line codes,
+/// whether the fill starts each code on a byte or ends it on one, when `data` starts with one (T.4
+/// sends one before the first row when it sends them at all), and on bytes otherwise, whatever
+/// `end_of_line` says. Group 4 is read as its parameters say.
+///
+/// Errors: `columns` that aren't from 1 to [`MAX_CCITT_COLUMNS`] ([`FilterError::Unsupported`]).
+pub fn decode_ccitt(data: &[u8], p: &CcittParams, max_rows: u32) -> Result<Vec<u8>, FilterError> {
+    let columns = u32::try_from(p.columns)
+        .ok()
+        .filter(|c| (1..=MAX_CCITT_COLUMNS).contains(c))
+        .ok_or_else(|| FilterError::Unsupported(format!("CCITT fax rows {} samples wide", p.columns)))?;
+    let rows = u32::try_from(p.rows).ok().filter(|r| *r > 0).map_or(max_rows, |r| r.min(max_rows));
+    if rows == 0 {
+        return Ok(Vec::new());
+    }
+    let settings = hayro_ccitt::DecodeSettings {
+        columns,
+        rows,
+        end_of_block: p.end_of_block,
+        end_of_line: p.end_of_line,
+        // Group 3 rows on bytes may have end-of-line codes whatever `end_of_line` says (the filter
+        // always accepts them), with the fill starting each code on a byte or ending it on one (T.4's
+        // fill, as TIFF writes it). Read unaligned, the codes mark the rows either way; without
+        // codes, the rows are read on bytes. A reading that comes up short isn't tried the other
+        // way: data cut short would then read as other rows.
+        rows_are_byte_aligned: p.encoded_byte_align && (p.k < 0 || !starts_with_end_of_line(data)),
+        encoding: match p.k {
+            ..0 => hayro_ccitt::EncodingMode::Group4,
+            0 => hayro_ccitt::EncodingMode::Group3_1D,
+            k => hayro_ccitt::EncodingMode::Group3_2D { k: u32::try_from(k).unwrap_or(u32::MAX) },
+        },
+        invert_black: false,
+    };
+    // u32 to usize: wasm32 and up have at least 32-bit usize.
+    let mut out = Rows::new(columns as usize, rows as usize, p.black_is_1);
+    // The rows decoded before damaged data are kept.
+    let _ = hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
+    Ok(out.out)
+}
+
+/// Whether CCITT fax `data` starts with an end-of-line code: a 1 after 11 zeros or more, fill
+/// included. T.4 sends one before the first row when it sends them at all, and no other code starts
+/// with more than eight zeros.
+fn starts_with_end_of_line(data: &[u8]) -> bool {
+    let Some((i, b)) = data.iter().enumerate().find(|(_, b)| **b != 0) else { return false };
+    i.saturating_mul(8).saturating_add(b.leading_zeros() as usize) >= 11
+}
+
+/// Rows of 1-bit samples filled from a decoder's pixels: `columns` a row, each row on a new byte, at
+/// most `rows` rows. Pixels past a row's end and rows past the last are dropped.
+struct Rows {
+    out: Vec<u8>,
+    row: Vec<u8>,
+    x: usize,
+    columns: usize,
+    rows: usize,
+    done: usize,
+    black_is_1: bool,
+}
+
+impl Rows {
+    fn new(columns: usize, rows: usize, black_is_1: bool) -> Self {
+        Rows { out: Vec::new(), row: vec![0; columns.div_ceil(8)], x: 0, columns, rows, done: 0, black_is_1 }
+    }
+
+    /// `count` pixels, white or black.
+    fn push(&mut self, white: bool, count: usize) {
+        let end = self.x.saturating_add(count);
+        if white != self.black_is_1 {
+            for x in self.x..end.min(self.columns) {
+                if let Some(b) = self.row.get_mut(x / 8) {
+                    *b |= 0x80 >> (x % 8);
+                }
+            }
+        }
+        self.x = end;
+    }
+}
+
+impl hayro_ccitt::Decoder for Rows {
+    fn push_pixel(&mut self, white: bool) {
+        self.push(white, 1);
+    }
+    fn push_pixel_chunk(&mut self, white: bool, chunks: u32) {
+        self.push(white, (chunks as usize).saturating_mul(8));
+    }
+    fn next_line(&mut self) {
+        if self.done < self.rows {
+            self.out.extend_from_slice(&self.row);
+            self.done += 1;
+        }
+        self.row.fill(0);
+        self.x = 0;
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -159,8 +287,40 @@ mod tests {
         data
     }
 
+    fn g4(columns: u32) -> CcittParams {
+        CcittParams { k: -1, columns: i64::from(columns), ..CcittParams::default() }
+    }
+
+    #[test]
+    fn decoding_gives_the_rows_back() {
+        // 3 columns, padded with anything: the decoded padding is 0.
+        let data = [0b1010_1111, 0b0101_0000, 0b1110_1010];
+        let coded = encode_g4(&data, 3, 3).unwrap();
+        assert_eq!(decode_ccitt(&coded, &g4(3), 3).unwrap(), [0b1010_0000, 0b0100_0000, 0b1110_0000]);
+        // /BlackIs1 gives black as 1.
+        let p = CcittParams { black_is_1: true, ..g4(3) };
+        assert_eq!(decode_ccitt(&coded, &p, 3).unwrap(), [0b0100_0000, 0b1010_0000, 0b0000_0000]);
+        // At most /Rows rows, and at most max_rows.
+        assert_eq!(decode_ccitt(&coded, &CcittParams { rows: 2, ..g4(3) }, 3).unwrap().len(), 2);
+        assert_eq!(decode_ccitt(&coded, &g4(3), 1).unwrap().len(), 1);
+        assert_eq!(decode_ccitt(&coded, &CcittParams { rows: 3, ..g4(3) }, 1).unwrap().len(), 1, "max_rows bounds /Rows");
+        assert_eq!(decode_ccitt(&coded, &g4(3), 0).unwrap(), [0u8; 0]);
+        // Damaged data gives the rows before the damage; none here.
+        assert!(decode_ccitt(&coded[..1], &g4(3), 3).unwrap().len() < 3);
+    }
+
+    #[test]
+    fn what_it_cannot_decode_is_an_error() {
+        for columns in [0, -1, i64::from(MAX_CCITT_COLUMNS) + 1, i64::MAX] {
+            let p = CcittParams { columns, ..CcittParams::default() };
+            assert!(matches!(decode_ccitt(&[0; 8], &p, 4), Err(FilterError::Unsupported(_))), "{columns}");
+        }
+        assert_eq!(CcittParams::default().columns, 1728, "Table 11");
+    }
+
     proptest::proptest! {
-        /// Any bitmap, of noise or of runs, decodes to its own bits through an independent decoder.
+        /// Any bitmap, of noise or of runs, decodes to its own bits, through an independent decoder
+        /// and through `decode_ccitt`.
         #[test]
         fn bitmaps_round_trip(
             columns in 1u32..400,
@@ -169,14 +329,20 @@ mod tests {
             noise in proptest::bool::ANY,
         ) {
             let data = bitmap(columns, rows, &runs, noise);
-            let g4 = encode_g4(&data, columns, rows).unwrap();
-            proptest::prop_assert_eq!(decode(&g4, columns, rows), unpack(&data, columns, rows));
+            let coded = encode_g4(&data, columns, rows).unwrap();
+            proptest::prop_assert_eq!(decode(&coded, columns, rows), unpack(&data, columns, rows));
+            let decoded = decode_ccitt(&coded, &g4(columns), rows).unwrap();
+            proptest::prop_assert_eq!(unpack(&decoded, columns, rows), unpack(&data, columns, rows));
         }
 
         /// Whatever it is given, it returns.
         #[test]
-        fn any_input_returns(data in proptest::collection::vec(0u8..=255, 0..600), columns in 0u32..40_000, rows in 0u32..80) {
+        fn any_input_returns(data in proptest::collection::vec(0u8..=255, 0..600), columns in 0u32..40_000, rows in 0u32..80, k in -2i64..3) {
             let _ = encode_g4(&data, columns, rows);
+            let p = CcittParams { k, columns: i64::from(columns), ..CcittParams::default() };
+            if let Ok(out) = decode_ccitt(&data, &p, rows) {
+                proptest::prop_assert!(out.len() <= (columns as usize).div_ceil(8) * rows as usize);
+            }
         }
     }
 }
diff --git a/crates/filters/src/lib.rs b/crates/filters/src/lib.rs
index b9461435eb..63daefc4ea 100644
--- a/crates/filters/src/lib.rs
+++ b/crates/filters/src/lib.rs
@@ -24,7 +24,7 @@ mod runlength;
 
 use std::borrow::Cow;
 
-pub use ccitt::{MAX_G4_COLUMNS, encode_g4};
+pub use ccitt::{CcittParams, MAX_CCITT_COLUMNS, MAX_G4_COLUMNS, decode_ccitt, encode_g4};
 
 /// A PDF stream filter, identified by its `/Filter` name.
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
diff --git a/crates/optimize/Cargo.toml b/crates/optimize/Cargo.toml
index 456ab4c991..d1a759d468 100644
--- a/crates/optimize/Cargo.toml
+++ b/crates/optimize/Cargo.toml
@@ -24,3 +24,4 @@ zune-jpeg = "0.5"
 
 [dev-dependencies]
 pdfcraft-render = { workspace = true }
+proptest.workspace = true
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 1f184f0ffb..ba71eb38f5 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -34,18 +34,30 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   alone, since readers differ on which wins. Samples are read with `/DecodeParms` given by
   reference too, the numbers inside included (`Document::with_direct_parms`), here and below:
   without them a predictor's tag bytes would shift every row of an image written back.
-- **Monochrome images** (`Settings::mono`, CCITT Group 4 by default): a 1-bit image with one
-  colour component (grey, indexed, a separation) or an image mask, stored with no filter or with
-  general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
-  that is smaller as stored. An eight-bit grey image of only 0 and 255 is packed to one bit first
-  (not an indexed image, whose samples are palette indices, nor one with a colour-key `/Mask`),
-  unless the grey settings make it smaller still, its soft mask counted (resampled with it there,
-  kept as it is here), as they can a dithered scan by downsampling it to JPEG. It is lossless: the samples decode to the same bits, so the colour
-  space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
-  on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
-  JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
-  than 32,767 samples. Redaction doesn't decode Group 4 yet: a mark over part of an image stored
-  this way removes the whole image (nothing leaks).
+- **Monochrome images** (`Settings::mono`, `MonoSettings::REDUCE` by default: to 300 ppi above
+  450 ppi, CCITT Group 4). Black-and-white images are a 1-bit image with one colour component
+  (grey, indexed, a separation) or an image mask, stored with no filter, with general-purpose ones
+  or with CCITT fax after any of those (decoded by `Document::decoded_image`), and an eight-bit grey image of
+  only 0 and 255, packed to one bit (not an indexed image, whose samples are palette indices, nor
+  one with a colour-key `/Mask`) unless the grey settings make it smaller still, its soft mask counted
+  (resampled with it there, kept as it is here), as they can a dithered scan by downsampling it to
+  JPEG.
+  - **Downsampling:** one whose effective resolution is above `above_ppi` is averaged down to
+    `target_ppi`: each new pixel takes the sample covering more of its area, a 0 (black in grey)
+    on a tie, so a dark line half a new pixel wide stays. Not one with a soft mask, whose own size
+    would have to follow. On a 600 ppi text page, Group 4 at 300 ppi is half the size.
+  - **Compression:** CCITT Group 4 (`pdfcraft_filters::encode_g4`), or 1-bit Flate when that is
+    smaller, which only a resampled image or one packed from eight bits may be: a 1-bit image that
+    is only stored again becomes Group 4 or stays. A CCITT image is only decoded to be resampled,
+    unless another filter such as `ASCII85Decode` wraps it, which storing it again drops. With Retain, a resampled image keeps its kind of
+    compression (CCITT, or Flate) and nothing else changes; eight-bit grey is then left to the grey
+    settings. Every change is kept only when it is smaller as stored.
+  - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
+    space, decode array and `/Mask` stay. Group 4 wins on scans, whose ragged edges defeat Flate;
+    on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, Group 3 to Group 4
+    without resampling, inline images, and Group 4 for rows wider than 32,767 samples. Redaction
+    doesn't decode Group 4 yet: a mark over part of an image stored this way removes the whole
+    image (nothing leaks).
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 8550affb5c..f6fd5e5770 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -5,7 +5,7 @@ use std::collections::{HashMap, HashSet};
 use pdfcraft_content::{Matrix, Pieces};
 use pdfcraft_cos::{DecodeBudget, Dict, Document, ObjRef, Object, Stream};
 
-use crate::{Compression, ImageSettings, MonoCompression, OptimizeError, Report, Settings, Stage};
+use crate::{Compression, ImageSettings, MonoCompression, MonoSettings, OptimizeError, Report, Settings, Stage};
 
 /// Images with more pixels than this are left alone (memory).
 const MAX_PIXELS: u64 = 80_000_000;
@@ -562,102 +562,172 @@ fn one_component(doc: &Document, cs: &Object) -> bool {
     }
 }
 
-/// A black-and-white image (one bit per pixel, or an image mask) stored again as CCITT Group 4,
-/// if `compression` asks for that and the result is smaller as stored. Only images whose samples
-/// PdfCraft decodes (no filter, or general-purpose filters: image codecs don't decode here)
-/// qualify. The samples decode to the same bits, so the colour space, decode array and masks stay
-/// as they are.
-fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stream> {
-    if compression != MonoCompression::CcittG4 {
-        return None;
-    }
+/// The samples of a black-and-white image, as rows of 1-bit samples each starting on a new byte,
+/// with its width and height, and whether they were packed from eight bits. Two kinds count:
+/// - one bit per pixel in one colour component, or an image mask, stored with no filter, with
+///   general-purpose ones, or with CCITT fax last ([`Document::decoded_image`]);
+/// - with `eight_bit`, eight-bit grey whose every sample is 0 or 255. A decode array maps 0 and 255
+///   at eight bits as it maps 0 and 1 at one bit, so it stays. Left out: indexed images (their
+///   samples are palette indices) and a colour-key `/Mask` (its ranges are in eight-bit values).
+fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32, u32, bool)> {
     let d = &s.dict;
-    let bits = d.int(b"BitsPerComponent");
-    let qualifies = if matches!(d.get(b"ImageMask"), Some(Object::Bool(true))) {
-        bits.is_none_or(|b| b == 1)
-    } else {
-        bits == Some(1) && d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs))
-    };
-    if !qualifies {
-        return None;
-    }
-    let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
-    if w == 0 || h == 0 || w > pdfcraft_filters::MAX_G4_COLUMNS || u64::from(w) * u64::from(h) > MAX_PIXELS {
-        return None;
-    }
-    // Through its parameters given by reference too, as `pixels` reads, and no further than its
-    // rows can need.
-    let bytes = usize::try_from(w).ok()?.div_ceil(8).checked_mul(usize::try_from(h).ok()?)?;
-    let g4 = pdfcraft_filters::encode_g4(&doc.with_direct_parms(s).decoded_within(allowance(bytes, h)?).ok()?, w, h).ok()?;
-    let mut new = d.clone();
-    for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
-        new.remove(k);
-    }
-    let mut parms = Dict::new();
-    parms.set(b"K".to_vec(), Object::Int(-1));
-    parms.set(b"Columns".to_vec(), Object::Int(i64::from(w)));
-    parms.set(b"Rows".to_vec(), Object::Int(i64::from(h)));
-    new.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
-    new.set(b"DecodeParms".to_vec(), Object::Dict(parms));
-    let new = Stream::from_raw(new, g4);
-    // Smaller as stored, counting the larger dictionary: a tiny image can lose by it.
-    (crate::stored_len(&new)? < crate::stored_len(s)?).then_some(new)
-}
-
-/// An eight-bit grey image whose every sample is 0 or 255, stored at one bit per pixel and then as
-/// `compression` asks (see [`mono`]), if that is smaller as stored. Lossless: a decode array maps
-/// 0 and 255 at eight bits as it maps 0 and 1 at one bit, so it stays. Left alone: indexed images
-/// (their samples are palette indices), a colour-key `/Mask` (its ranges are in eight-bit values),
-/// and everything when `compression` is Retain: such an image is then a grey image like any other,
-/// which the grey settings handle as they did before.
-fn bilevel_grey(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stream> {
-    if compression == MonoCompression::Retain {
-        return None;
-    }
-    let d = &s.dict;
-    let indexed = |cs: &Object| match &*doc.resolve(cs) {
-        Object::Array(a) => matches!(a.first().and_then(Object::as_name), Some(b"Indexed" | b"I")),
-        _ => false,
-    };
-    let colour_key = d.get(b"Mask").is_some_and(|m| doc.resolve(m).as_array().is_some());
-    if d.int(b"BitsPerComponent") != Some(8)
-        || matches!(d.get(b"ImageMask"), Some(Object::Bool(true)))
-        || colour_key
-        || !d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs) && !indexed(cs))
-    {
-        return None;
-    }
     // Through u32 first, as everywhere here, so the product can't overflow.
     let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
     if w == 0 || h == 0 || u64::from(w) * u64::from(h) > MAX_PIXELS {
         return None;
     }
-    let (w, h) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
+    let (wu, hu) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
+    let stride = wu.div_ceil(8);
+    let bits = d.int(b"BitsPerComponent");
+    let mask = matches!(d.get(b"ImageMask"), Some(Object::Bool(true)));
+    if (mask && bits.is_none_or(|b| b == 1)) || (bits == Some(1) && d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs))) {
+        // A fax image through its decoder; any other no further than its rows can need.
+        let len = stride.checked_mul(hu)?;
+        let mut data = match s.filters().last() {
+            Some((pdfcraft_filters::Filter::CcittFax, _)) => doc.decoded_image(s),
+            _ => doc.with_direct_parms(s).decoded_within(allowance(len, h)?),
+        }
+        .ok()?;
+        if data.len() < len {
+            return None;
+        }
+        data.truncate(len);
+        return Some((data, w, h, false));
+    }
+    let indexed = |cs: &Object| match &*doc.resolve(cs) {
+        Object::Array(a) => matches!(a.first().and_then(Object::as_name), Some(b"Indexed" | b"I")),
+        _ => false,
+    };
+    let colour_key = d.get(b"Mask").is_some_and(|m| doc.resolve(m).as_array().is_some());
+    if !eight_bit || bits != Some(8) || mask || colour_key || !d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs) && !indexed(cs)) {
+        return None;
+    }
     // Through its parameters given by reference too: without a PNG predictor's tag bytes taken
     // off, rows of 0 and 255 would still pass below, each shifted by a byte.
-    let samples = doc.with_direct_parms(s).decoded_within(allowance(w.checked_mul(h)?, u32::try_from(h).ok()?)?).ok()?;
-    let samples = samples.get(..w.checked_mul(h)?)?;
-    let stride = w.div_ceil(8);
-    let mut packed = vec![0u8; stride.checked_mul(h)?];
+    let samples = doc.with_direct_parms(s).decoded_within(allowance(wu.checked_mul(hu)?, h)?).ok()?;
+    let samples = samples.get(..wu.checked_mul(hu)?)?;
+    let mut packed = vec![0u8; stride.checked_mul(hu)?];
     for (i, v) in samples.iter().enumerate() {
         match v {
             0 => {}
             255 => {
-                if let Some(b) = packed.get_mut((i / w) * stride + (i % w) / 8) {
-                    *b |= 0x80 >> (i % w % 8);
+                if let Some(b) = packed.get_mut((i / wu) * stride + (i % wu) / 8) {
+                    *b |= 0x80 >> (i % wu % 8);
                 }
             }
             _ => return None,
         }
     }
-    let mut one_bit = d.clone();
-    for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
-        one_bit.remove(k);
+    Some((packed, w, h, true))
+}
+
+/// `w` × `h` 1-bit rows (each starting on a new byte) averaged down to `nw` × `nh`, no larger:
+/// each new pixel takes the sample that covers more of its area, and a 0 when the two tie. A 0 is
+/// black in grey and the painted part of an image mask, so a dark line half a new pixel wide stays.
+/// `None` when the rows are short or the new size isn't smaller in both directions or empty.
+pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32) -> Option<Vec<u8>> {
+    if nw == 0 || nh == 0 || nw > w || nh > h {
+        return None;
     }
-    one_bit.set(b"BitsPerComponent".to_vec(), Object::Int(1));
-    let one_bit = Stream::flate(one_bit, &packed);
-    let best = mono(doc, &one_bit, compression).unwrap_or(one_bit);
-    (crate::stored_len(&best)? < crate::stored_len(s)?).then_some(best)
+    let (stride, nstride) = (usize::try_from(w).ok()?.div_ceil(8), usize::try_from(nw).ok()?.div_ceil(8));
+    let data = data.get(..stride.checked_mul(usize::try_from(h).ok()?)?)?;
+    let mut out = vec![0u8; nstride.checked_mul(usize::try_from(nh).ok()?)?];
+    // In units of 1/nw of a source column, source column x spans [x·nw, (x+1)·nw) and new column i
+    // spans [i·w, (i+1)·w); rows likewise with h and nh. A new pixel's area is then w·h.
+    let (w, h, nw, nh) = (u64::from(w), u64::from(h), u64::from(nw), u64::from(nh));
+    let overlap = |a0: u64, a1: u64, b0: u64, b1: u64| a1.min(b1).saturating_sub(a0.max(b0));
+    // Per source column, the area its 1 samples cover in the new row.
+    let mut ones = vec![0u64; usize::try_from(w).ok()?];
+    for j in 0..nh {
+        ones.fill(0);
+        let (y0, y1) = (j * h, (j + 1) * h);
+        for y in y0 / nh..y1.div_ceil(nh).min(h) {
+            let weight = overlap(y0, y1, y * nh, (y + 1) * nh);
+            let row = data.get(usize::try_from(y).ok()? * stride..)?;
+            for (x, sum) in ones.iter_mut().enumerate() {
+                if row.get(x / 8).is_some_and(|b| b & (0x80 >> (x % 8)) != 0) {
+                    *sum += weight;
+                }
+            }
+        }
+        let out_row = out.get_mut(usize::try_from(j).ok()? * nstride..)?;
+        for i in 0..nw {
+            let (x0, x1) = (i * w, (i + 1) * w);
+            let covered: u64 = (x0 / nw..x1.div_ceil(nw).min(w))
+                .map(|x| overlap(x0, x1, x * nw, (x + 1) * nw) * usize::try_from(x).ok().and_then(|x| ones.get(x)).copied().unwrap_or(0))
+                .sum();
+            // More than half of w·h, which can't overflow (w·h < 2^64 for u32 sizes).
+            if covered > w * h / 2 {
+                let i = usize::try_from(i).ok()?;
+                *out_row.get_mut(i / 8)? |= 0x80 >> (i % 8);
+            }
+        }
+    }
+    Some(out)
+}
+
+/// A black-and-white image (see [`one_bit`]) resampled and stored again per `settings`, if that is
+/// smaller as stored; `ppi` is its effective resolution. Also says whether it was resampled.
+///
+/// - **Resampled** ([`downsample_bits`]) when its resolution is above `above_ppi`, to `target_ppi`,
+///   unless it has a soft mask, whose own size would then have to follow.
+/// - **Stored** as CCITT Group 4 with `CcittG4`, or as 1-bit Flate when that is smaller, which only
+///   a resampled image or one packed from eight bits may be: a 1-bit image that is only stored again
+///   becomes Group 4 or stays. With `Retain`, a resampled image keeps its kind of compression
+///   (CCITT, or Flate), and nothing else changes: eight-bit grey stays a grey image like any
+///   other, which the grey settings handle.
+///
+/// The samples keep their meaning, so the colour space, decode array and `/Mask` stay as they are.
+fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option<(Stream, bool)> {
+    let d = &s.dict;
+    let downsample = settings.downsample && ppi.is_finite() && ppi > settings.above_ppi && settings.target_ppi > 0.0 && !d.contains(b"SMask");
+    let retain = settings.compression == MonoCompression::Retain;
+    let chain = s.filters();
+    // Its kind of compression, which Retain keeps, behind any other filters.
+    let ccitt = matches!(chain.last(), Some((pdfcraft_filters::Filter::CcittFax, _)));
+    // A fax image is only worth decoding to resample it; behind ASCII85Decode, say, storing it
+    // again as Group 4 also drops that filter.
+    let fax_alone = ccitt && chain.len() == 1;
+    if (retain || fax_alone) && !downsample {
+        return None;
+    }
+    let (data, w, h, eight_bit) = one_bit(doc, s, !retain)?;
+    let k = settings.target_ppi / ppi;
+    // At most `w` × `h`, as k < 1: no overflow.
+    let (nw, nh) =
+        if downsample && k < 1.0 { (((f64::from(w) * k).round() as u32).max(1), ((f64::from(h) * k).round() as u32).max(1)) } else { (w, h) };
+    let resampled = (nw, nh) != (w, h);
+    if (retain || fax_alone) && !resampled {
+        return None;
+    }
+    let data = if resampled { downsample_bits(&data, w, h, nw, nh)? } else { data };
+    let mut dict = d.clone();
+    for key in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
+        dict.remove(key);
+    }
+    dict.set(b"Width".to_vec(), Object::Int(i64::from(nw)));
+    dict.set(b"Height".to_vec(), Object::Int(i64::from(nh)));
+    if eight_bit {
+        dict.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    }
+    let g4 = if settings.compression == MonoCompression::CcittG4 || (retain && ccitt) {
+        pdfcraft_filters::encode_g4(&data, nw, nh).ok().map(|coded| {
+            let mut dict = dict.clone();
+            let mut parms = Dict::new();
+            parms.set(b"K".to_vec(), Object::Int(-1));
+            parms.set(b"Columns".to_vec(), Object::Int(i64::from(nw)));
+            parms.set(b"Rows".to_vec(), Object::Int(i64::from(nh)));
+            dict.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+            dict.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+            Stream::from_raw(dict, coded)
+        })
+    } else {
+        None
+    };
+    let flate = ((resampled || eight_bit) && !(retain && ccitt)).then(|| Stream::flate(dict, &data));
+    // Smaller as stored, counting the dictionary: a tiny image can lose by Group 4's parameters.
+    let best = [g4, flate].into_iter().flatten().filter_map(|c| Some((crate::stored_len(&c)?, c))).min_by_key(|(len, _)| *len)?;
+    (best.0 < crate::stored_len(s)?).then_some((best.1, resampled))
 }
 
 pub(crate) fn run(
@@ -686,19 +756,28 @@ pub(crate) fn run(
         let obj = doc.get(r);
         let Object::Stream(s) = &*obj else { continue };
         report.images += 1;
-        if let Some(new) = mono(doc, s, settings.mono) {
+        // Packed from more bits a sample, it is lossless at one bit, but the grey settings can
+        // make it smaller still (below).
+        let packed_from_more = s.dict.int(b"BitsPerComponent").is_some_and(|b| b > 1);
+        let (packed, mono) = match mono(doc, s, ppi, &settings.mono) {
+            Some(m) if packed_from_more => (Some(m), None),
+            m => (None, m),
+        };
+        if let Some((new, resampled)) = mono {
             report.image_bytes_before += s.raw.len();
             report.image_bytes_after += new.raw.len();
-            report.images_recompressed += 1;
+            if resampled {
+                report.images_resampled += 1;
+            } else {
+                report.images_recompressed += 1;
+            }
             doc.set(r, Object::Stream(new));
             continue;
         }
-        let packed = bilevel_grey(doc, s, settings.mono);
         let n = s.dict.get(b"ColorSpace").and_then(|cs| components(doc, cs));
         let processed = n.and_then(|n| process(doc, s, ppi, if n == 1 { &settings.gray } else { &settings.color }, n));
-        // An image packed from eight bits is lossless at one bit, but the grey settings can make it
-        // smaller still (a dithered scan, downsampled and JPEG-compressed): the smaller wins,
-        // counting a soft mask resampled with it.
+        // A dithered scan, say, downsampled and JPEG-compressed: the smaller wins, counting a soft
+        // mask resampled with it.
         let smask_len = |smask: Option<&(ObjRef, Stream)>| match smask {
             Some((_, m)) => Some(m.raw.len()),
             None => s.dict.reference(b"SMask").map(|m| match &*doc.get(m) {
@@ -707,13 +786,17 @@ pub(crate) fn run(
             }),
         };
         let total = |new: &Stream, smask: Option<&(ObjRef, Stream)>| Some(crate::stored_len(new)?.saturating_add(smask_len(smask).unwrap_or(0)));
-        let packed_wins = packed.as_ref().is_some_and(|p| {
+        let packed_wins = packed.as_ref().is_some_and(|(p, _)| {
             processed.as_ref().is_none_or(|(new, smask)| total(p, None).zip(total(new, smask.as_ref())).is_some_and(|(a, b)| a <= b))
         });
-        if let Some(new) = packed.filter(|_| packed_wins) {
+        if let Some((new, resampled)) = packed.filter(|_| packed_wins) {
             report.image_bytes_before += s.raw.len();
             report.image_bytes_after += new.raw.len();
-            report.images_recompressed += 1;
+            if resampled {
+                report.images_resampled += 1;
+            } else {
+                report.images_recompressed += 1;
+            }
             doc.set(r, Object::Stream(new));
             continue;
         }
@@ -788,3 +871,76 @@ mod tests {
         assert!(data.is_none_or(|d| d.len() <= MAX_PAGE_DECODED + 300));
     }
 }
+
+#[cfg(test)]
+mod downsample_tests {
+    use super::downsample_bits;
+
+    /// [`downsample_bits`] the slow way: each new pixel's area against every source pixel's.
+    fn naive(data: &[u8], w: u32, h: u32, nw: u32, nh: u32) -> Vec<u8> {
+        let (stride, nstride) = ((w as usize).div_ceil(8), (nw as usize).div_ceil(8));
+        let (w, h, nw, nh) = (u64::from(w), u64::from(h), u64::from(nw), u64::from(nh));
+        let mut out = vec![0u8; nstride * nh as usize];
+        for j in 0..nh {
+            for i in 0..nw {
+                let mut ones = 0;
+                for y in 0..h {
+                    for x in 0..w {
+                        let across = ((i + 1) * w).min((x + 1) * nw).saturating_sub((i * w).max(x * nw));
+                        let down = ((j + 1) * h).min((y + 1) * nh).saturating_sub((j * h).max(y * nh));
+                        if data[y as usize * stride + x as usize / 8] & (0x80 >> (x % 8)) != 0 {
+                            ones += across * down;
+                        }
+                    }
+                }
+                if 2 * ones > w * h {
+                    out[j as usize * nstride + i as usize / 8] |= 0x80 >> (i % 8);
+                }
+            }
+        }
+        out
+    }
+
+    #[test]
+    fn each_new_pixel_takes_the_sample_covering_more_of_it() {
+        // 4 × 2 to 2 × 1: three 1s of four on the left, none on the right.
+        assert_eq!(downsample_bits(&[0b1100_0000, 0b1000_0000], 4, 2, 2, 1), Some(vec![0b1000_0000]));
+        // A tie gives 0: black in grey, so a black line half a new pixel wide stays (the second
+        // of four white columns is black); a white one that thin on black doesn't.
+        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1), Some(vec![0b0100_0000]));
+        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1), Some(vec![0]));
+        // The same size gives the same bits; padding bits are 0.
+        assert_eq!(downsample_bits(&[0b1010_1111], 3, 1, 3, 1), Some(vec![0b1010_0000]));
+        // 3 to 2 across: the middle column counts half to each new one.
+        assert_eq!(downsample_bits(&[0b1100_0000], 3, 1, 2, 1), Some(vec![0b1000_0000]));
+    }
+
+    #[test]
+    fn what_it_cannot_resample_is_none() {
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 5, 1), None, "wider");
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 2, 3), None, "taller");
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 0, 1), None);
+        assert_eq!(downsample_bits(&[0; 1], 4, 2, 2, 1), None, "short rows");
+        assert_eq!(downsample_bits(&[], u32::MAX, u32::MAX, 1, 1), None);
+    }
+
+    proptest::proptest! {
+        /// Any bitmap, to any size no larger, gives what the slow way gives; all 1s stay all 1s.
+        #[test]
+        fn it_matches_the_slow_way(
+            w in 1u32..40,
+            h in 1u32..16,
+            nw_part in 0.0f64..1.0,
+            nh_part in 0.0f64..1.0,
+            seed in proptest::collection::vec(0u8..=255, 1..64),
+        ) {
+            let (nw, nh) = (1 + (f64::from(w - 1) * nw_part) as u32, 1 + (f64::from(h - 1) * nh_part) as u32);
+            let len = (w as usize).div_ceil(8) * h as usize;
+            let data: Vec<u8> = seed.iter().cycle().take(len).copied().collect();
+            proptest::prop_assert_eq!(downsample_bits(&data, w, h, nw, nh), Some(naive(&data, w, h, nw, nh)));
+            let white = downsample_bits(&vec![0xFF; len], w, h, nw, nh).unwrap();
+            proptest::prop_assert_eq!(white, naive(&vec![0xFF; len], w, h, nw, nh));
+            proptest::prop_assert!(naive(&vec![0xFF; len], w, h, nw, nh).iter().any(|b| *b != 0));
+        }
+    }
+}
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index f4f7baf988..e911055941 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -10,8 +10,9 @@
 //!   A new image replaces the old one only if it is smaller. Images PdfCraft can't decode
 //!   faithfully (CMYK and other colour spaces, masks, decode arrays other than the default,
 //!   JPEG 2000, JBIG2, CCITT, other than 8 bits, JPEGs whose Adobe marker and `/ColorTransform`
-//!   disagree) are left alone. Black-and-white (1-bit) images are stored again as CCITT Group 4,
-//!   losslessly, when that is smaller.
+//!   disagree) are left alone. Black-and-white images (1-bit, CCITT fax among them, and eight-bit
+//!   grey of only black and white) above a threshold are averaged down to a target resolution, and
+//!   are stored as CCITT Group 4 when that is smaller.
 //! - **Discard objects:** page thumbnails, alternate images, document tags (structure tree),
 //!   print settings.
 //! - **Clean up:** drop images and forms that pages list but never draw (such as a deleted
@@ -128,6 +129,23 @@ pub enum MonoCompression {
     Retain,
 }
 
+/// How black-and-white images (1-bit, CCITT fax among them, and eight-bit grey of only black
+/// and white), and image masks, are resampled and stored.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct MonoSettings {
+    /// Average images whose effective resolution is above `above_ppi` down to `target_ppi`.
+    pub downsample: bool,
+    pub target_ppi: f64,
+    pub above_ppi: f64,
+    pub compression: MonoCompression,
+}
+
+impl MonoSettings {
+    /// Reduce File Size and the presets: to 300 ppi above 450 ppi, CCITT Group 4. Text in a scan
+    /// stays sharp at 300 ppi.
+    pub const REDUCE: MonoSettings = MonoSettings { downsample: true, target_ppi: 300.0, above_ppi: 450.0, compression: MonoCompression::CcittG4 };
+}
+
 /// Acrobat's JPEG quality steps.
 pub const QUALITIES: [(&str, u8); 5] = [("Minimum", 25), ("Low", 45), ("Medium", 60), ("High", 80), ("Maximum", 95)];
 
@@ -157,8 +175,8 @@ pub struct Settings {
     pub merge_fragments: bool,
     pub color: ImageSettings,
     pub gray: ImageSettings,
-    /// Black-and-white (1-bit) images, and image masks.
-    pub mono: MonoCompression,
+    /// Black-and-white images, and image masks.
+    pub mono: MonoSettings,
     pub discard_thumbnails: bool,
     pub discard_alternate_images: bool,
     pub discard_tags: bool,
@@ -193,7 +211,7 @@ impl Default for Settings {
             merge_fragments: true,
             color: ImageSettings::REDUCE,
             gray: ImageSettings::REDUCE,
-            mono: MonoCompression::CcittG4,
+            mono: MonoSettings::REDUCE,
             discard_thumbnails: true,
             discard_alternate_images: true,
             discard_tags: false,
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 9e82858776..e904088d24 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -5,7 +5,8 @@ use std::sync::Arc;
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, SaveOptions, Stream, write_full};
 use pdfcraft_filters::{Filter, Params};
 use pdfcraft_optimize::{
-    Compatibility, Compression, ImageSettings, MonoCompression, OptimizeError, Settings, SpaceCategory, audit_space, effective_resolutions, optimize,
+    Compatibility, Compression, ImageSettings, MonoCompression, MonoSettings, OptimizeError, Settings, SpaceCategory, audit_space,
+    effective_resolutions, optimize,
 };
 
 fn image(doc: &mut Document, w: u32, h: u32, n: usize, jpeg: bool, smask: Option<ObjRef>) -> ObjRef {
@@ -394,7 +395,7 @@ fn black_and_white_images_become_ccitt_group_4() {
     let untouched = [noise, rgb, wide, tiny, named].map(|r| raw(&doc, r));
 
     let mut kept = doc.clone();
-    let r = optimize(&mut kept, &Settings { mono: MonoCompression::Retain, ..Settings::default() }).unwrap();
+    let r = optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
     assert_eq!(r.images_recompressed, 0, "Retain keeps every image as it is");
     assert!([gray, mask, indexed, predicted].iter().all(|i| raw(&kept, *i) == raw(&doc, *i)));
 
@@ -456,7 +457,16 @@ fn group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit() {
     let past_limit = mono_image(&mut doc, 10_000, 8_001, &bilevel(10_000, 8_001, false), None, &grey);
     let all = [icc_1, icc_3, spot, two_spots, mask_1, mask_8, at_limit, past_limit];
     let names: Vec<String> = (0..all.len()).map(|i| format!("Im{i}")).collect();
-    let content: String = (0..all.len()).map(|i| format!("q 200 0 0 80 {} {} cm /Im{i} Do Q ", 6 + 200 * (i % 3), 690 - 100 * (i / 3))).collect();
+    // 200 × 80 pt is 432 ppi, 1800 × 1440 pt 400 ppi: below where monochrome downsampling starts.
+    let content: String = (0..all.len())
+        .map(|i| {
+            if i < 6 {
+                format!("q 200 0 0 80 {} {} cm /Im{i} Do Q ", 6 + 200 * (i % 3), 690 - 100 * (i / 3))
+            } else {
+                format!("q 1800 0 0 1440 0 0 cm /Im{i} Do Q ")
+            }
+        })
+        .collect();
     page(&mut doc, &names.iter().map(String::as_str).zip(all).collect::<Vec<_>>(), &content);
     let converted = [icc_1, spot, mask_1, at_limit];
     let left = [icc_3, two_spots, mask_8, past_limit];
@@ -614,6 +624,9 @@ fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
     assert_eq!(stream(&doc, packed).dict.int(b"BitsPerComponent"), Some(1), "8-bit black-and-white hex text in lines: packed");
 }
 
+/// Monochrome Images keeping each image's compression (and resampling as by default).
+const RETAIN: MonoSettings = MonoSettings { compression: MonoCompression::Retain, ..MonoSettings::REDUCE };
+
 /// Eight-bit samples (0 or 255) from rows of one-bit ones.
 fn eight_bit(bits: &[u8], w: u32, h: u32) -> Vec<u8> {
     let stride = (w as usize).div_ceil(8);
@@ -667,7 +680,7 @@ fn eight_bit_black_and_white_takes_the_smaller_of_one_bit_and_the_grey_settings(
         let (mut doc, img) = build();
         optimize(&mut doc, &Settings::default()).unwrap();
         let (mut retained, _) = build();
-        optimize(&mut retained, &Settings { mono: MonoCompression::Retain, ..Settings::default() }).unwrap();
+        optimize(&mut retained, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
         let (s, kept) = (stream(&doc, img), stream(&retained, img));
         let bits = if what == "dither" { 8 } else { 1 };
         assert_eq!(s.dict.int(b"BitsPerComponent"), Some(bits), "{what}: {} bytes, {} with Retain", s.raw.len(), kept.raw.len());
@@ -757,7 +770,7 @@ fn eight_bit_black_and_white_images_become_one_bit() {
     let settings = Settings { gray: keep, ..Settings::default() };
 
     let mut kept = doc.clone();
-    let r = optimize(&mut kept, &Settings { mono: MonoCompression::Retain, ..settings.clone() }).unwrap();
+    let r = optimize(&mut kept, &Settings { mono: RETAIN, ..settings.clone() }).unwrap();
     assert_eq!(r.images_recompressed, 0, "Retain keeps every image as it is");
 
     let untouched = [shade, indexed, keyed].map(|r| raw(&doc, r));
@@ -775,6 +788,141 @@ fn eight_bit_black_and_white_images_become_one_bit() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// Black-and-white images above 450 ppi are averaged down to 300 ppi, by default: 1-bit Flate, CCITT
+/// Group 4 (alone and behind ASCIIHexDecode), an image mask (its inverting decode array stays) and
+/// eight-bit grey of only black and white, all drawn at 600 ppi, are stored at half the size (as
+/// Group 4, or 1-bit Flate when that is smaller, as it is on this clean text), each new pixel the
+/// majority of the 2 × 2 it covers (a tie black). Left at their size: an image at 400 ppi (stored
+/// again as Group 4), a Group 4 one at 400 ppi (not even decoded), one behind ASCIIHexDecode at
+/// 400 ppi (stored again as Group 4 alone), and one with a soft mask. The page looks the same at
+/// screen size. With `downsample` off nothing is resampled; with Retain, Flate stays Flate, CCITT
+/// stays CCITT, and eight-bit grey is left to the grey settings.
+#[test]
+fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200u32, 480u32);
+    let text = bilevel(w, h, false);
+    let grey = [("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))];
+    let g4 = |doc: &mut Document, entries: &[(&str, Object)]| {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("CCITTFaxDecode")]));
+        let mut parms = Dict::new();
+        parms.set(b"K".to_vec(), Object::Int(-1));
+        parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+        d.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Dict(parms)]));
+        for (k, v) in entries {
+            d.set(k.as_bytes().to_vec(), v.clone());
+        }
+        doc.add(Object::Stream(Stream::from_raw(d, pdfcraft_filters::encode_g4(&text, w, h).unwrap())))
+    };
+    // Group 4 behind ASCIIHexDecode, its parameters second in the array.
+    let behind_hex = |doc: &mut Document| {
+        let r = g4(doc, &grey);
+        let s = stream(doc, r);
+        let mut d = s.dict.clone();
+        let parms = d.get(b"DecodeParms").and_then(Object::as_array).and_then(|a| a.first()).cloned().unwrap();
+        d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("ASCIIHexDecode"), Object::name("CCITTFaxDecode")]));
+        d.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Null, parms]));
+        let hex = s.raw.iter().map(|b| format!("{b:02x}")).chain([">".to_string()]).collect::<String>().into_bytes();
+        doc.set(r, Object::Stream(Stream::from_raw(d, hex)));
+        r
+    };
+    let flate = mono_image(&mut doc, w, h, &text, None, &grey);
+    let fax = g4(&mut doc, &grey);
+    let hex_fax = behind_hex(&mut doc);
+    let hex_at_400 = behind_hex(&mut doc);
+    let decode = Object::Array(vec![1.into(), 0.into()]);
+    let mask = mono_image(&mut doc, w, h, &text, None, &[("ImageMask", Object::Bool(true)), ("Decode", decode.clone())]);
+    let mut d = Dict::new();
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w.into()));
+    d.set(b"Height".to_vec(), Object::Int(h.into()));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    let eight = doc.add(Object::Stream(Stream::flate(d, &eight_bit(&text, w, h))));
+    let at_400 = mono_image(&mut doc, w, h, &text, None, &grey);
+    let fax_at_400 = g4(&mut doc, &grey);
+    let mut sm = Dict::new();
+    sm.set(b"Subtype".to_vec(), Object::name("Image"));
+    sm.set(b"Width".to_vec(), Object::Int(2));
+    sm.set(b"Height".to_vec(), Object::Int(1));
+    sm.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+    sm.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    let smask = doc.add(Object::Stream(Stream::flate(sm, &[255, 200])));
+    let soft = mono_image(&mut doc, w, h, &text, None, &[grey[0].clone(), grey[1].clone(), ("SMask", Object::Ref(smask))]);
+    // 144 × 57.6 pt is 2 × 0.8 in: 600 ppi. 216 × 86.4 pt is 400 ppi.
+    page(
+        &mut doc,
+        &[("A", flate), ("B", fax), ("C", mask), ("D", eight), ("E", at_400), ("F", fax_at_400), ("G", soft), ("H", hex_fax), ("I", hex_at_400)],
+        "q 144 0 0 57.6 20 700 cm /A Do Q q 144 0 0 57.6 200 700 cm /B Do Q q 0 0 1 rg 144 0 0 57.6 380 700 cm /C Do Q \
+         q 144 0 0 57.6 20 600 cm /D Do Q q 216 0 0 86.4 200 580 cm /E Do Q q 216 0 0 86.4 20 480 cm /F Do Q \
+         q 144 0 0 57.6 260 480 cm /G Do Q q 144 0 0 57.6 430 600 cm /H Do Q q 216 0 0 86.4 20 360 cm /I Do Q",
+    );
+    let before = render(&doc);
+    let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
+    let size = |doc: &Document, r: ObjRef| {
+        let d = stream(doc, r).dict;
+        (d.int(b"Width").unwrap(), d.int(b"Height").unwrap())
+    };
+    // Each new pixel: 1 when more than two of the 2 × 2 it covers are.
+    let stride = (w as usize).div_ceil(8);
+    let bit = |x: usize, y: usize| text[y * stride + x / 8] & (0x80 >> (x % 8)) != 0;
+    let mut halved = vec![0u8; (w as usize / 2).div_ceil(8) * h as usize / 2];
+    for y in 0..h as usize / 2 {
+        for x in 0..w as usize / 2 {
+            let ones = [(0, 0), (1, 0), (0, 1), (1, 1)].iter().filter(|(dx, dy)| bit(2 * x + dx, 2 * y + dy)).count();
+            if ones > 2 {
+                halved[y * (w as usize / 2).div_ceil(8) + x / 8] |= 0x80 >> (x % 8);
+            }
+        }
+    }
+
+    // The grey settings left alone too: an eight-bit image would otherwise take them when smaller.
+    let mut off = doc.clone();
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    let mono = MonoSettings { downsample: false, ..MonoSettings::REDUCE };
+    let r = optimize(&mut off, &Settings { mono, gray: keep, ..Settings::default() }).unwrap();
+    assert_eq!(r.images_resampled, 0, "{r:?}");
+    assert!([flate, fax, mask, eight, hex_fax].iter().all(|i| size(&off, *i) == (1200, 480)));
+
+    let mut kept = doc.clone();
+    let r = optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
+    assert_eq!(r.images_resampled, 5, "{r:?}");
+    assert_eq!(stream(&kept, flate).dict.name(b"Filter"), Some(&b"FlateDecode"[..]), "Retain: Flate stays Flate");
+    for i in [fax, hex_fax] {
+        assert_eq!(stream(&kept, i).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "and CCITT stays CCITT: {i:?}");
+    }
+    assert_eq!(raw(&kept, hex_at_400), raw(&doc, hex_at_400), "and nothing else changes");
+    for i in [flate, fax, hex_fax] {
+        assert_eq!((size(&kept, i), kept.decoded_image(&stream(&kept, i)).unwrap()), ((600, 240), halved.clone()), "{i:?}");
+    }
+    assert_eq!(stream(&kept, eight).dict.int(b"BitsPerComponent"), Some(8), "Retain leaves eight bits to the grey settings");
+
+    let untouched = [fax_at_400].map(|r| raw(&doc, r));
+    let hex_len = raw(&doc, hex_at_400).len();
+    let r = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!((r.images_resampled, r.images_recompressed), (5, 3), "{r:?}");
+    for i in [flate, fax, mask, eight, hex_fax] {
+        let s = stream(&doc, i);
+        assert_eq!((size(&doc, i), s.dict.int(b"BitsPerComponent")), ((600, 240), if i == mask { None } else { Some(1) }));
+        assert!(matches!(s.dict.name(b"Filter"), Some(b"CCITTFaxDecode" | b"FlateDecode")), "{i:?}");
+        assert_eq!(doc.decoded_image(&s).unwrap(), halved, "{i:?}");
+    }
+    assert_eq!(stream(&doc, mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");
+    for i in [at_400, soft, hex_at_400] {
+        assert_eq!((size(&doc, i), stream(&doc, i).dict.name(b"Filter")), ((1200, 480), Some(&b"CCITTFaxDecode"[..])), "{i:?}");
+    }
+    assert!(raw(&doc, hex_at_400).len() < hex_len, "the ASCIIHexDecode is dropped");
+    assert_eq!(doc.decoded_image(&stream(&doc, hex_at_400)).unwrap(), text, "and the picture kept");
+    assert_eq!([fax_at_400].map(|r| raw(&doc, r)), untouched);
+    let after = render(&doc);
+    let differ = before.iter().zip(&after).filter(|(a, b)| a.abs_diff(**b) > 64).count();
+    assert!(differ * 200 < before.len(), "{differ} of {} channel values differ visibly", before.len());
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();
diff --git a/crates/ui-egui/src/workflows/optimize_ui.rs b/crates/ui-egui/src/workflows/optimize_ui.rs
index d3a5cfd4a1..d937592aba 100644
--- a/crates/ui-egui/src/workflows/optimize_ui.rs
+++ b/crates/ui-egui/src/workflows/optimize_ui.rs
@@ -8,7 +8,7 @@
 use std::sync::{Arc, Mutex};
 
 use egui::{Align, Layout, RichText};
-use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, MonoCompression, Preset, QUALITIES, Settings};
+use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, MonoCompression, MonoSettings, Preset, QUALITIES, Settings};
 use pdfcraft_engine::optimizer::{OptimizeStage, Optimized};
 use pdfcraft_engine::{DocId, EditError, Hidden, OptimizeReport};
 
@@ -143,18 +143,25 @@ fn image_row(ui: &mut egui::Ui, id: &str, title: &str, s: &mut ImageSettings) {
     ui.add_space(8.0);
 }
 
-/// Monochrome Images: how 1-bit images and image masks are stored.
-fn mono_row(ui: &mut egui::Ui, m: &mut MonoCompression) {
+/// Monochrome Images: how black-and-white images and image masks are resampled and stored.
+fn mono_row(ui: &mut egui::Ui, m: &mut MonoSettings) {
     ui.label(egui::RichText::new(tl!("Monochrome Images")).font(theme::semibold(13.0)));
+    ui.horizontal(|ui| {
+        ui.add(widgets::checkbox(&mut m.downsample, tl!("Downsample to")));
+        ui.add_enabled(m.downsample, egui::DragValue::new(&mut m.target_ppi).range(9.0..=2400.0).suffix(" ppi"));
+        ui.label(tl!("for images above"));
+        ui.add_enabled(m.downsample, egui::DragValue::new(&mut m.above_ppi).range(9.0..=2400.0).suffix(" ppi"));
+    });
+    m.above_ppi = m.above_ppi.max(m.target_ppi);
     ui.horizontal(|ui| {
         ui.label(tl!("Compression"));
-        let label = match m {
+        let label = match m.compression {
             MonoCompression::CcittG4 => tl!("CCITT Group 4"),
             MonoCompression::Retain => tl!("Retain existing"),
         };
         craft_ui::ComboBox::from_id_salt(("mono", "compression")).selected_text(label).show_ui(ui, |ui| {
-            ui.selectable_value(m, MonoCompression::CcittG4, tl!("CCITT Group 4"));
-            ui.selectable_value(m, MonoCompression::Retain, tl!("Retain existing"));
+            ui.selectable_value(&mut m.compression, MonoCompression::CcittG4, tl!("CCITT Group 4"));
+            ui.selectable_value(&mut m.compression, MonoCompression::Retain, tl!("Retain existing"));
         });
     });
     ui.add_space(8.0);
diff --git a/crates/ui-egui/tests/it/create.rs b/crates/ui-egui/tests/it/create.rs
index 22ac8503e7..1c9a757651 100644
--- a/crates/ui-egui/tests/it/create.rs
+++ b/crates/ui-egui/tests/it/create.rs
@@ -188,7 +188,11 @@ fn the_pdf_optimizer_dialog_saves_an_optimized_copy() {
     h.get_by_label("PDF Optimizer");
     h.get_by_label("Color Images");
     h.get_by_label("Monochrome Images");
-    assert_eq!(h.state().optimize_draft.settings.mono, pdfcraft_engine::optimize::MonoCompression::CcittG4);
+    assert_eq!(h.state().optimize_draft.settings.mono, pdfcraft_engine::optimize::MonoSettings::REDUCE);
+    // Monochrome Images ▸ Downsample to can be turned off.
+    h.get_by_label("Downsample to").click();
+    h.run_steps(2);
+    assert!(!h.state().optimize_draft.settings.mono.downsample);
     h.get_by_label("Discard Objects").click();
     h.run_steps(2);
     h.get_by_label("Discard document tags").click();
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index dba04f6c4c..6ed9eba7c1 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,6 +1,6 @@
 # PDF specification and standards parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: CCITT Group 4 encoding in the Optimizer; earlier, §14.3: custom properties edited in Document Properties) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: CCITT decoding in `pdfcraft-filters`; earlier, §7.4: CCITT Group 4 encoding in the Optimizer) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -21,7 +21,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 |---|---|---|---|---|
 | §7.2–7.5 | Syntax, objects, file structure, xref tables and streams, object streams, hybrid files, incremental updates | full | **own**, tolerant, repairs damaged files | `crates/cos`; corpus 958 files; fuzzed nightly |
 | §7.4 | Stream filters: Flate, LZW, ASCII85, ASCIIHex, RunLength, predictors | full | **own** | `crates/filters` |
-| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; the Optimizer encodes CCITT Group 4 (`pdfcraft_filters::encode_g4`, `optimize.mono-compression`); no JBIG2 encoding |
+| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; CCITT decoding in `pdfcraft-filters` (`decode_ccitt`, through `hayro-ccitt`) for export and the Optimizer, which encodes Group 4 (`optimize.mono-compression`); no JBIG2 encoding |
 | §7.5.8 | Linearization | R W | R only | `core.linearization` planned |
 | §7.6.4 | Standard security handler R2–R6 (RC4 40/128, AES-128, AES-256), crypt filters, `/EncryptMetadata`, SASLprep | full | **own**, read and write | `crates/crypt`; written files open in Acrobat DC since #836 (#774: Acrobat needs the catalog outside object streams) |
 | §7.6.5 | Public-key security handler | full | none | `core.open-public-key`, `protect.certificate-encryption` planned |
@@ -130,6 +130,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | §7.4: CCITT decoding (`hayro-ccitt`) in `pdfcraft-filters`, for export and the Optimizer |
 | 2026-10-26 | minor | §7.4: CCITT Group 4 encoding (`fax`) in the Optimizer |
 | 2026-10-14 | minor | §12.4.4: `/Trans` and `/Dur` read into `DocInfo::transitions` and reported by `doc_info` |
 | 2026-10-11 | minor | §7.6.4: encrypted files we write open in Acrobat (#774, fixed by #836) |
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 3e4c971b2f..6d12e87564 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,7 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
-> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white pictures stay one bit when PDFs are created and optimized; CCITT images export; estimates unchanged)
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white images above 450 ppi are averaged down to 300 ppi by the optimizer; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
@@ -257,6 +257,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-24 | minor | M11: monochrome downsampling: the PDF Optimizer and Reduce File Size average black-and-white images (1-bit, CCITT fax, eight-bit black-and-white grey) above 450 ppi down to 300 ppi, by area with ties black, as Monochrome Images ▸ Downsample to and `doc_optimize` `mono: { downsample, ppi, above_ppi }`; CCITT decoding moves into `pdfcraft-filters` (`decode_ccitt`) behind `Document::decoded_image`. Estimates unchanged. |
 | 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller, as they can a dithered scan, soft mask counted; Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 376131a974..9a8597e520 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -130,8 +130,8 @@ milestone = "M1"
 status = "partial"
 commands = []
 tools = []
-evidence = []
-notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2"
+evidence = ["crates/filters/src/ccitt.rs::decoding_gives_the_rows_back", "crates/cos/src/document/tests.rs::fax_images_decode_with_their_parameters"]
+notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images and the optimizer"
 
 [[feature]]
 id = "core.decompression-limits"
@@ -7360,8 +7360,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
-evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome not yet"
+evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::black_and_white_images_above_450_ppi_are_averaged_down_to_300", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie black, then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]
 id = "optimize.recompress-images"
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), Group 3 to Group 4 without resampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 151ca1d6ad4d8f1d7fb569585badef02335ff6b5 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 11:45:33 +0200
Subject: [PATCH 181/270] M11: monochrome downsampling: a tie goes to the dark
 sample, after the decode array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A 2 × 2 tie always gave sample 0, black in grey and the painted part of
an image mask with the default decode array. With an inverting one,
[1 0], 0 is white or unpainted, and in a separation 0 is no ink, so a
line half a new pixel wide could vanish. dark_is_one says which sample
is dark from the colour space and decode array: 0 in grey and of a
mask, 1 in a separation or a DeviceN of one colourant, each the other
way round when the decode array inverts; an indexed image keeps entry
0, as its palette, not the decode array, says which is darker.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/optimize/README.md         |   6 +-
 crates/optimize/src/images.rs     | 118 +++++++++++++++++++++++-------
 crates/optimize/tests/optimize.rs |  26 ++++---
 parity/acrobat-features.toml      |   2 +-
 4 files changed, 112 insertions(+), 40 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index ba71eb38f5..a76fb54c04 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -43,8 +43,10 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   (resampled with it there, kept as it is here), as they can a dithered scan by downsampling it to
   JPEG.
   - **Downsampling:** one whose effective resolution is above `above_ppi` is averaged down to
-    `target_ppi`: each new pixel takes the sample covering more of its area, a 0 (black in grey)
-    on a tie, so a dark line half a new pixel wide stays. Not one with a soft mask, whose own size
+    `target_ppi`: each new pixel takes the sample covering more of its area, and the dark one on a
+    tie, so a dark line half a new pixel wide stays: black in grey and the painted part of an image
+    mask (a 0, or a 1 with an inverting decode array), full ink in a separation (a 1, or a 0), and
+    entry 0 of an indexed image, whose palette says which is darker. Not one with a soft mask, whose own size
     would have to follow. On a 600 ppi text page, Group 4 at 300 ppi is half the size.
   - **Compression:** CCITT Group 4 (`pdfcraft_filters::encode_g4`), or 1-bit Flate when that is
     smaller, which only a resampled image or one packed from eight bits may be: a 1-bit image that
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index f6fd5e5770..dc78b109ac 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -621,11 +621,34 @@ fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32,
     Some((packed, w, h, true))
 }
 
+/// Whether sample 1 is the dark one of the 1-bit image `d` describes, after its decode array
+/// (`[0 1]` when it has none of two numbers): the painted part of an image mask and black in grey
+/// decode to 0, and full ink in a separation (or a DeviceN of one colourant) to 1. An indexed image
+/// says 0, as its palette, not its decode array, says which entry is darker.
+fn dark_is_one(doc: &Document, d: &Dict) -> bool {
+    let number = |v: Option<&Object>| v.and_then(|v| doc.resolve(v).as_f64());
+    let (d0, d1) = match d.get(b"Decode").map(|v| doc.resolve(v)).as_deref() {
+        Some(Object::Array(a)) => number(a.first()).zip(number(a.get(1))).unwrap_or((0.0, 1.0)),
+        _ => (0.0, 1.0),
+    };
+    if matches!(d.get(b"ImageMask"), Some(Object::Bool(true))) {
+        return d1 < d0;
+    }
+    match d.get(b"ColorSpace").map(|cs| doc.resolve(cs)).as_deref() {
+        Some(Object::Array(a)) => match a.first().and_then(Object::as_name) {
+            Some(b"Indexed" | b"I") => false,
+            Some(b"Separation" | b"DeviceN") => d1 > d0,
+            _ => d1 < d0,
+        },
+        _ => d1 < d0,
+    }
+}
+
 /// `w` × `h` 1-bit rows (each starting on a new byte) averaged down to `nw` × `nh`, no larger:
-/// each new pixel takes the sample that covers more of its area, and a 0 when the two tie. A 0 is
-/// black in grey and the painted part of an image mask, so a dark line half a new pixel wide stays.
-/// `None` when the rows are short or the new size isn't smaller in both directions or empty.
-pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32) -> Option<Vec<u8>> {
+/// each new pixel takes the sample that covers more of its area, and the dark one when the two tie
+/// (1 if `dark_is_one`, see [`dark_is_one`]), so a dark line half a new pixel wide stays. `None`
+/// when the rows are short or the new size isn't smaller in both directions or empty.
+pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dark_is_one: bool) -> Option<Vec<u8>> {
     if nw == 0 || nh == 0 || nw > w || nh > h {
         return None;
     }
@@ -656,8 +679,10 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32) ->
             let covered: u64 = (x0 / nw..x1.div_ceil(nw).min(w))
                 .map(|x| overlap(x0, x1, x * nw, (x + 1) * nw) * usize::try_from(x).ok().and_then(|x| ones.get(x)).copied().unwrap_or(0))
                 .sum();
-            // More than half of w·h, which can't overflow (w·h < 2^64 for u32 sizes).
-            if covered > w * h / 2 {
+            // Against what the 0 samples cover: covered is at most w·h, which can't overflow
+            // (w·h < 2^64 for u32 sizes).
+            let zeros = w * h - covered;
+            if covered > zeros || (dark_is_one && covered == zeros) {
                 let i = usize::try_from(i).ok()?;
                 *out_row.get_mut(i / 8)? |= 0x80 >> (i % 8);
             }
@@ -700,7 +725,7 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     if (retain || fax_alone) && !resampled {
         return None;
     }
-    let data = if resampled { downsample_bits(&data, w, h, nw, nh)? } else { data };
+    let data = if resampled { downsample_bits(&data, w, h, nw, nh, dark_is_one(doc, d))? } else { data };
     let mut dict = d.clone();
     for key in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
         dict.remove(key);
@@ -874,10 +899,11 @@ mod tests {
 
 #[cfg(test)]
 mod downsample_tests {
-    use super::downsample_bits;
+    use super::{dark_is_one, downsample_bits};
+    use pdfcraft_cos::{Dict, Document, Object};
 
     /// [`downsample_bits`] the slow way: each new pixel's area against every source pixel's.
-    fn naive(data: &[u8], w: u32, h: u32, nw: u32, nh: u32) -> Vec<u8> {
+    fn naive(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dark_one: bool) -> Vec<u8> {
         let (stride, nstride) = ((w as usize).div_ceil(8), (nw as usize).div_ceil(8));
         let (w, h, nw, nh) = (u64::from(w), u64::from(h), u64::from(nw), u64::from(nh));
         let mut out = vec![0u8; nstride * nh as usize];
@@ -893,7 +919,7 @@ mod downsample_tests {
                         }
                     }
                 }
-                if 2 * ones > w * h {
+                if 2 * ones > w * h || (dark_one && 2 * ones == w * h) {
                     out[j as usize * nstride + i as usize / 8] |= 0x80 >> (i % 8);
                 }
             }
@@ -904,28 +930,65 @@ mod downsample_tests {
     #[test]
     fn each_new_pixel_takes_the_sample_covering_more_of_it() {
         // 4 × 2 to 2 × 1: three 1s of four on the left, none on the right.
-        assert_eq!(downsample_bits(&[0b1100_0000, 0b1000_0000], 4, 2, 2, 1), Some(vec![0b1000_0000]));
-        // A tie gives 0: black in grey, so a black line half a new pixel wide stays (the second
-        // of four white columns is black); a white one that thin on black doesn't.
-        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1), Some(vec![0b0100_0000]));
-        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1), Some(vec![0]));
+        assert_eq!(downsample_bits(&[0b1100_0000, 0b1000_0000], 4, 2, 2, 1, false), Some(vec![0b1000_0000]));
+        // A tie gives the dark sample: 0, black in grey, so a black line half a new pixel wide
+        // stays (the second of four white columns is black); a white one that thin on black doesn't.
+        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1, false), Some(vec![0b0100_0000]));
+        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1, false), Some(vec![0]));
+        // With 1 the dark sample (an inverting decode array, a separation), that line is a 1.
+        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1, true), Some(vec![0b1000_0000]));
+        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1, true), Some(vec![0b1100_0000]));
         // The same size gives the same bits; padding bits are 0.
-        assert_eq!(downsample_bits(&[0b1010_1111], 3, 1, 3, 1), Some(vec![0b1010_0000]));
+        assert_eq!(downsample_bits(&[0b1010_1111], 3, 1, 3, 1, false), Some(vec![0b1010_0000]));
         // 3 to 2 across: the middle column counts half to each new one.
-        assert_eq!(downsample_bits(&[0b1100_0000], 3, 1, 2, 1), Some(vec![0b1000_0000]));
+        assert_eq!(downsample_bits(&[0b1100_0000], 3, 1, 2, 1, false), Some(vec![0b1000_0000]));
+    }
+
+    /// The dark sample: 0 in grey and of an image mask, 1 in a separation, each the other way round
+    /// with an inverting decode array; 0 for an indexed image, whatever its decode array.
+    #[test]
+    fn the_dark_sample_follows_the_colour_space_and_decode_array() {
+        let doc = Document::new_empty();
+        let image = |entries: &[(&str, Object)]| {
+            let mut d = Dict::new();
+            for (k, v) in entries {
+                d.set(k.as_bytes().to_vec(), v.clone());
+            }
+            d
+        };
+        let inverted = ("Decode", Object::Array(vec![1.into(), 0.into()]));
+        let grey = ("ColorSpace", Object::name("DeviceGray"));
+        let mask = ("ImageMask", Object::Bool(true));
+        let separation =
+            ("ColorSpace", Object::Array(vec![Object::name("Separation"), Object::name("Spot"), Object::name("DeviceCMYK"), Object::Null]));
+        let indexed = ("ColorSpace", Object::Array(vec![Object::name("Indexed"), Object::name("DeviceGray"), 1.into(), Object::Null]));
+        for (entries, dark_one) in [
+            (vec![grey.clone()], false),
+            (vec![grey, inverted.clone()], true),
+            (vec![mask.clone()], false),
+            (vec![mask, inverted.clone()], true),
+            (vec![separation.clone()], true),
+            (vec![separation, inverted.clone()], false),
+            (vec![indexed.clone()], false),
+            (vec![indexed, inverted], false),
+            (vec![("ColorSpace", Object::name("DeviceGray")), ("Decode", Object::Array(vec![Object::name("x"), 0.into()]))], false),
+        ] {
+            assert_eq!(dark_is_one(&doc, &image(&entries)), dark_one, "{entries:?}");
+        }
     }
 
     #[test]
     fn what_it_cannot_resample_is_none() {
-        assert_eq!(downsample_bits(&[0; 2], 4, 2, 5, 1), None, "wider");
-        assert_eq!(downsample_bits(&[0; 2], 4, 2, 2, 3), None, "taller");
-        assert_eq!(downsample_bits(&[0; 2], 4, 2, 0, 1), None);
-        assert_eq!(downsample_bits(&[0; 1], 4, 2, 2, 1), None, "short rows");
-        assert_eq!(downsample_bits(&[], u32::MAX, u32::MAX, 1, 1), None);
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 5, 1, false), None, "wider");
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 2, 3, false), None, "taller");
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 0, 1, false), None);
+        assert_eq!(downsample_bits(&[0; 1], 4, 2, 2, 1, false), None, "short rows");
+        assert_eq!(downsample_bits(&[], u32::MAX, u32::MAX, 1, 1, true), None);
     }
 
     proptest::proptest! {
-        /// Any bitmap, to any size no larger, gives what the slow way gives; all 1s stay all 1s.
+        /// Any bitmap, to any size no larger, with either sample the dark one, gives what the slow
+        /// way gives; all 1s stay all 1s.
         #[test]
         fn it_matches_the_slow_way(
             w in 1u32..40,
@@ -933,14 +996,15 @@ mod downsample_tests {
             nw_part in 0.0f64..1.0,
             nh_part in 0.0f64..1.0,
             seed in proptest::collection::vec(0u8..=255, 1..64),
+            dark_one: bool,
         ) {
             let (nw, nh) = (1 + (f64::from(w - 1) * nw_part) as u32, 1 + (f64::from(h - 1) * nh_part) as u32);
             let len = (w as usize).div_ceil(8) * h as usize;
             let data: Vec<u8> = seed.iter().cycle().take(len).copied().collect();
-            proptest::prop_assert_eq!(downsample_bits(&data, w, h, nw, nh), Some(naive(&data, w, h, nw, nh)));
-            let white = downsample_bits(&vec![0xFF; len], w, h, nw, nh).unwrap();
-            proptest::prop_assert_eq!(white, naive(&vec![0xFF; len], w, h, nw, nh));
-            proptest::prop_assert!(naive(&vec![0xFF; len], w, h, nw, nh).iter().any(|b| *b != 0));
+            proptest::prop_assert_eq!(downsample_bits(&data, w, h, nw, nh, dark_one), Some(naive(&data, w, h, nw, nh, dark_one)));
+            let white = downsample_bits(&vec![0xFF; len], w, h, nw, nh, dark_one).unwrap();
+            proptest::prop_assert_eq!(white, naive(&vec![0xFF; len], w, h, nw, nh, dark_one));
+            proptest::prop_assert!(naive(&vec![0xFF; len], w, h, nw, nh, dark_one).iter().any(|b| *b != 0));
         }
     }
 }
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index e904088d24..ea2961513b 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -792,7 +792,7 @@ fn eight_bit_black_and_white_images_become_one_bit() {
 /// Group 4 (alone and behind ASCIIHexDecode), an image mask (its inverting decode array stays) and
 /// eight-bit grey of only black and white, all drawn at 600 ppi, are stored at half the size (as
 /// Group 4, or 1-bit Flate when that is smaller, as it is on this clean text), each new pixel the
-/// majority of the 2 × 2 it covers (a tie black). Left at their size: an image at 400 ppi (stored
+/// majority of the 2 × 2 it covers (a tie black, or for the mask painted). Left at their size: an image at 400 ppi (stored
 /// again as Group 4), a Group 4 one at 400 ppi (not even decoded), one behind ASCIIHexDecode at
 /// 400 ppi (stored again as Group 4 alone), and one with a soft mask. The page looks the same at
 /// screen size. With `downsample` off nothing is resampled; with Retain, Flate stays Flate, CCITT
@@ -867,18 +867,24 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
         let d = stream(doc, r).dict;
         (d.int(b"Width").unwrap(), d.int(b"Height").unwrap())
     };
-    // Each new pixel: 1 when more than two of the 2 × 2 it covers are.
+    // Each new pixel: 1 when more than two of the 2 × 2 it covers are, or two when 1 is the dark
+    // sample (the mask's decode array inverts it, so its painted part is 1).
     let stride = (w as usize).div_ceil(8);
     let bit = |x: usize, y: usize| text[y * stride + x / 8] & (0x80 >> (x % 8)) != 0;
-    let mut halved = vec![0u8; (w as usize / 2).div_ceil(8) * h as usize / 2];
-    for y in 0..h as usize / 2 {
-        for x in 0..w as usize / 2 {
-            let ones = [(0, 0), (1, 0), (0, 1), (1, 1)].iter().filter(|(dx, dy)| bit(2 * x + dx, 2 * y + dy)).count();
-            if ones > 2 {
-                halved[y * (w as usize / 2).div_ceil(8) + x / 8] |= 0x80 >> (x % 8);
+    let halve = |dark_one: bool| {
+        let mut out = vec![0u8; (w as usize / 2).div_ceil(8) * h as usize / 2];
+        for y in 0..h as usize / 2 {
+            for x in 0..w as usize / 2 {
+                let ones = [(0, 0), (1, 0), (0, 1), (1, 1)].iter().filter(|(dx, dy)| bit(2 * x + dx, 2 * y + dy)).count();
+                if ones > 2 || (dark_one && ones == 2) {
+                    out[y * (w as usize / 2).div_ceil(8) + x / 8] |= 0x80 >> (x % 8);
+                }
             }
         }
-    }
+        out
+    };
+    let (halved, halved_mask) = (halve(false), halve(true));
+    assert_ne!(halved, halved_mask, "the picture has ties");
 
     // The grey settings left alone too: an eight-bit image would otherwise take them when smaller.
     let mut off = doc.clone();
@@ -909,7 +915,7 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
         let s = stream(&doc, i);
         assert_eq!((size(&doc, i), s.dict.int(b"BitsPerComponent")), ((600, 240), if i == mask { None } else { Some(1) }));
         assert!(matches!(s.dict.name(b"Filter"), Some(b"CCITTFaxDecode" | b"FlateDecode")), "{i:?}");
-        assert_eq!(doc.decoded_image(&s).unwrap(), halved, "{i:?}");
+        assert_eq!(doc.decoded_image(&s).unwrap(), if i == mask { halved_mask.clone() } else { halved.clone() }, "{i:?}");
     }
     assert_eq!(stream(&doc, mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");
     for i in [at_400, soft, hex_at_400] {
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 9a8597e520..41266cb293 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7361,7 +7361,7 @@ status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
 evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::black_and_white_images_above_450_ppi_are_averaged_down_to_300", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie black, then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]
 id = "optimize.recompress-images"

From ba1a741471ca00bcad1e0e064feb4755ec536330 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 10:20:23 +0100
Subject: [PATCH 182/270] M11: a fax image's /DecodeParms entry is its own when
 a /Crypt follows it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

decoded_image paired the fax filter with the last /DecodeParms entry,
but Stream::filters leaves /Crypt out wherever it stands, so with
[/CCITTFaxDecode /Crypt] the fax filter got the Crypt entry and lost
its /K, /Columns and /BlackIs1. Its entry is now that of the last
filter but a /Crypt. /Crypt belongs first (ISO 32000-2 §7.4.10), so
only a malformed file had it (from CodeRabbit's review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/cos/src/document/objects.rs | 5 +++--
 crates/cos/src/document/tests.rs   | 2 ++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index bcbf8bbf41..06d488d7c2 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -236,9 +236,10 @@ impl Document {
         let s = &*self.with_direct_parms(s);
         let chain = s.readable_filters().map_err(|e| CosError::Filter(e.to_string()))?;
         let Some(((pdfcraft_filters::Filter::CcittFax, _), before)) = chain.split_last() else { return s.decoded() };
-        // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1).
+        // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1): the
+        // last filter but a /Crypt, which `filters` leaves out wherever it stands.
         let index = match s.dict.get(b"Filter") {
-            Some(Object::Array(a)) => a.len().saturating_sub(1),
+            Some(Object::Array(a)) => a.iter().rposition(|f| f.as_name() != Some(b"Crypt".as_slice())).unwrap_or(0),
             _ => 0,
         };
         let parms = match s.dict.get(b"DecodeParms").map(|p| self.resolve(p)).as_deref() {
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index 49baeccec8..aeb5184729 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -151,6 +151,8 @@ fn fax_images_decode_with_their_parameters() {
         "behind Flate"
     );
     assert_eq!(behind(&[Object::name("Crypt"), fax.clone()], &[null.clone(), own.clone()], coded.clone()).unwrap(), bits, "after /Crypt");
+    // A /Crypt belongs first (§7.4.10); one after the fax filter leaves it its own entry.
+    assert_eq!(behind(&[fax.clone(), Object::name("Crypt")], &[own.clone(), null.clone()], coded.clone()).unwrap(), bits, "before /Crypt");
     assert!(behind(&ahx, &[own.clone(), null.clone()], hex).is_err(), "the first entry is the other filter's");
     assert!(behind(&[fax.clone(), Object::name("FlateDecode")], &[own.clone(), null.clone()], flated).is_err(), "CCITT, then Flate");
     assert!(behind(&[Object::Int(5), fax], &[null, own], coded.clone()).is_err(), "a /Filter entry that isn't a name");

From 9fca1d44f0f164e9795aed5cd44079dd0113c76b Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 10:20:23 +0100
Subject: [PATCH 183/270] M11: monochrome downsampling: say an indexed image's
 tie goes to entry 0, its palette unread

The README said an indexed image's palette decides which entry is the
dark one on a tie, but dark_is_one never reads the palette: entry 0
wins whatever its colour. The README, the function's comment and the
parity note now say so (from FredApps' review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/optimize/README.md     | 5 +++--
 crates/optimize/src/images.rs | 3 ++-
 parity/acrobat-features.toml  | 2 +-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index a76fb54c04..ae6c749ef3 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -46,8 +46,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
     `target_ppi`: each new pixel takes the sample covering more of its area, and the dark one on a
     tie, so a dark line half a new pixel wide stays: black in grey and the painted part of an image
     mask (a 0, or a 1 with an inverting decode array), full ink in a separation (a 1, or a 0), and
-    entry 0 of an indexed image, whose palette says which is darker. Not one with a soft mask, whose own size
-    would have to follow. On a 600 ppi text page, Group 4 at 300 ppi is half the size.
+    entry 0 of an indexed image, whatever colour its palette gives it (the palette isn't read yet).
+    Not one with a soft mask, whose own size would have to follow. On a 600 ppi text page, Group 4
+    at 300 ppi is half the size.
   - **Compression:** CCITT Group 4 (`pdfcraft_filters::encode_g4`), or 1-bit Flate when that is
     smaller, which only a resampled image or one packed from eight bits may be: a 1-bit image that
     is only stored again becomes Group 4 or stays. A CCITT image is only decoded to be resampled,
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index dc78b109ac..4c20c1b3e7 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -624,7 +624,8 @@ fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32,
 /// Whether sample 1 is the dark one of the 1-bit image `d` describes, after its decode array
 /// (`[0 1]` when it has none of two numbers): the painted part of an image mask and black in grey
 /// decode to 0, and full ink in a separation (or a DeviceN of one colourant) to 1. An indexed image
-/// says 0, as its palette, not its decode array, says which entry is darker.
+/// says 0: its palette, not its decode array, says which entry is darker, and the palette isn't
+/// read yet, so a tie goes to entry 0 whatever its colour.
 fn dark_is_one(doc: &Document, d: &Dict) -> bool {
     let number = |v: Option<&Object>| v.and_then(|v| doc.resolve(v).as_f64());
     let (d0, d1) = match d.get(b"Decode").map(|v| doc.resolve(v)).as_deref() {
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 41266cb293..d2ef8f4f75 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7361,7 +7361,7 @@ status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
 evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::black_and_white_images_above_450_ppi_are_averaged_down_to_300", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]
 id = "optimize.recompress-images"

From 6a99d26c7d641228c2628c8d2457db551532d534 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 13:59:36 +0100
Subject: [PATCH 184/270] M11: redaction reads /DecodeParms given by reference
 before clearing pixels

Stream::decoded_within reads /DecodeParms only when it is direct, so an
image whose PNG predictor was given by reference decoded with its row
tags still in the data. The cleared bytes then drifted one byte further
from the covered pixels each row, and the covered samples survived in
the redacted copy, recoverable by applying the predictor. Parameters
are now made direct first (Document::with_direct_parms).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                 |  1 +
 crates/redact/Cargo.toml   |  1 +
 crates/redact/src/image.rs |  3 +++
 crates/redact/src/tests.rs | 26 ++++++++++++++++++++++++++
 4 files changed, 31 insertions(+)

diff --git a/Cargo.lock b/Cargo.lock
index f9280eff06..c6ee963a34 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4572,6 +4572,7 @@ dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
  "pdfcraft-edit",
+ "pdfcraft-filters",
  "pdfcraft-fonts",
  "pdfcraft-forms",
  "pdfcraft-model",
diff --git a/crates/redact/Cargo.toml b/crates/redact/Cargo.toml
index 49593855e2..8d1515d8a4 100644
--- a/crates/redact/Cargo.toml
+++ b/crates/redact/Cargo.toml
@@ -20,4 +20,5 @@ pdfcraft-xfa = { workspace = true }
 thiserror = { workspace = true }
 
 [dev-dependencies]
+pdfcraft-filters = { workspace = true }
 pdfcraft-testkit = { workspace = true }
diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index 601700f257..4e26fbd1fc 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -45,6 +45,9 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     if s.dict.contains(b"SMask") || s.dict.contains(b"Mask") {
         return None;
     }
+    // `Stream::decoded*` reads `/DecodeParms` only when it is direct: a predictor given by
+    // reference would be skipped, and the cleared bytes would then miss the covered pixels.
+    let s = &*doc.with_direct_parms(s);
     let supported = |n: &[u8]| {
         matches!(
             n,
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index c072d19db7..6db9cec8c7 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -549,6 +549,32 @@ fn redaction_clears_pixels_intersected_without_covering_their_centres() {
     }
 }
 
+/// An image whose PNG predictor is given by reference has its covered pixel cleared, and only
+/// that one: `Stream::decoded` reads only a direct `/DecodeParms`, so the row tags stayed in the
+/// data, the cleared byte drifted off the covered pixel and the covered sample survived.
+#[test]
+fn an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared() {
+    // Two rows of four grey samples, each behind a PNG "None" row tag.
+    let predicted = pdfcraft_filters::encode_flate(&[0, 10, 20, 30, 40, 0, 50, 60, 70, 80]);
+    let mut doc = one_page(
+        b"q 40 0 0 20 0 0 cm /Im Do Q",
+        "/XObject << /Im 7 0 R >>",
+        vec![
+            stream(
+                "/Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /FlateDecode /DecodeParms 8 0 R",
+                predicted,
+            ),
+            b"<< /Predictor 15 /Colors 1 /BitsPerComponent 8 /Columns 4 >>".to_vec(),
+        ],
+    );
+    // The top row's second sample.
+    mark(&mut doc, 0, &[[12.0, 12.0, 18.0, 18.0]], "");
+    let report = apply(&mut doc, None).unwrap();
+    assert_eq!(report.images_cleared, 1);
+    let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+    assert_eq!(named_image(&saved, 0, b"PCRedacted1"), Some(vec![10, 0, 30, 40, 50, 60, 70, 80]));
+}
+
 /// Apply Redactions gives the page its own pruned /Resources, but the dictionary it drew through
 /// before (inherited from the /Pages node, or shared with another page) still named the removed
 /// image and form, so a full-rewrite save kept them.

From e3b9e175b5c5148cf9cfce63a02358090db76e18 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 14:00:49 +0100
Subject: [PATCH 185/270] M11: redaction clears pixels in CCITT fax images
 instead of removing them whole

Create PDF and the optimizer now store black-and-white scans as Group 4,
and redaction couldn't decode CCITT, so redacting one word on such a
scan removed the whole page image. A CCITT image (the last filter,
after any others) now decodes through Document::decoded_image and is
cleared in a Flate copy like any other image; one that can't be decoded
in full is still removed whole.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/create/README.md      |  4 +---
 crates/optimize/README.md    |  4 +---
 crates/redact/README.md      | 11 ++++++-----
 crates/redact/src/image.rs   | 27 ++++++++++++++++++---------
 crates/redact/src/tests.rs   | 34 ++++++++++++++++++++++++++++++++++
 parity/acrobat-features.toml | 10 +++++-----
 6 files changed, 65 insertions(+), 25 deletions(-)

diff --git a/crates/create/README.md b/crates/create/README.md
index 05131d9038..a9aef83493 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -8,9 +8,7 @@ Layer L4. Create a PDF (Acrobat's Create a PDF tool), execution plan M10.2:
   (`/DCTDecode`, grey, RGB or Adobe-inverted CMYK); PNG is decoded and stored with Flate,
   with transparency as a soft mask. A picture of only pure black and white (a 1-bit PNG or TIFF,
   eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as
-  CCITT Group 4 or Flate, whichever is smaller as stored (`pdfcraft_filters::encode_g4`).
-  Redaction doesn't decode Group 4 yet: a mark over part of such a picture removes the whole
-  picture (nothing leaks). An ICC profile in the file (JPEG `APP2 ICC_PROFILE`, PNG
+  CCITT Group 4 or Flate, whichever is smaller as stored (`pdfcraft_filters::encode_g4`). An ICC profile in the file (JPEG `APP2 ICC_PROFILE`, PNG
   `iCCP`) that matches the image's colour space is kept as an `/ICCBased` colour space with
   the device space as `/Alternate`; images with the same profile share one profile object.
   JPEG metadata scanning skips marker fill bytes and reads application segments after the
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index ae6c749ef3..d0a412a311 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -58,9 +58,7 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
     space, decode array and `/Mask` stay. Group 4 wins on scans, whose ragged edges defeat Flate;
     on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, Group 3 to Group 4
-    without resampling, inline images, and Group 4 for rows wider than 32,767 samples. Redaction
-    doesn't decode Group 4 yet: a mark over part of an image stored this way removes the whole
-    image (nothing leaks).
+    without resampling, inline images, and Group 4 for rows wider than 32,767 samples.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/crates/redact/README.md b/crates/redact/README.md
index 34c9f4fe1f..2b540927d1 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -18,11 +18,12 @@ clear_marks(&mut doc, None)?;                        // remove marks without app
   more than a fifth of its size (or a point) both ways; zero-size text goes when its origin is
   inside;
 - **images**: fully covered → removed; partly covered → a copy with the covered pixels cleared
-  (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx). Codecs PdfCraft can't
-  re-encode (DCT, JPX, JBIG2, CCITT) are removed whole (fail-closed); inline images under an
-  area are removed. Images with separate `/SMask` or `/Mask` data, and images whose data decodes
-  to more than twice their declared raster (plus a byte per row and 4 KiB), are removed whole;
-  cleared copies drop `/Alternates` so alternate pixels cannot survive;
+  (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx, and CCITT fax as the last
+  filter, decoded through `Document::decoded_image`; `/DecodeParms` given by reference count).
+  Codecs PdfCraft can't decode (DCT, JPX, JBIG2) are removed whole (fail-closed); inline images
+  under an area are removed. Images with separate `/SMask` or `/Mask` data, and images whose
+  data decodes to more than twice their declared raster (plus a byte per row and 4 KiB), are
+  removed whole; cleared copies drop `/Alternates` so alternate pixels cannot survive;
 - **vectors**: covered paths are removed; partly covered paths and shadings are clipped so
   nothing paints inside the areas;
 - **form XObjects**: rewritten recursively into new objects (pages sharing the original keep it);
diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index 4e26fbd1fc..2d22cc8174 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -1,8 +1,9 @@
 //! Clearing the pixels of an image under redaction regions. The image is decoded, every pixel
 //! whose footprint intersects a region is set to zero (no ink for image masks), and the result is
 //! written as a new Flate image; the original object is untouched (other pages may use it).
-//! Images whose codec PdfCraft can't decode (DCT, JPX, JBIG2, CCITT) return `None`, and the
-//! caller removes the whole image instead; that is fail-closed.
+//! CCITT fax images decode through `Document::decoded_image`. Images whose codec PdfCraft can't
+//! decode (DCT, JPX, JBIG2) return `None`, and the caller removes the whole image instead; that
+//! is fail-closed.
 
 use pdfcraft_content::{Matrix, overlaps};
 use pdfcraft_cos::{Document, Object, Stream};
@@ -54,11 +55,18 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
             b"FlateDecode" | b"Fl" | b"LZWDecode" | b"LZW" | b"ASCII85Decode" | b"A85" | b"ASCIIHexDecode" | b"AHx" | b"RunLengthDecode" | b"RL"
         )
     };
-    let ok = match s.dict.get(b"Filter") {
-        None => true,
-        Some(Object::Name(n)) => supported(n),
-        Some(Object::Array(a)) => a.iter().all(|f| f.as_name().is_some_and(supported)),
-        _ => false,
+    // A CCITT fax image (its last filter) decodes through `Document::decoded_image`, after the
+    // filters before it, so a scan stored as Group 4 is cleared like any other image.
+    let fax = |f: &Object| f.as_name().is_some_and(|n| matches!(n, b"CCITTFaxDecode" | b"CCF"));
+    let readable = |f: &Object| f.as_name().is_some_and(supported);
+    let (ok, is_fax) = match s.dict.get(b"Filter") {
+        None => (true, false),
+        Some(f @ Object::Name(_)) => (readable(f) || fax(f), fax(f)),
+        Some(Object::Array(a)) => match a.split_last() {
+            Some((last, before)) if fax(last) => (before.iter().all(readable), true),
+            _ => (a.iter().all(readable), false),
+        },
+        _ => (false, false),
     };
     if !ok {
         return None;
@@ -82,9 +90,10 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     bytes.checked_mul(8)?;
     // Decode no further than the raster can need: a filter stage may legitimately produce up to
     // twice it (ASCIIHex text under Flate) plus a PNG predictor's byte per row. Data past that
-    // can only be a decompression bomb; the image is then removed whole.
+    // can only be a decompression bomb; the image is then removed whole. A fax image decodes to
+    // at most its /Height rows (the filters before it within `MAX_DECODED`).
     let allowance = bytes.checked_add(h)?.checked_mul(2)?.checked_add(4096)?;
-    let mut data = s.decoded_within(allowance).ok()?;
+    let mut data = if is_fax { doc.decoded_image(s).ok()? } else { s.decoded_within(allowance).ok()? };
     if data.len() < bytes {
         return None;
     }
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index 6db9cec8c7..760d0727cf 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -575,6 +575,40 @@ fn an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared(
     assert_eq!(named_image(&saved, 0, b"PCRedacted1"), Some(vec![10, 0, 30, 40, 50, 60, 70, 80]));
 }
 
+/// A CCITT fax image (a scan the optimizer or Create PDF stored as Group 4) has its covered
+/// pixels cleared in a copy, like any image PdfCraft can decode, instead of being removed whole:
+/// whether it sits behind another filter, with its parameters given by reference, or is a mask.
+#[test]
+fn a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed() {
+    // 16 × 2, all 1 bits (white), or all 0 bits (a mask painting everywhere); the left half of
+    // the top row is covered.
+    let g4 = pdfcraft_filters::encode_g4(&[0xFF; 4], 16, 2).unwrap();
+    let painted = pdfcraft_filters::encode_g4(&[0x00; 4], 16, 2).unwrap();
+    let hex: Vec<u8> = g4.iter().map(|b| format!("{b:02x}")).collect::<String>().bytes().chain(*b">").collect();
+    let image = "/Type /XObject /Subtype /Image /Width 16 /Height 2 /BitsPerComponent 1";
+    let parms = "<< /K -1 /Columns 16 /Rows 2 >>";
+    for (dict, data, extra, cleared) in [
+        (format!("{image} /ColorSpace /DeviceGray /Filter /CCITTFaxDecode /DecodeParms {parms}"), g4.clone(), vec![], [0x00, 0xFF, 0xFF, 0xFF]),
+        (
+            format!("{image} /ColorSpace /DeviceGray /Filter [/ASCIIHexDecode /CCITTFaxDecode] /DecodeParms [null 8 0 R]"),
+            hex,
+            vec![parms.as_bytes().to_vec()],
+            [0x00, 0xFF, 0xFF, 0xFF],
+        ),
+        // A mask's 0 bits paint: cleared bits are set to 1, which paints nothing.
+        (format!("{image} /ImageMask true /Filter /CCITTFaxDecode /DecodeParms {parms}"), painted, vec![], [0xFF, 0x00, 0x00, 0x00]),
+    ] {
+        let mut objs = vec![stream(&dict, data)];
+        objs.extend(extra);
+        let mut doc = one_page(b"q 160 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", objs);
+        mark(&mut doc, 0, &[[0.0, 12.0, 75.0, 18.0]], "");
+        let report = apply(&mut doc, None).unwrap();
+        assert_eq!((report.images_cleared, report.images_removed), (1, 0), "{dict}");
+        let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+        assert_eq!(named_image(&saved, 0, b"PCRedacted1").as_deref(), Some(&cleared[..]), "{dict}");
+    }
+}
+
 /// Apply Redactions gives the page its own pruned /Resources, but the dictionary it drew through
 /// before (inherited from the /Pages node, or shared with another page) still named the removed
 /// image and form, so a full-rewrite save kept them.
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index d2ef8f4f75..c9ca864d45 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -131,7 +131,7 @@ status = "partial"
 commands = []
 tools = []
 evidence = ["crates/filters/src/ccitt.rs::decoding_gives_the_rows_back", "crates/cos/src/document/tests.rs::fax_images_decode_with_their_parameters"]
-notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images and the optimizer"
+notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images, the optimizer and redaction"
 
 [[feature]]
 id = "core.decompression-limits"
@@ -5792,8 +5792,8 @@ milestone = "M8"
 status = "shipped"
 commands = ["redact.apply"]
 tools = ["redact_apply"]
-evidence = ["crates/redact/src/tests.rs::images_are_removed_or_have_their_pixels_cleared", "crates/redact/src/tests.rs::redaction_clears_pixels_intersected_without_covering_their_centres"]
-notes = "intersected pixel footprints are cleared conservatively in a copy; DCT/JPX/JBIG2/CCITT images removed whole"
+evidence = ["crates/redact/src/tests.rs::images_are_removed_or_have_their_pixels_cleared", "crates/redact/src/tests.rs::redaction_clears_pixels_intersected_without_covering_their_centres", "crates/redact/src/tests.rs::a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed", "crates/redact/src/tests.rs::an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared"]
+notes = "intersected pixel footprints are cleared conservatively in a copy, CCITT fax images (scans stored as Group 4) included; DCT/JPX/JBIG2 images removed whole"
 
 [[feature]]
 id = "protect.redact-vectors"
@@ -6885,7 +6885,7 @@ status = "shipped"
 commands = ["create.images"]
 tools = ["doc_create"]
 evidence = ["crates/create/src/tests.rs::black_and_white_images_are_stored_at_one_bit", "crates/create/src/tests.rs::jpeg_2000_images_are_embedded_as_is", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::embedded_icc_profiles_tag_the_image_colour_space"]
-notes = "PNG, JPEG, TIFF (multi-page), GIF (first frame), BMP, and JPEG 2000 (JP2 or codestream, embedded as JPXDecode with its capture resolution). JPEG and PNG ICC profiles are kept as /ICCBased; TIFF profiles are not read yet. A picture of only pure black and white (a 1-bit PNG or TIFF, eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as CCITT Group 4 or Flate, whichever is smaller. Redaction doesn't decode Group 4 yet: a mark over part of such a picture removes it whole (nothing leaks)"
+notes = "PNG, JPEG, TIFF (multi-page), GIF (first frame), BMP, and JPEG 2000 (JP2 or codestream, embedded as JPXDecode with its capture resolution). JPEG and PNG ICC profiles are kept as /ICCBased; TIFF profiles are not read yet. A picture of only pure black and white (a 1-bit PNG or TIFF, eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as CCITT Group 4 or Flate, whichever is smaller"
 
 [[feature]]
 id = "create.from-multipage-tiff"
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), Group 3 to Group 4 without resampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), Group 3 to Group 4 without resampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 832d74b50497196fe4a3c39b32fc498da95d54ef Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 14:05:11 +0100
Subject: [PATCH 186/270] M11: the batch optimize step's ppi reaches
 black-and-white images

The batch step took Reduce File Size's monochrome settings unchanged, so
`ppi: 600` (or `--ppi 600`) kept colour and grey images at 600 ppi but
halved 600 ppi black-and-white scans to 300. Black-and-white images now
go to the larger of ppi and 300 ppi: a higher ppi keeps their
resolution, and a lower one doesn't take scanned text below 300. The
doc_batch description and docs/cli-batch.md say so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/src/batch.rs           | 10 ++++--
 crates/automation/src/tools.rs           |  2 +-
 crates/automation/tests/it/automation.rs | 46 ++++++++++++++++++------
 docs/cli-batch.md                        |  8 +++--
 4 files changed, 49 insertions(+), 17 deletions(-)

diff --git a/crates/automation/src/batch.rs b/crates/automation/src/batch.rs
index 47cf714ec9..decb18d2b7 100644
--- a/crates/automation/src/batch.rs
+++ b/crates/automation/src/batch.rs
@@ -17,6 +17,7 @@ const MAX_INPUT: u64 = 512 * 1024 * 1024;
 struct Recipe<'a> {
     steps: Vec<&'a str>,
     images: optimize::ImageSettings,
+    mono: optimize::MonoSettings,
     ocr: ocr::OcrSettings,
 }
 
@@ -38,12 +39,17 @@ impl<'a> Recipe<'a> {
             }
         }
         let mut images = optimize::ImageSettings::REDUCE;
+        let mut mono = optimize::MonoSettings::REDUCE;
         if let Some(ppi) = args.opt_num("ppi")? {
             if !(9.0..=1600.0).contains(&ppi) {
                 return Err(Args::wrong("ppi", "9 to 1600"));
             }
             images.target_ppi = ppi;
             images.above_ppi = ppi * 1.5;
+            // Black-and-white images keep Reduce File Size's higher resolution, at which text
+            // stays legible, and are never taken below a higher `ppi` asked for.
+            mono.target_ppi = mono.target_ppi.max(ppi);
+            mono.above_ppi = mono.target_ppi * 1.5;
         }
         if let Some(q) = args.opt_int("quality")? {
             if !(1..=100).contains(&q) {
@@ -54,7 +60,7 @@ impl<'a> Recipe<'a> {
         if args.opt_num("dpi")?.is_some_and(|dpi| !(72.0..=600.0).contains(&dpi)) {
             return Err(Args::wrong("dpi", "72 to 600"));
         }
-        Ok(Self { steps, images, ocr: auto.ocr_settings(args)? })
+        Ok(Self { steps, images, mono, ocr: auto.ocr_settings(args)? })
     }
 
     fn accepts(&self, path: &Path) -> bool {
@@ -88,7 +94,7 @@ impl<'a> Recipe<'a> {
                 }
                 "optimize" => {
                     let id = session.open(name, None, bytes.clone(), None).map_err(failed)?;
-                    let settings = optimize::Settings { color: self.images, gray: self.images, ..Default::default() };
+                    let settings = optimize::Settings { color: self.images, gray: self.images, mono: self.mono, ..Default::default() };
                     let (candidate, _) = session.optimized_bytes(id, &settings, &[])?;
                     session.close(id);
                     if candidate.len() < bytes.len() {
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 79555f1548..8767b4dc46 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -121,7 +121,7 @@ pub fn tools() -> Vec<ToolDef> {
     let save_out = json!({ "type": "string", "description": "File to write. Omit to open the result as a new unsaved document instead." });
     let open = json!({ "type": "boolean", "description": "Also open the result as a new document (default: only when out is omitted)." });
     vec![
-        t("doc_batch", "Process files and folders", "Run convert, ocr and/or optimize over files and folders, one file at a time. recursive defaults to false. Preserve paths relative to each selected folder inside out_dir; duplicate inputs run once. Skip unsupported files, links and the output subtree. Existing outputs receive numbered names and are never replaced. Continue after per-file errors unless stop_on_error is true. Return completed/failed/skipped counts and per-file results. Discovery is bounded to 10000 entries and 64 folder levels. Convert must be first; each step can appear once. OCR uses installed models. Optimize uses Reduce File Size settings, optionally overriding target ppi (threshold 1.5 times ppi) and JPEG quality; a larger candidate keeps the original bytes. Sources and open documents are unchanged.")
+        t("doc_batch", "Process files and folders", "Run convert, ocr and/or optimize over files and folders, one file at a time. recursive defaults to false. Preserve paths relative to each selected folder inside out_dir; duplicate inputs run once. Skip unsupported files, links and the output subtree. Existing outputs receive numbered names and are never replaced. Continue after per-file errors unless stop_on_error is true. Return completed/failed/skipped counts and per-file results. Discovery is bounded to 10000 entries and 64 folder levels. Convert must be first; each step can appear once. OCR uses installed models. Optimize uses Reduce File Size settings, optionally overriding target ppi (threshold 1.5 times ppi; black-and-white images go to the larger of ppi and 300) and JPEG quality; a larger candidate keeps the original bytes. Sources and open documents are unchanged.")
             .with(schema(json!({
                 "paths": {"type":"array","items":{"type":"string"},"minItems":1,"maxItems":1000},
                 "out_dir": {"type":"string"},
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index e68da784d6..d17627a951 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6525,17 +6525,7 @@ fn doc_optimize_averages_black_and_white_scans_down() {
     std::fs::write(dir.join("scan.pdf"), scan_drawn(b"q 120 0 0 48 50 500 cm /Scan Do Q")).unwrap();
     let mut a = auto(&dir);
     let doc = ok(&mut a, "doc_open", json!({ "path": "scan.pdf" }))["doc"].as_u64().unwrap();
-    let sizes = |name: &str| -> Vec<(Option<i64>, Option<i64>)> {
-        let written = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join(name)).unwrap())).unwrap();
-        written
-            .object_numbers()
-            .into_iter()
-            .filter_map(|num| match &*written.get(pdfcraft_cos::ObjRef { num, generation: written.generation(num) }) {
-                pdfcraft_cos::Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => Some((s.dict.int(b"Width"), s.dict.int(b"Height"))),
-                _ => None,
-            })
-            .collect()
-    };
+    let sizes = |name: &str| image_sizes(&dir.join(name));
     let r = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "small.pdf" }));
     assert_eq!(r["images_resampled"].as_u64(), Some(1), "{r}");
     assert_eq!(sizes("small.pdf"), [(Some(500), Some(200))]);
@@ -6549,6 +6539,40 @@ fn doc_optimize_averages_black_and_white_scans_down() {
     }
 }
 
+/// The width and height of every image in the PDF at `path`.
+fn image_sizes(path: &std::path::Path) -> Vec<(Option<i64>, Option<i64>)> {
+    let written = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(path).unwrap())).unwrap();
+    written
+        .object_numbers()
+        .into_iter()
+        .filter_map(|num| match &*written.get(pdfcraft_cos::ObjRef { num, generation: written.generation(num) }) {
+            pdfcraft_cos::Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => Some((s.dict.int(b"Width"), s.dict.int(b"Height"))),
+            _ => None,
+        })
+        .collect()
+}
+
+/// The batch optimize step's `ppi` reaches black-and-white images too: they go to the larger of
+/// it and Reduce File Size's 300 ppi. Before, a batch run took every scan to 300 ppi whatever
+/// `ppi` said, so `ppi: 600` halved 600 ppi scans.
+#[test]
+fn batch_ppi_bounds_how_far_black_and_white_scans_are_resampled() {
+    let dir = workdir("batch-mono-ppi");
+    // 1000 × 400 samples on 120 × 48 pt: 600 ppi.
+    std::fs::write(dir.join("scan.pdf"), scan_drawn(b"q 120 0 0 48 50 500 cm /Scan Do Q")).unwrap();
+    let mut a = auto(&dir);
+    for (ppi, size) in [(None, (500, 200)), (Some(600), (1000, 400)), (Some(96), (500, 200))] {
+        let out = format!("out-{ppi:?}");
+        let mut args = json!({ "paths": ["scan.pdf"], "steps": ["optimize"], "out_dir": out });
+        if let Some(ppi) = ppi {
+            args["ppi"] = json!(ppi);
+        }
+        let report = ok(&mut a, "doc_batch", args);
+        assert_eq!(report["completed"], 1, "{report}");
+        assert_eq!(image_sizes(&dir.join(&out).join("scan.pdf")), [(Some(size.0), Some(size.1))], "ppi {ppi:?}");
+    }
+}
+
 /// A one-page PDF whose page picture is drawn as `rows` grey images one pixel row high, 600 px
 /// wide on a 72 pt square (600 ppi), as some PDF printers write it.
 fn printed_in_strips(rows: usize) -> Vec<u8> {
diff --git a/docs/cli-batch.md b/docs/cli-batch.md
index 0892791194..ad2982bb14 100644
--- a/docs/cli-batch.md
+++ b/docs/cli-batch.md
@@ -27,9 +27,11 @@ new engine importers become available here automatically. Without `convert`,
 only `.pdf` inputs are processed. Unsupported extensions are reported as skipped.
 
 - `optimize` uses Reduce File Size settings: JPEG quality 60, resampling to 150 ppi
-  above 225 ppi (black-and-white images stored as CCITT Group 4 when smaller), plus the
-  existing document cleanup. `--ppi` (9–1600) sets the target
-  and a threshold of 1.5 times that value; `--quality` (1–100) sets JPEG quality.
+  above 225 ppi (black-and-white images to 300 ppi above 450 ppi, stored as CCITT
+  Group 4 when smaller), plus the existing document cleanup. `--ppi` (9–1600) sets the
+  target and a threshold of 1.5 times that value; black-and-white images go to the
+  larger of `--ppi` and 300 ppi, so a lower value keeps scanned text legible and a
+  higher one keeps their resolution. `--quality` (1–100) sets JPEG quality.
   These settings can lose image detail. A candidate that is not smaller retains
   the bytes entering that step. This is not an images-only or lossless preset.
 - `ocr` uses the installed engine and its supported languages. `--dpi` (72–600,

From 1f801bf4c987ebff22f6aa868ec926e1c664e316 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 14:23:23 +0100
Subject: [PATCH 187/270] M11: redaction bounds a fax image's decoding; a test
 for numbers inside /DecodeParms given by reference

- Redacting a CCITT image went through decoded_image, which undoes the
  filters before the fax decoder up to MAX_DECODED, so a Flate bomb in
  front of a fax image cost a gigabyte while every other image stops at
  twice its raster. Document::decoded_image_within takes a bound, and
  redaction gives a fax image's code about a byte per pixel. A fax image
  cut short, or behind a bomb, is removed whole; a busy one whose code
  is bigger than twice its raster is still cleared.
- Every image is now decoded through decoded_image_within, which reads
  /DecodeParms through Document::with_direct_parms: given by reference,
  the numbers inside (/Predictor 7 0 R) included. That reading was first
  written here and has moved down to #4304. The predictor test now covers
  the dictionary, an array's entry and the number itself given by
  reference; read without them, the cleared bytes drift off the covered
  pixel and the covered sample stays in the copy.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/cos/src/document/objects.rs | 14 +++--
 crates/redact/README.md            | 11 ++--
 crates/redact/src/image.rs         | 24 +++++----
 crates/redact/src/tests.rs         | 82 +++++++++++++++++++++++-------
 docs/pdf-spec-parity.md            |  5 +-
 5 files changed, 97 insertions(+), 39 deletions(-)

diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index 06d488d7c2..4c03d04243 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -233,9 +233,17 @@ impl Document {
     /// whatever `/Rows` says, within [`MAX_DECODED`] bytes; damaged data gives fewer, so a caller
     /// checks it has the rows it needs.
     pub fn decoded_image(&self, s: &Stream) -> Result<Vec<u8>, CosError> {
+        self.decoded_image_within(s, MAX_DECODED)
+    }
+
+    /// [`Document::decoded_image`] for an image whose decoding has a tighter bound than
+    /// [`MAX_DECODED`]: no stage, the filters before a fax decoder included, may produce more than
+    /// `max` bytes.
+    pub fn decoded_image_within(&self, s: &Stream, max: usize) -> Result<Vec<u8>, CosError> {
+        let max = max.min(MAX_DECODED);
         let s = &*self.with_direct_parms(s);
         let chain = s.readable_filters().map_err(|e| CosError::Filter(e.to_string()))?;
-        let Some(((pdfcraft_filters::Filter::CcittFax, _), before)) = chain.split_last() else { return s.decoded() };
+        let Some(((pdfcraft_filters::Filter::CcittFax, _), before)) = chain.split_last() else { return s.decoded_within(max) };
         // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1): the
         // last filter but a /Crypt, which `filters` leaves out wherever it stands.
         let index = match s.dict.get(b"Filter") {
@@ -270,11 +278,11 @@ impl Document {
         }
         let height = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
         let stride = usize::try_from(p.columns).unwrap_or(usize::MAX).div_ceil(8).max(1);
-        let rows = u32::try_from(MAX_DECODED / stride).unwrap_or(u32::MAX).min(height);
+        let rows = u32::try_from(max / stride).unwrap_or(u32::MAX).min(height);
         // The filters before it, such as ASCII85Decode, are undone first.
         let data = match before {
             [] => Cow::Borrowed(&s.raw[..]),
-            _ => Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, MAX_DECODED).map_err(|e| CosError::Filter(e.to_string()))?.0),
+            _ => Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, max).map_err(|e| CosError::Filter(e.to_string()))?.0),
         };
         pdfcraft_filters::decode_ccitt(&data, &p, rows).map_err(|e| CosError::Filter(e.to_string()))
     }
diff --git a/crates/redact/README.md b/crates/redact/README.md
index 2b540927d1..75648b3cc4 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -19,11 +19,12 @@ clear_marks(&mut doc, None)?;                        // remove marks without app
   inside;
 - **images**: fully covered → removed; partly covered → a copy with the covered pixels cleared
   (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx, and CCITT fax as the last
-  filter, decoded through `Document::decoded_image`; `/DecodeParms` given by reference count).
-  Codecs PdfCraft can't decode (DCT, JPX, JBIG2) are removed whole (fail-closed); inline images
-  under an area are removed. Images with separate `/SMask` or `/Mask` data, and images whose
-  data decodes to more than twice their declared raster (plus a byte per row and 4 KiB), are
-  removed whole; cleared copies drop `/Alternates` so alternate pixels cannot survive;
+  filter, decoded through `Document::decoded_image_within`; `/DecodeParms` given by reference,
+  numbers inside included, count). Codecs redaction doesn't decode (DCT, JPX, JBIG2) are removed
+  whole (fail-closed); inline images under an area are removed. Images with separate `/SMask`
+  or `/Mask` data, and images whose data decodes to more than twice their declared raster (plus
+  a byte per row and 4 KiB; for a fax image's code, about a byte per pixel), are removed whole;
+  cleared copies drop `/Alternates` so alternate pixels cannot survive;
 - **vectors**: covered paths are removed; partly covered paths and shadings are clipped so
   nothing paints inside the areas;
 - **form XObjects**: rewritten recursively into new objects (pages sharing the original keep it);
diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index 2d22cc8174..6568e8015a 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -1,7 +1,7 @@
 //! Clearing the pixels of an image under redaction regions. The image is decoded, every pixel
 //! whose footprint intersects a region is set to zero (no ink for image masks), and the result is
 //! written as a new Flate image; the original object is untouched (other pages may use it).
-//! CCITT fax images decode through `Document::decoded_image`. Images whose codec PdfCraft can't
+//! CCITT fax images decode through `Document::decoded_image_within`. Images whose codec PdfCraft can't
 //! decode (DCT, JPX, JBIG2) return `None`, and the caller removes the whole image instead; that
 //! is fail-closed.
 
@@ -46,16 +46,13 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     if s.dict.contains(b"SMask") || s.dict.contains(b"Mask") {
         return None;
     }
-    // `Stream::decoded*` reads `/DecodeParms` only when it is direct: a predictor given by
-    // reference would be skipped, and the cleared bytes would then miss the covered pixels.
-    let s = &*doc.with_direct_parms(s);
     let supported = |n: &[u8]| {
         matches!(
             n,
             b"FlateDecode" | b"Fl" | b"LZWDecode" | b"LZW" | b"ASCII85Decode" | b"A85" | b"ASCIIHexDecode" | b"AHx" | b"RunLengthDecode" | b"RL"
         )
     };
-    // A CCITT fax image (its last filter) decodes through `Document::decoded_image`, after the
+    // A CCITT fax image (its last filter) decodes through `Document::decoded_image_within`, after the
     // filters before it, so a scan stored as Group 4 is cleared like any other image.
     let fax = |f: &Object| f.as_name().is_some_and(|n| matches!(n, b"CCITTFaxDecode" | b"CCF"));
     let readable = |f: &Object| f.as_name().is_some_and(supported);
@@ -89,11 +86,18 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     let row_bits = row.checked_mul(8)?;
     bytes.checked_mul(8)?;
     // Decode no further than the raster can need: a filter stage may legitimately produce up to
-    // twice it (ASCIIHex text under Flate) plus a PNG predictor's byte per row. Data past that
-    // can only be a decompression bomb; the image is then removed whole. A fax image decodes to
-    // at most its /Height rows (the filters before it within `MAX_DECODED`).
-    let allowance = bytes.checked_add(h)?.checked_mul(2)?.checked_add(4096)?;
-    let mut data = if is_fax { doc.decoded_image(s).ok()? } else { s.decoded_within(allowance).ok()? };
+    // twice it (ASCIIHex text under Flate) plus a PNG predictor's byte per row. A fax image's
+    // code, which the filters before its decoder produce, takes at most about a byte per pixel
+    // plus each row's end. Data past that can only be a decompression bomb; the image is then
+    // removed whole.
+    let allowance = if is_fax {
+        w.checked_mul(h)?.checked_add(h.checked_mul(4)?)?.checked_add(4096)?
+    } else {
+        bytes.checked_add(h)?.checked_mul(2)?.checked_add(4096)?
+    };
+    // Through the document, which reads `/DecodeParms` given by reference (`Stream::decoded*`
+    // alone would skip such a predictor, and the cleared bytes would then miss the covered pixels).
+    let mut data = doc.decoded_image_within(s, allowance).ok()?;
     if data.len() < bytes {
         return None;
     }
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index 760d0727cf..9400391bb5 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -550,29 +550,31 @@ fn redaction_clears_pixels_intersected_without_covering_their_centres() {
 }
 
 /// An image whose PNG predictor is given by reference has its covered pixel cleared, and only
-/// that one: `Stream::decoded` reads only a direct `/DecodeParms`, so the row tags stayed in the
-/// data, the cleared byte drifted off the covered pixel and the covered sample survived.
+/// that one, whichever part is the reference: the dictionary, an array's entry, or the number
+/// itself. `Stream::decoded` reads only a direct `/DecodeParms` with direct numbers, so the row
+/// tags stayed in the data, the cleared byte drifted off the covered pixel and the covered sample
+/// survived.
 #[test]
 fn an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared() {
     // Two rows of four grey samples, each behind a PNG "None" row tag.
     let predicted = pdfcraft_filters::encode_flate(&[0, 10, 20, 30, 40, 0, 50, 60, 70, 80]);
-    let mut doc = one_page(
-        b"q 40 0 0 20 0 0 cm /Im Do Q",
-        "/XObject << /Im 7 0 R >>",
-        vec![
-            stream(
-                "/Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /FlateDecode /DecodeParms 8 0 R",
-                predicted,
-            ),
-            b"<< /Predictor 15 /Colors 1 /BitsPerComponent 8 /Columns 4 >>".to_vec(),
-        ],
-    );
-    // The top row's second sample.
-    mark(&mut doc, 0, &[[12.0, 12.0, 18.0, 18.0]], "");
-    let report = apply(&mut doc, None).unwrap();
-    assert_eq!(report.images_cleared, 1);
-    let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
-    assert_eq!(named_image(&saved, 0, b"PCRedacted1"), Some(vec![10, 0, 30, 40, 50, 60, 70, 80]));
+    let parms = "/Predictor 15 /Colors 1 /BitsPerComponent 8 /Columns 4";
+    for (decode_parms, object8) in [
+        ("8 0 R".to_owned(), format!("<< {parms} >>")),
+        ("[8 0 R]".to_owned(), format!("<< {parms} >>")),
+        ("<< /Predictor 8 0 R /Colors 1 /BitsPerComponent 8 /Columns 4 >>".to_owned(), "15".to_owned()),
+    ] {
+        let image = format!(
+            "/Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /FlateDecode /DecodeParms {decode_parms}"
+        );
+        let mut doc = one_page(b"q 40 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(&image, &predicted), object8.into_bytes()]);
+        // The top row's second sample.
+        mark(&mut doc, 0, &[[12.0, 12.0, 18.0, 18.0]], "");
+        let report = apply(&mut doc, None).unwrap();
+        assert_eq!(report.images_cleared, 1, "{decode_parms}");
+        let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+        assert_eq!(named_image(&saved, 0, b"PCRedacted1"), Some(vec![10, 0, 30, 40, 50, 60, 70, 80]), "{decode_parms}");
+    }
 }
 
 /// A CCITT fax image (a scan the optimizer or Create PDF stored as Group 4) has its covered
@@ -609,6 +611,48 @@ fn a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed() {
     }
 }
 
+/// A fax image that can't be decoded in full is removed whole, as any other image is: one whose
+/// code is cut short, and one behind a filter that inflates past what a code for its pixels can
+/// take (a decompression bomb, which `decoded_image` alone would undo up to a gigabyte).
+#[test]
+fn a_fax_image_that_cannot_be_decoded_in_full_is_removed_whole() {
+    let g4 = pdfcraft_filters::encode_g4(&[0xFF; 4], 16, 2).unwrap();
+    // A busy picture's code, cut off in its first row.
+    let busy = pdfcraft_filters::encode_g4(&[0xAA, 0xAA, 0x55, 0x55], 16, 2).unwrap();
+    let short = busy.get(..1).unwrap().to_vec();
+    // The real code, then four megabytes of padding the fax decoder would never read.
+    let mut padded = g4.clone();
+    padded.resize(4 << 20, 0);
+    let bomb = pdfcraft_filters::encode_flate(&padded);
+    let image = "/Type /XObject /Subtype /Image /Width 16 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 1";
+    let parms = "<< /K -1 /Columns 16 /Rows 2 >>";
+    for (filters, data) in [("/CCITTFaxDecode /DecodeParms", short), ("[/FlateDecode /CCITTFaxDecode] /DecodeParms [null", bomb)] {
+        let close = if filters.ends_with("[null") { "]" } else { "" };
+        let dict = format!("{image} /Filter {filters} {parms}{close}");
+        let mut doc = one_page(b"q 160 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(&dict, data)]);
+        mark(&mut doc, 0, &[[0.0, 12.0, 75.0, 18.0]], "");
+        let report = apply(&mut doc, None).unwrap();
+        assert_eq!((report.images_cleared, report.images_removed), (0, 1), "{dict}");
+    }
+}
+
+/// A busy fax image is cleared, though its code is bigger than twice its raster (the bound for
+/// other images): a code takes up to about a byte per pixel, and the fax image gets that much.
+#[test]
+fn a_busy_fax_image_behind_another_filter_is_cleared() {
+    // A 256 × 256 checkerboard, the worst case for a fax code.
+    let rows: Vec<u8> = (0..256).flat_map(|y| [if y % 2 == 0 { 0xAA } else { 0x55 }; 32]).collect();
+    let g4 = pdfcraft_filters::encode_g4(&rows, 256, 256).unwrap();
+    let raster = 32 * 256;
+    assert!(g4.len() > (raster + 256) * 2 + 4096, "{} bytes: within the bound for other images", g4.len());
+    let dict = "/Type /XObject /Subtype /Image /Width 256 /Height 256 /ColorSpace /DeviceGray /BitsPerComponent 1 \
+                /Filter [/FlateDecode /CCITTFaxDecode] /DecodeParms [null << /K -1 /Columns 256 /Rows 256 >>]";
+    let mut doc = one_page(b"q 256 0 0 256 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(dict, pdfcraft_filters::encode_flate(&g4))]);
+    mark(&mut doc, 0, &[[0.0, 0.0, 10.0, 10.0]], "");
+    let report = apply(&mut doc, None).unwrap();
+    assert_eq!((report.images_cleared, report.images_removed), (1, 0));
+}
+
 /// Apply Redactions gives the page its own pruned /Resources, but the dictionary it drew through
 /// before (inherited from the /Pages node, or shared with another page) still named the removed
 /// image and form, so a full-rewrite save kept them.
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index 6ed9eba7c1..b68c5b641d 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,6 +1,6 @@
 # PDF specification and standards parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: CCITT decoding in `pdfcraft-filters`; earlier, §7.4: CCITT Group 4 encoding in the Optimizer) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: redaction decodes CCITT fax images; earlier, §7.4: CCITT decoding in `pdfcraft-filters`) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -21,7 +21,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 |---|---|---|---|---|
 | §7.2–7.5 | Syntax, objects, file structure, xref tables and streams, object streams, hybrid files, incremental updates | full | **own**, tolerant, repairs damaged files | `crates/cos`; corpus 958 files; fuzzed nightly |
 | §7.4 | Stream filters: Flate, LZW, ASCII85, ASCIIHex, RunLength, predictors | full | **own** | `crates/filters` |
-| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; CCITT decoding in `pdfcraft-filters` (`decode_ccitt`, through `hayro-ccitt`) for export and the Optimizer, which encodes Group 4 (`optimize.mono-compression`); no JBIG2 encoding |
+| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; CCITT decoding in `pdfcraft-filters` (`decode_ccitt`, through `hayro-ccitt`) for export, redaction and the Optimizer, which encodes Group 4 (`optimize.mono-compression`); no JBIG2 encoding |
 | §7.5.8 | Linearization | R W | R only | `core.linearization` planned |
 | §7.6.4 | Standard security handler R2–R6 (RC4 40/128, AES-128, AES-256), crypt filters, `/EncryptMetadata`, SASLprep | full | **own**, read and write | `crates/crypt`; written files open in Acrobat DC since #836 (#774: Acrobat needs the catalog outside object streams) |
 | §7.6.5 | Public-key security handler | full | none | `core.open-public-key`, `protect.certificate-encryption` planned |
@@ -130,6 +130,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | §7.4: redaction clears pixels in CCITT fax images through the CCITT decoder, instead of removing them whole |
 | 2026-10-26 | minor | §7.4: CCITT decoding (`hayro-ccitt`) in `pdfcraft-filters`, for export and the Optimizer |
 | 2026-10-26 | minor | §7.4: CCITT Group 4 encoding (`fax`) in the Optimizer |
 | 2026-10-14 | minor | §12.4.4: `/Trans` and `/Dur` read into `DocInfo::transitions` and reported by `doc_info` |

From 8bd156a4ac0d953ab21283949f3835f513ff312c Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 14:23:23 +0100
Subject: [PATCH 188/270] M11: Reduce File Size's descriptions say
 black-and-white images go to 300 ppi

doc_reduce, the engine's reduced_bytes doc, the optimize README's
presets and the optimize.reduce parity note still said every image
above 225 ppi goes to 150 ppi; black-and-white images go to 300 ppi
above 450 ppi, as CCITT Group 4 when smaller.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/src/tools.rs     | 2 +-
 crates/engine/src/session/files.rs | 9 +++++----
 crates/optimize/README.md          | 4 +++-
 parity/acrobat-features.toml       | 2 +-
 4 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 8767b4dc46..cdf62ebd8e 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1332,7 +1332,7 @@ pub fn tools() -> Vec<ToolDef> {
             }),
             &["from"],
         )),
-        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images stored as CCITT Group 4 whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
+        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images averaged down to 300 ppi above 450 ppi and each stored as CCITT Group 4 (or 1-bit Flate, once resampled) whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
             .cmd("optimize.reduce")
             .with(schema(json!({ "doc": doc(), "path": { "type": "string" } }), &["doc", "path"])),
         t("doc_initial_view", "Initial view", "Read or change how the document opens (Document Properties ▸ Initial View) and its reading options: navigation (page, bookmarks, pages, attachments, layers), layout (default, single, continuous, two_up, two_up_continuous, two_up_cover, two_up_continuous_cover), magnification (default, actual, fit_page, fit_width, fit_height, fit_visible, or a percentage), page, window options (fit_window, center_window, full_screen, display_title), interface options (hide_menubar, hide_toolbar, hide_window_ui), language and binding (left, right). Only the given ones change; returns the result. Undoable.").with(schema(
diff --git a/crates/engine/src/session/files.rs b/crates/engine/src/session/files.rs
index 5453163aca..34d75e5c82 100644
--- a/crates/engine/src/session/files.rs
+++ b/crates/engine/src/session/files.rs
@@ -69,10 +69,11 @@ impl Session {
     }
 
     /// Reduce File Size: Acrobat's defaults (colour and grey images above 225 ppi to 150 ppi,
-    /// JPEG medium quality; black-and-white stored as CCITT Group 4 whenever smaller; thumbnails
-    /// dropped), identical resources merged, unused objects dropped, objects packed into
-    /// compressed object streams. Returns the bytes and how many objects were merged. The open
-    /// document is not changed (Acrobat saves the reduced copy as a new file).
+    /// JPEG medium quality; black-and-white averaged down to 300 ppi above 450 ppi, and stored as
+    /// CCITT Group 4 whenever smaller; thumbnails dropped), identical resources merged, unused
+    /// objects dropped, objects packed into compressed object streams. Returns the bytes and how
+    /// many objects were merged. The open document is not changed (Acrobat saves the reduced copy
+    /// as a new file).
     pub fn reduced_bytes(&self, id: DocId) -> Result<(Arc<Vec<u8>>, usize), EditError> {
         let (bytes, report) = self.optimized_bytes(id, &optimize::Settings::default(), &[])?;
         Ok((bytes, report.merged))
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index d0a412a311..3ff33728db 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -11,7 +11,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
 ```
 
 - **Presets:** Standard (Reduce File Size's choices: images above 225 ppi to 150 ppi, JPEG
-  medium) and Mobile (above 144 ppi to 96 ppi, JPEG high), as in Acrobat's Settings menu.
+  medium) and Mobile (above 144 ppi to 96 ppi, JPEG high), as in Acrobat's Settings menu. In
+  both, black-and-white images are averaged down to 300 ppi above 450 ppi, and stored as CCITT
+  Group 4 whenever that is smaller.
 - **Merge image fragments** (`fragments`, on by default): some PDF printers draw a page picture
   as thousands of images one pixel row high. Runs of upright 8-bit grey or RGB images in one
   colour space, sharing their left and right edges and stacked edge to edge (at least four,
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index c9ca864d45..6e67d4aa9a 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7325,7 +7325,7 @@ status = "shipped"
 commands = ["optimize.reduce"]
 tools = ["doc_reduce"]
 evidence = ["crates/ui-egui/tests/it/create.rs::reduce_file_size_writes_a_compact_copy", "crates/ui-egui/tests/it/create.rs::reduce_file_size_saves_nothing_when_the_file_is_already_small", "crates/engine/src/tests.rs::create_and_reduce", "crates/automation/tests/it/automation.rs::creating_and_reducing_through_tools", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::an_identity_decode_array_does_not_stop_reduce"]
-notes = "images above 225 ppi to 150 ppi JPEG medium (after merging page pictures printed as one-pixel strips into one image), black-and-white images to CCITT Group 4 when that is smaller, thumbnails dropped, resources merged, object streams; scanner images with the default decode array are included; a copy that isn't smaller is not saved (\"already as small as it can be made\"); runs in the background with a progress bar and Cancel"
+notes = "images above 225 ppi to 150 ppi JPEG medium (after merging page pictures printed as one-pixel strips into one image), black-and-white images averaged down to 300 ppi above 450 ppi, and stored as CCITT Group 4 whenever that is smaller, thumbnails dropped, resources merged, object streams; scanner images with the default decode array are included; a copy that isn't smaller is not saved (\"already as small as it can be made\"); runs in the background with a progress bar and Cancel"
 
 [[feature]]
 id = "optimize.compatibility-level"

From e221d552f9d1e7de65a9c30a15e980b101e0ada8 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 09:54:53 +0200
Subject: [PATCH 189/270] M11: the optimizer stores Group 3 fax images as Group
 4 when smaller

A CCITT fax image that wasn't resampled was left as it was, so Group 3
images (the 1-D and 2-D codings fax software writes) stayed Group 3.
Group 4 codes each row against the one above and is usually much
smaller. Now only Group 4 alone skips decoding; Group 3 is stored again
as Group 4 when that is smaller as stored, and Retain still keeps it.

It reads an image's CCITT parameters (its /DecodeParms entry with Table
11's defaults) through pdfcraft_cos::Document::fax_params, from #4384.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/optimize/README.md         |  9 ++--
 crates/optimize/src/images.rs     | 17 ++++----
 crates/optimize/tests/optimize.rs | 72 +++++++++++++++++++++++++++++++
 parity/acrobat-features.toml      |  4 +-
 4 files changed, 88 insertions(+), 14 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 2c90981770..13aa82aadb 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -61,10 +61,11 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
     column. On a 600 ppi text page, Group 4 at 300 ppi is half the size.
   - **Compression:** CCITT Group 4 (`pdfcraft_filters::encode_g4`), or 1-bit Flate when that is
     smaller, which only a resampled image or one packed from eight bits may be: a 1-bit image that
-    is only stored again becomes Group 4 or stays. A CCITT image is only decoded to be resampled,
-    unless another filter such as `ASCII85Decode` wraps it, which storing it again drops. With Retain, a resampled image keeps its kind of
-    compression (CCITT, or Flate) and nothing else changes; eight-bit grey is then left to the grey
-    settings. Every change is kept only when it is smaller as stored.
+    is only stored again becomes Group 4 or stays. Group 4 alone is only decoded to be resampled;
+    Group 3, or Group 4 inside another filter such as `ASCII85Decode`, is stored again as Group 4
+    alone when that is smaller. With Retain, a resampled image keeps its kind of compression (CCITT,
+    or Flate) and nothing else changes; eight-bit grey is then left to the grey settings. Every
+    change is kept only when it is smaller as stored.
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
     space, decode array and `/Mask` stay. Group 4 wins on scans, whose ragged edges defeat Flate;
     on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, a lone Group 3 image to
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index bb768551d5..42c9a742c8 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -705,7 +705,8 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
 ///   covers more would turn its tones solid (a 50% screen black, a 25% one white).
 /// - **Stored** as CCITT Group 4 with `CcittG4`, or as 1-bit Flate when that is smaller, which only
 ///   a resampled image or one packed from eight bits may be: a 1-bit image that is only stored again
-///   becomes Group 4 or stays. With `Retain`, a resampled image keeps its kind of compression
+///   becomes Group 4 or stays. Group 4 alone is only decoded to be resampled; Group 3 is stored
+///   again like any other. With `Retain`, a resampled image keeps its kind of compression
 ///   (CCITT, or Flate), and nothing else changes: eight-bit grey stays a grey image like any
 ///   other, which the grey settings handle.
 ///
@@ -714,13 +715,13 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     let d = &s.dict;
     let downsample = settings.downsample && ppi.is_finite() && ppi > settings.above_ppi && settings.target_ppi > 0.0 && !d.contains(b"SMask");
     let retain = settings.compression == MonoCompression::Retain;
-    let chain = s.filters();
+    let fax = doc.fax_params(s);
     // Its kind of compression, which Retain keeps, behind any other filters.
-    let ccitt = matches!(chain.last(), Some((pdfcraft_filters::Filter::CcittFax, _)));
-    // A fax image is only worth decoding to resample it; behind ASCII85Decode, say, storing it
-    // again as Group 4 also drops that filter.
-    let fax_alone = ccitt && chain.len() == 1;
-    if (retain || fax_alone) && !downsample {
+    let ccitt = fax.is_some();
+    // Group 4 alone is only worth decoding to resample it. Group 3, or Group 4 behind
+    // ASCII85Decode, say, can be smaller stored again as Group 4 alone.
+    let g4_alone = fax.is_some_and(|p| p.k < 0) && s.filters().len() == 1;
+    if (retain || g4_alone) && !downsample {
         return None;
     }
     let (data, w, h, eight_bit) = one_bit(doc, s, !retain)?;
@@ -747,7 +748,7 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
         Some(out) => (out, nw, nh),
         None => (data, w, h),
     };
-    if (retain || fax_alone) && !resampled {
+    if (retain || g4_alone) && !resampled {
         return None;
     }
     let mut dict = d.clone();
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index f9676144c4..f1e5015761 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1116,6 +1116,78 @@ fn monochrome_images_keep_what_they_should() {
     assert_eq!((s.dict.int(b"Width"), s.dict.name(b"Filter")), (Some(600), Some(&b"FlateDecode"[..])), "Retain: Flate stays Flate: {r:?}");
 }
 
+/// `rows` coded as CCITT Group 3, one-dimensional (`/K 0`): each row its runs in turn, white first,
+/// with ITU-T T.4's terminating codes for the few lengths used here.
+fn group_3(rows: &[&[u32]]) -> Vec<u8> {
+    let code = |white: bool, run: u32| match (white, run) {
+        (true, 0) => "00110101",
+        (true, 8) => "10011",
+        (true, 16) => "101010",
+        (true, 32) => "00011011",
+        (false, 8) => "000101",
+        (false, 16) => "0000010111",
+        (false, 32) => "000001101010",
+        _ => panic!("no code here for a run of {run}"),
+    };
+    let bits: String = rows.iter().flat_map(|row| row.iter().enumerate().map(|(i, run)| code(i % 2 == 0, *run))).collect();
+    bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
+}
+
+/// A Group 3 fax image is stored again as Group 4 when that is smaller, the same picture (to the
+/// pixel on the page); with Retain it stays Group 3.
+#[test]
+fn group_3_fax_images_become_group_4() {
+    let (w, h) = (64u32, 64u32);
+    let runs: Vec<&[u32]> = [&[32, 32][..], &[16; 4], &[8; 8], &[0, 16, 16, 32]].into_iter().flat_map(|r| std::iter::repeat_n(r, 16)).collect();
+    // White is 1, as CCITTFaxDecode gives it without /BlackIs1.
+    let mut bits = Vec::new();
+    for row in &runs {
+        let mut packed = [0u8; 8];
+        let mut x = 0;
+        for (i, run) in row.iter().enumerate() {
+            for p in x..x + *run as usize {
+                if i % 2 == 0 {
+                    packed[p / 8] |= 0x80 >> (p % 8);
+                }
+            }
+            x += *run as usize;
+        }
+        bits.extend(packed);
+    }
+    let g3 = group_3(&runs);
+    let p = pdfcraft_filters::CcittParams { k: 0, columns: w.into(), ..Default::default() };
+    assert_eq!(pdfcraft_filters::decode_ccitt(&g3, &p, h).unwrap(), bits, "the Group 3 data is the picture");
+
+    let mut doc = Document::new_empty();
+    let mut d = Dict::new();
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w.into()));
+    d.set(b"Height".to_vec(), Object::Int(h.into()));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+    let mut parms = Dict::new();
+    parms.set(b"K".to_vec(), Object::Int(0));
+    parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+    parms.set(b"Rows".to_vec(), Object::Int(h.into()));
+    d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+    let fax = doc.add(Object::Stream(Stream::from_raw(d, g3.clone())));
+    page(&mut doc, &[("A", fax)], "q 64 0 0 64 100 600 cm /A Do Q");
+    let before = render(&doc);
+
+    let mut kept = doc.clone();
+    optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
+    assert_eq!(stream(&kept, fax).raw[..], g3[..], "Retain keeps Group 3");
+
+    let r = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!((r.images_resampled, r.images_recompressed), (0, 1), "{r:?}");
+    let s = stream(&doc, fax);
+    assert_eq!(doc.fax_params(&s).map(|p| p.k), Some(-1), "Group 4");
+    assert!(s.raw.len() < g3.len(), "{} bytes, from {}", s.raw.len(), g3.len());
+    assert_eq!(doc.decoded_image(&s).unwrap(), bits, "the same picture");
+    assert!(render(&doc) == before, "the page looks the same");
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index ea60fc2857..ecadea7b64 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7384,8 +7384,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
-evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), a lone Group 3 image to Group 4 without resampling (one behind another filter is stored again as Group 4; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From bd5693679564017e5ec529430000c0d51010877b Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:19:30 +0100
Subject: [PATCH 190/270] M11: redaction reads an image mask's /Decode given by
 reference

Redaction clears an image mask's covered samples to the value that
paints nothing, which an inverting /Decode [1 0] flips. It read the
array only when direct, so given by reference (or with its first number
so) the cleared samples painted instead: the covered area came out
inked. That was already so on main, and this PR sends CCITT masks
through it. The array and its first number are resolved now, as export
and the optimizer read them; the fax test covers all three forms.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/redact/src/image.rs |  5 ++++-
 crates/redact/src/tests.rs | 17 ++++++++++++++++-
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index 6568e8015a..a1bf022df1 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -104,7 +104,10 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     data.truncate(bytes);
     // Image masks: a sample of 0 paints unless /Decode is [1 0]; cleared samples must not paint.
     let clear_bit = if mask {
-        let inverted = s.dict.get(b"Decode").and_then(Object::as_array).and_then(|d| d.first()).and_then(Object::as_f64) == Some(1.0);
+        // The array, and its first number, given by reference too.
+        let decode = s.dict.get(b"Decode").map(|d| doc.resolve(d));
+        let first = decode.as_deref().and_then(Object::as_array).and_then(|d| d.first()).map(|v| doc.resolve(v));
+        let inverted = first.as_deref().and_then(Object::as_f64) == Some(1.0);
         !inverted
     } else {
         false
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index 9400391bb5..c6885eaf11 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -579,7 +579,8 @@ fn an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared(
 
 /// A CCITT fax image (a scan the optimizer or Create PDF stored as Group 4) has its covered
 /// pixels cleared in a copy, like any image PdfCraft can decode, instead of being removed whole:
-/// whether it sits behind another filter, with its parameters given by reference, or is a mask.
+/// whether it sits behind another filter, with its parameters given by reference, or is a mask,
+/// its decode array inverting it given directly, by reference or with its first number so.
 #[test]
 fn a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed() {
     // 16 × 2, all 1 bits (white), or all 0 bits (a mask painting everywhere); the left half of
@@ -599,6 +600,20 @@ fn a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed() {
         ),
         // A mask's 0 bits paint: cleared bits are set to 1, which paints nothing.
         (format!("{image} /ImageMask true /Filter /CCITTFaxDecode /DecodeParms {parms}"), painted, vec![], [0xFF, 0x00, 0x00, 0x00]),
+        // With /Decode [1 0] a mask's 1 bits paint, and cleared bits are 0.
+        (format!("{image} /ImageMask true /Decode [1 0] /Filter /CCITTFaxDecode /DecodeParms {parms}"), g4.clone(), vec![], [0x00, 0xFF, 0xFF, 0xFF]),
+        (
+            format!("{image} /ImageMask true /Decode 8 0 R /Filter /CCITTFaxDecode /DecodeParms {parms}"),
+            g4.clone(),
+            vec![b"[1 0]".to_vec()],
+            [0x00, 0xFF, 0xFF, 0xFF],
+        ),
+        (
+            format!("{image} /ImageMask true /Decode [8 0 R 0] /Filter /CCITTFaxDecode /DecodeParms {parms}"),
+            g4.clone(),
+            vec![b"1".to_vec()],
+            [0x00, 0xFF, 0xFF, 0xFF],
+        ),
     ] {
         let mut objs = vec![stream(&dict, data)];
         objs.extend(extra);

From 76236edf1e56caa51eb012e86cc2513593ff5df7 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 10:10:21 +0200
Subject: [PATCH 191/270] M11: the optimizer packs black-and-white RGB and
 indexed images to one bit

Monochrome Images only took eight-bit grey of only black and white
besides 1-bit images, so the same scan written as RGB, or as an indexed
image of two palette entries, stayed at eight bits (and RGB went to the
colour settings, as JPEG). Now these are packed to one bit first:

- eight-bit DeviceRGB whose every pixel is black or white becomes
  DeviceGray; a decode array the same for each component becomes that
  pair, another stops it. Calibrated RGB and RGB with a profile stay.
- an indexed image of 2, 4 or 8 bits that uses only palette entries 0
  and 1 keeps its palette, whatever the two colours; a decode array
  other than the default stops it.

Colour-key masks still stop all of them, and Retain leaves them to the
grey and colour settings. They are decoded through /DecodeParms given
by reference too (Document::with_direct_parms), and when downsampled a
tie goes to the dark sample of the image as packed: packed RGB is grey,
with grey's decode pair.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 ROADMAP.md                        |   1 +
 crates/optimize/README.md         |  14 +-
 crates/optimize/src/images.rs     | 164 +++++++++++++++++------
 crates/optimize/tests/optimize.rs | 208 ++++++++++++++++++++++++++----
 docs/roadmap.md                   |   2 +
 parity/acrobat-features.toml      |   6 +-
 6 files changed, 326 insertions(+), 69 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index baae83997d..5a441aa553 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,6 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
+- **2026-10-24 (M11, more black-and-white images):** The optimizer re-stores Group 3 fax images as Group 4 when that is smaller, instead of leaving any CCITT image it doesn't resample as it is. Black-and-white images stored as eight-bit RGB (as some phone and scanner apps write them) become one-bit grey, and indexed images that use only their first two palette entries become one bit with their palette, so Monochrome Images compresses and downsamples them too.
 - **2026-10-24 (M11, monochrome downsampling):** The PDF Optimizer and Reduce File Size average black-and-white images above 450 ppi down to 300 ppi (Monochrome Images ▸ Downsample to), Group 4 scans included, so a 600 ppi text page goes from 79 KB to 40 KB. CCITT decoding moved into `pdfcraft-filters` (`decode_ccitt`), shared by Export ▸ Images and the optimizer through `Document::decoded_image`.
 - **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller, as they can a dithered scan, soft mask counted, and Export ▸ Images reads CCITT fax images.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 13aa82aadb..0b159229a0 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -43,12 +43,14 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   or with CCITT fax after any of those (decoded by `Document::decoded_image_within`, no further
   than its rows can need; byte-aligned Group 3 with end-of-line codes but none before the first
   row, not as T.4 sends them, is read as PdfCraft draws it, which at `/K 0` may be other rows than
-  were coded, and an image resampled, or stored again as Group 4 from behind another filter,
-  keeps them), and an eight-bit grey image of
-  only 0 and 255, packed to one bit (not an indexed image, whose samples are palette indices, nor
-  one with a colour-key `/Mask`) unless the grey settings make it smaller still, its soft mask counted
-  (resampled with it there, kept as it is here), as they can a dithered scan by downsampling it to
-  JPEG.
+  were coded, and an image stored again keeps them). Packed to one bit first, unless a colour-key `/Mask` is in the image's
+  own values: eight-bit grey of only 0 and 255; eight-bit `DeviceRGB` of only black and white,
+  which becomes `DeviceGray` (not calibrated RGB or RGB with a profile); and an indexed image of 2,
+  4 or 8 bits that uses only palette entries 0 and 1, which keeps its palette, whatever its two
+  colours. A decode array stays when it means the same at one bit (grey's, or RGB's if the same
+  for each component, as grey's); otherwise the image is left alone. The grey or colour settings
+  take a packed image instead when they make it smaller still, its soft mask counted (resampled
+  with it there, kept as it is here), as they can a dithered scan by downsampling it to JPEG.
   - **Downsampling:** one whose effective resolution is above `above_ppi` is averaged down to
     `target_ppi`: each new pixel takes the sample covering more of its area, and the dark one on a
     tie, so a dark line half a new pixel wide stays: black in grey and the painted part of an image
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 42c9a742c8..8b55d4aeb2 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -562,14 +562,26 @@ fn one_component(doc: &Document, cs: &Object) -> bool {
     }
 }
 
+/// A pixel's samples as a 1 or a 0, or `None` for a colour that is neither.
+type Pixel = fn(&[u8]) -> Option<bool>;
+
 /// The samples of a black-and-white image, as rows of 1-bit samples each starting on a new byte,
-/// with its width and height, and whether they were packed from eight bits. Two kinds count:
+/// with its width and height, and, when they were packed from more bits, its dictionary as a 1-bit
+/// image. These count:
 /// - one bit per pixel in one colour component, or an image mask, stored with no filter, with
-///   general-purpose ones, or with CCITT fax last ([`Document::decoded_image_within`], no further than its rows can need);
-/// - with `eight_bit`, eight-bit grey whose every sample is 0 or 255. A decode array maps 0 and 255
-///   at eight bits as it maps 0 and 1 at one bit, so it stays. Left out: indexed images (their
-///   samples are palette indices) and a colour-key `/Mask` (its ranges are in eight-bit values).
-fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32, u32, bool)> {
+///   general-purpose ones, or with CCITT fax last ([`Document::decoded_image_within`], no further
+///   than its rows can need);
+/// - with `pack`, and with no colour-key `/Mask` (its ranges are in the image's own values):
+///   - eight-bit grey (one component, not indexed) whose every sample is 0 or 255. A decode array
+///     maps 0 and 255 at eight bits as it maps 0 and 1 at one bit, so it stays;
+///   - eight-bit `DeviceRGB` whose every pixel is black or white, which becomes `DeviceGray`. A
+///     decode array the same for all three components becomes that one pair; another stops it.
+///     Calibrated RGB and RGB with a profile are left out, as the profile could make them other
+///     than black and white;
+///   - an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1, which stay 0 and
+///     1 at one bit, whatever their colours, so the colour space stays. A decode array other than
+///     the default stops it: in index units it would mean something else at one bit.
+fn one_bit(doc: &Document, s: &Stream, pack: bool) -> Option<(Vec<u8>, u32, u32, Option<Dict>)> {
     let d = &s.dict;
     // Through u32 first, as everywhere here, so the product can't overflow.
     let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
@@ -593,33 +605,92 @@ fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32,
             return None;
         }
         data.truncate(len);
-        return Some((data, w, h, false));
+        return Some((data, w, h, None));
     }
-    let indexed = |cs: &Object| match &*doc.resolve(cs) {
-        Object::Array(a) => matches!(a.first().and_then(Object::as_name), Some(b"Indexed" | b"I")),
-        _ => false,
-    };
     let colour_key = d.get(b"Mask").is_some_and(|m| doc.resolve(m).as_array().is_some());
-    if !eight_bit || bits != Some(8) || mask || colour_key || !d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs) && !indexed(cs)) {
+    if !pack || mask || colour_key {
         return None;
     }
-    // Through its parameters given by reference too: without a PNG predictor's tag bytes taken
-    // off, rows of 0 and 255 would still pass below, each shifted by a byte.
-    let samples = doc.with_direct_parms(s).decoded_within(allowance(wu.checked_mul(hu)?, h)?).ok()?;
-    let samples = samples.get(..wu.checked_mul(hu)?)?;
-    let mut packed = vec![0u8; stride.checked_mul(hu)?];
-    for (i, v) in samples.iter().enumerate() {
-        match v {
-            0 => {}
-            255 => {
-                if let Some(b) = packed.get_mut((i / wu) * stride + (i % wu) / 8) {
-                    *b |= 0x80 >> (i % wu % 8);
+    let cs = d.get(b"ColorSpace")?;
+    let decode = d.get(b"Decode").map(|v| doc.resolve(v));
+    let mut packed = d.clone();
+    packed.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    // Components a pixel, bits a component, and a pixel's samples as 1 or 0.
+    let (n, bpc, white): (usize, usize, Pixel) = match &*doc.resolve(cs) {
+        Object::Array(a) if matches!(a.first().and_then(Object::as_name), Some(b"Indexed" | b"I")) => {
+            let bpc = bits.filter(|b| matches!(b, 2 | 4 | 8))?;
+            match decode.as_deref() {
+                None => {}
+                Some(Object::Array(v)) if v[..] == [Object::Int(0), Object::Int((1 << bpc) - 1)] => {
+                    packed.remove(b"Decode");
                 }
+                Some(_) => return None,
+            }
+            (1, usize::try_from(bpc).ok()?, |v| match v {
+                [0] => Some(false),
+                [1] => Some(true),
+                _ => None,
+            })
+        }
+        Object::Name(name) if matches!(name.as_slice(), b"DeviceRGB" | b"RGB") && bits == Some(8) => {
+            match decode.as_deref() {
+                None => {}
+                Some(Object::Array(v)) if v.len() == 6 && v.chunks(2).all(|pair| Some(pair) == v.get(..2)) => {
+                    packed.set(b"Decode".to_vec(), Object::Array(v.get(..2)?.to_vec()));
+                }
+                Some(_) => return None,
+            }
+            packed.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+            (3, 8, |v| match v {
+                [0, 0, 0] => Some(false),
+                [255, 255, 255] => Some(true),
+                _ => None,
+            })
+        }
+        _ if bits == Some(8) && one_component(doc, cs) => (1, 8, |v| match v {
+            [0] => Some(false),
+            [255] => Some(true),
+            _ => None,
+        }),
+        _ => return None,
+    };
+    let row_len = wu.checked_mul(n)?.checked_mul(bpc)?.div_ceil(8);
+    // Through its parameters given by reference too: without a PNG predictor's tag bytes taken
+    // off, rows of 0 and 255 (or palette entries 0 and 1) would still pass below, each shifted.
+    let samples = doc.with_direct_parms(s).decoded_within(allowance(row_len.checked_mul(hu)?, h)?).ok()?;
+    Some((packed_rows(&samples, row_len, wu, hu, (n, bpc, white))?, w, h, Some(packed)))
+}
+
+/// `h` rows of `w` pixels, each row `row_len` bytes of `n` samples a pixel at `bpc` bits (8, or
+/// a divisor of 8 with `n` 1), as rows of 1-bit samples each starting on a new byte: 1 where
+/// `white` says the pixel is white. `None` when a pixel is neither, `samples` is short, or the
+/// rows have another shape: no pixels in a row, other sample sizes, or too few bytes for their
+/// pixels.
+fn packed_rows(samples: &[u8], row_len: usize, w: usize, h: usize, (n, bpc, white): (usize, usize, Pixel)) -> Option<Vec<u8>> {
+    let stride = w.div_ceil(8);
+    let shape = (n > 0 && bpc == 8) || (n == 1 && matches!(bpc, 1 | 2 | 4));
+    if stride == 0 || !shape || row_len < w.checked_mul(n)?.checked_mul(bpc)?.div_ceil(8) {
+        return None;
+    }
+    // From here no row is empty and x·n·bpc stays within one, and the output is no larger than
+    // the samples it is read from.
+    let samples = samples.get(..row_len.checked_mul(h)?)?;
+    let mut out = vec![0u8; stride.checked_mul(h)?];
+    for (row, out_row) in samples.chunks(row_len).zip(out.chunks_mut(stride)) {
+        for x in 0..w {
+            let on = if bpc == 8 {
+                white(row.get(x * n..x * n + n)?)?
+            } else {
+                // Samples narrower than a byte, the first in its high bits; bpc divides 8.
+                let at = x * bpc;
+                white(&[(row.get(at / 8)? >> (8 - bpc - at % 8)) & ((1u8 << bpc) - 1)])?
+            };
+            if on {
+                *out_row.get_mut(x / 8)? |= 0x80 >> (x % 8);
             }
-            _ => return None,
         }
     }
-    Some((packed, w, h, true))
+    Some(out)
 }
 
 /// Whether sample 1 is the dark one of the 1-bit image `d` describes, after its decode array
@@ -704,13 +775,14 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
 ///   dither: most of its new pixels would cover both black and white, and taking the sample that
 ///   covers more would turn its tones solid (a 50% screen black, a 25% one white).
 /// - **Stored** as CCITT Group 4 with `CcittG4`, or as 1-bit Flate when that is smaller, which only
-///   a resampled image or one packed from eight bits may be: a 1-bit image that is only stored again
+///   a resampled image or one packed from more bits may be: a 1-bit image that is only stored again
 ///   becomes Group 4 or stays. Group 4 alone is only decoded to be resampled; Group 3 is stored
 ///   again like any other. With `Retain`, a resampled image keeps its kind of compression
-///   (CCITT, or Flate), and nothing else changes: eight-bit grey stays a grey image like any
-///   other, which the grey settings handle.
+///   (CCITT, or Flate), and nothing else changes: an image of more bits stays as it is, for the
+///   grey or colour settings.
 ///
-/// The samples keep their meaning, so the colour space, decode array and `/Mask` stay as they are.
+/// The samples keep their meaning, so the decode array and `/Mask` stay as they are, and the
+/// colour space too, but for black-and-white RGB, which becomes grey.
 fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option<(Stream, bool)> {
     let d = &s.dict;
     let downsample = settings.downsample && ppi.is_finite() && ppi > settings.above_ppi && settings.target_ppi > 0.0 && !d.contains(b"SMask");
@@ -724,7 +796,8 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     if (retain || g4_alone) && !downsample {
         return None;
     }
-    let (data, w, h, eight_bit) = one_bit(doc, s, !retain)?;
+    let (data, w, h, packed) = one_bit(doc, s, !retain)?;
+    let packed_from_more = packed.is_some();
     let k = settings.target_ppi / ppi;
     // `downsample_bits` keeps a counter for each column: no more columns than a fax row may have,
     // so a hostile strip of 80 million can't make it 640 MB.
@@ -736,7 +809,8 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
         (w, h)
     };
     let averaged = if (nw, nh) != (w, h) {
-        let (out, mixed) = downsample_bits(&data, w, h, nw, nh, dark_is_one(doc, d))?;
+        // The dark sample of the image as it ends up: packed RGB is grey, with grey's decode pair.
+        let (out, mixed) = downsample_bits(&data, w, h, nw, nh, dark_is_one(doc, packed.as_ref().unwrap_or(d)))?;
         // A halftone or dither: most new pixels cover both samples. Text covers both only along
         // its edges.
         (mixed.saturating_mul(2) <= u64::from(nw) * u64::from(nh)).then_some(out)
@@ -751,15 +825,12 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     if (retain || g4_alone) && !resampled {
         return None;
     }
-    let mut dict = d.clone();
+    let mut dict = packed.unwrap_or_else(|| d.clone());
     for key in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
         dict.remove(key);
     }
     dict.set(b"Width".to_vec(), Object::Int(i64::from(nw)));
     dict.set(b"Height".to_vec(), Object::Int(i64::from(nh)));
-    if eight_bit {
-        dict.set(b"BitsPerComponent".to_vec(), Object::Int(1));
-    }
     let g4 = if settings.compression == MonoCompression::CcittG4 || (retain && ccitt) {
         pdfcraft_filters::encode_g4(&data, nw, nh).ok().map(|coded| {
             let mut dict = dict.clone();
@@ -774,7 +845,7 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     } else {
         None
     };
-    let flate = ((resampled || eight_bit) && !(retain && ccitt)).then(|| Stream::flate(dict, &data));
+    let flate = ((resampled || packed_from_more) && !(retain && ccitt)).then(|| Stream::flate(dict, &data));
     // Smaller as stored, counting the dictionary: a tiny image can lose by Group 4's parameters.
     let best = [g4, flate].into_iter().flatten().filter_map(|c| Some((crate::stored_len(&c)?, c))).min_by_key(|(len, _)| *len)?;
     (best.0 < crate::stored_len(s)?).then_some((best.1, resampled))
@@ -1033,3 +1104,24 @@ mod downsample_tests {
         }
     }
 }
+
+#[cfg(test)]
+mod pack_tests {
+    use super::{Pixel, packed_rows};
+
+    /// Rows of one pixel of one bit, 1 white: each packed as it is.
+    const WHITE_IS_1: Pixel = |v| Some(v == [1]);
+
+    /// [`packed_rows`] packs rows it can read whole, and refuses any other shape, without reading
+    /// past a row or allocating more than its samples: no pixels in a row, no components, samples
+    /// of 3 bits, several components under 8 bits, rows shorter than their pixels, and a width far
+    /// past the samples.
+    #[test]
+    fn packed_rows_refuses_rows_it_cannot_read_whole() {
+        let samples = [0x80, 0x00, 0x80, 0x00];
+        assert_eq!(packed_rows(&samples, 1, 1, 4, (1, 1, WHITE_IS_1)), Some(vec![0x80, 0x00, 0x80, 0x00]));
+        for (row_len, w, n, bpc) in [(1, 0, 1, 1), (1, 1, 0, 8), (1, 1, 1, 3), (1, 1, 2, 4), (1, 9, 1, 1), (1, usize::MAX / 8, 1, 1)] {
+            assert_eq!(packed_rows(&samples, row_len, w, 4, (n, bpc, WHITE_IS_1)), None, "row of {row_len} for {w} × {n} × {bpc}");
+        }
+    }
+}
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index f1e5015761..cc8f2f4683 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -486,9 +486,10 @@ fn group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit() {
 /// (`/Predictor 9 0 R`, which `Dict::int` doesn't follow), is read through them, as one with them
 /// direct: a predictor's tag bytes would otherwise shift every row, and the image would be stored
 /// again wrong. Here a 1-bit image with a PNG predictor (stored again as Group 4), an eight-bit
-/// grey one with a PNG predictor at 600 ppi (resampled), and an eight-bit one of only black and
-/// white with PNG predictor 10 (each row's tag a 0, so the shifted rows would still be black and
-/// white; packed to one bit) come out byte for byte as with direct parameters.
+/// grey one with a PNG predictor at 600 ppi (resampled), an eight-bit one of only black and white
+/// with PNG predictor 10 (each row's tag a 0, so the shifted rows would still be black and white;
+/// packed to one bit), and a two-entry indexed one the same way come out byte for byte as with
+/// direct parameters.
 #[test]
 fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
     let build = |how: &str| {
@@ -519,8 +520,21 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
         parms.set(b"Columns".to_vec(), Object::Int(w as i64));
         d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
         let black_and_white = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &black_and_white_samples).unwrap();
-        let packed = doc.add(Object::Stream(Stream::from_raw(d, black_and_white)));
-        for r in [one_bit, eight_bit, packed] {
+        let packed = doc.add(Object::Stream(Stream::from_raw(d.clone(), black_and_white)));
+        let palette = vec![0, 0, 255, 255, 255, 255];
+        d.set(
+            b"ColorSpace".to_vec(),
+            Object::Array(vec![
+                Object::name("Indexed"),
+                Object::name("DeviceRGB"),
+                1.into(),
+                Object::String(pdfcraft_cos::PdfString::literal(palette)),
+            ]),
+        );
+        let entries = samples_of(&bilevel(w, h, false), w, h, [&[0], &[1]], 8);
+        let entries = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &entries).unwrap();
+        let indexed = doc.add(Object::Stream(Stream::from_raw(d, entries)));
+        for r in [one_bit, eight_bit, packed, indexed] {
             let mut s = stream(&doc, r);
             let Some(Object::Dict(mut parms)) = s.dict.get(b"DecodeParms").cloned() else { panic!("{:?}", s.dict) };
             let made = match how {
@@ -540,16 +554,19 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
         // 300 × 120 pt is 288 ppi; 144 × 57.6 pt is 600 ppi.
         page(
             &mut doc,
-            &[("A", one_bit), ("B", eight_bit), ("C", packed)],
-            "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q q 300 0 0 120 20 200 cm /C Do Q",
+            &[("A", one_bit), ("B", eight_bit), ("C", packed), ("D", indexed)],
+            "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q q 300 0 0 120 20 200 cm /C Do Q \
+             q 280 0 0 112 325 200 cm /D Do Q",
         );
-        let before = [one_bit, eight_bit, packed].map(|r| stream(&doc, r).raw);
+        let before = [one_bit, eight_bit, packed, indexed].map(|r| stream(&doc, r).raw);
         let r = optimize(&mut doc, &Settings::default()).unwrap();
-        assert_eq!((r.images_resampled, r.images_recompressed), (1, 2), "{r:?}");
-        let after = [one_bit, eight_bit, packed].map(|r| stream(&doc, r));
+        assert_eq!((r.images_resampled, r.images_recompressed), (1, 3), "{r:?}");
+        let after = [one_bit, eight_bit, packed, indexed].map(|r| stream(&doc, r));
         assert!(before.iter().zip(&after).all(|(b, a)| *b != a.raw), "all stored again");
         assert_eq!(after[0].dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]));
-        assert_eq!((after[2].dict.int(b"BitsPerComponent"), after[2].dict.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])));
+        for s in &after[2..] {
+            assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])));
+        }
         after.map(|s| s.raw)
     };
     let direct = build("direct");
@@ -788,15 +805,129 @@ fn eight_bit_black_and_white_images_become_one_bit() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// `bits` (1-bit rows) with each 0 as `values[0]` and each 1 as `values[1]`, at `bpc` bits a sample
+/// (each row starting on a new byte).
+fn samples_of(bits: &[u8], w: u32, h: u32, values: [&[u8]; 2], bpc: usize) -> Vec<u8> {
+    let (w, h) = (w as usize, h as usize);
+    let stride = w.div_ceil(8);
+    let mut out = Vec::new();
+    for y in 0..h {
+        let row: Vec<u8> = (0..w).flat_map(|x| values[usize::from(bits[y * stride + x / 8] & (0x80 >> (x % 8)) != 0)].iter().copied()).collect();
+        let mut packed = vec![0u8; (row.len() * bpc).div_ceil(8)];
+        for (i, s) in row.iter().enumerate() {
+            packed[i * bpc / 8] |= if bpc == 8 { *s } else { s << (8 - bpc - i * bpc % 8) };
+        }
+        out.extend(packed);
+    }
+    out
+}
+
+/// Eight-bit RGB of only black and white becomes one-bit grey, and an indexed image that uses only
+/// palette entries 0 and 1 becomes one bit with its palette (here blue and white), at 8 bits or 4,
+/// both as Group 4 and losslessly: the page looks the same to the pixel. An RGB decode array the
+/// same for each component becomes grey's, and an indexed image's default one goes. Not touched:
+/// RGB with any other colour, a decode array that differs between components, a colour-key mask or
+/// calibrated RGB; an indexed image that uses a third entry or has another decode array; and
+/// everything with `mono: Retain`.
+#[test]
+fn rgb_and_two_colour_indexed_black_and_white_images_become_one_bit() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200u32, 480u32);
+    let text = bilevel(w, h, false);
+    let image = |doc: &mut Document, data: &[u8], bpc: i64, cs: Object, entries: &[(&str, Object)]| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(bpc));
+        d.set(b"ColorSpace".to_vec(), cs);
+        for (k, v) in entries {
+            d.set(k.as_bytes().to_vec(), v.clone());
+        }
+        doc.add(Object::Stream(Stream::flate(d, data)))
+    };
+    let rgb_cs = Object::name("DeviceRGB");
+    let rgb_data = samples_of(&text, w, h, [&[0, 0, 0], &[255, 255, 255]], 8);
+    let rgb = image(&mut doc, &rgb_data, 8, rgb_cs.clone(), &[]);
+    let pairs = |p: [i64; 6]| Object::Array(p.into_iter().map(Object::Int).collect());
+    let rgb_inverted = image(&mut doc, &rgb_data, 8, rgb_cs.clone(), &[("Decode", pairs([1, 0, 1, 0, 1, 0]))]);
+    let rgb_mixed = image(&mut doc, &rgb_data, 8, rgb_cs.clone(), &[("Decode", pairs([1, 0, 0, 1, 0, 1]))]);
+    let mut red = rgb_data.clone();
+    red[3000..3003].copy_from_slice(&[255, 0, 0]);
+    let rgb_red = image(&mut doc, &red, 8, rgb_cs.clone(), &[]);
+    let mut white_point = Dict::new();
+    white_point.set(b"WhitePoint".to_vec(), Object::Array(vec![Object::Real(0.9505), 1.into(), Object::Real(1.089)]));
+    let cal_rgb = image(&mut doc, &rgb_data, 8, Object::Array(vec![Object::name("CalRGB"), Object::Dict(white_point)]), &[]);
+    let rgb_keyed = image(&mut doc, &rgb_data, 8, rgb_cs, &[("Mask", pairs([0, 0, 0, 0, 0, 0]))]);
+    let palette = |entries: &[u8]| {
+        Object::Array(vec![
+            Object::name("Indexed"),
+            Object::name("DeviceRGB"),
+            (entries.len() as i64 / 3 - 1).into(),
+            Object::String(pdfcraft_cos::PdfString::literal(entries.to_vec())),
+        ])
+    };
+    let blue_white = palette(&[0, 0, 255, 255, 255, 255]);
+    let indices = samples_of(&text, w, h, [&[0], &[1]], 8);
+    let blue = image(&mut doc, &indices, 8, blue_white.clone(), &[]);
+    let default_decode = Object::Array(vec![0.into(), 255.into()]);
+    let blue_decoded = image(&mut doc, &indices, 8, blue_white.clone(), &[("Decode", default_decode)]);
+    let blue_4 = image(&mut doc, &samples_of(&text, w, h, [&[0], &[1]], 4), 4, blue_white.clone(), &[]);
+    let mut third = indices.clone();
+    third[3000] = 2;
+    let three = image(&mut doc, &third, 8, palette(&[0, 0, 255, 255, 255, 255, 255, 0, 0]), &[]);
+    let other_decode = image(&mut doc, &indices, 8, blue_white.clone(), &[("Decode", Object::Array(vec![0.into(), 1.into()]))]);
+    let all = [rgb, rgb_inverted, rgb_mixed, rgb_red, cal_rgb, rgb_keyed, blue, blue_decoded, blue_4, three, other_decode];
+    // 200 × 80 pt is 432 ppi: below where monochrome downsampling starts.
+    let names: Vec<String> = (0..all.len()).map(|i| format!("Im{i}")).collect();
+    let content: String =
+        (0..all.len()).map(|i| format!("q 200 0 0 80 {} {} cm /Im{i} Do Q ", 6 + 200 * (i % 3), 690 - 100 * (i / 3) as i64)).collect();
+    page(&mut doc, &names.iter().map(String::as_str).zip(all).collect::<Vec<_>>(), &content);
+    let before = render(&doc);
+    let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
+    // Colour and grey settings that leave images alone, so only this conversion acts.
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    let settings = Settings { color: keep, gray: keep, ..Settings::default() };
+
+    let mut kept = doc.clone();
+    let r = optimize(&mut kept, &Settings { mono: RETAIN, ..settings.clone() }).unwrap();
+    assert_eq!((r.images_resampled, r.images_recompressed), (0, 0), "Retain keeps every image as it is");
+
+    let untouched = [rgb_mixed, rgb_red, cal_rgb, rgb_keyed, three, other_decode].map(|r| raw(&doc, r));
+    let r = optimize(&mut doc, &settings).unwrap();
+    assert_eq!((r.images_resampled, r.images_recompressed), (0, 5), "{r:?}");
+    for (i, cs) in [
+        (rgb, Object::name("DeviceGray")),
+        (rgb_inverted, Object::name("DeviceGray")),
+        (blue, blue_white.clone()),
+        (blue_decoded, blue_white.clone()),
+        (blue_4, blue_white),
+    ] {
+        let s = stream(&doc, i);
+        assert_eq!(
+            (s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter"), s.dict.get(b"ColorSpace")),
+            (Some(1), Some(&b"CCITTFaxDecode"[..]), Some(&cs)),
+            "{i:?}"
+        );
+        assert_eq!(doc.decoded_image(&s).unwrap(), text, "{i:?}");
+        let decode = if i == rgb_inverted { Some(Object::Array(vec![1.into(), 0.into()])) } else { None };
+        assert_eq!(s.dict.get(b"Decode").cloned(), decode, "{i:?}");
+    }
+    assert_eq!([rgb_mixed, rgb_red, cal_rgb, rgb_keyed, three, other_decode].map(|r| raw(&doc, r)), untouched);
+    assert!(render(&doc) == before, "the page looks the same");
+}
+
 /// Black-and-white images above 450 ppi are averaged down to 300 ppi, by default: 1-bit Flate, CCITT
-/// Group 4 (alone and behind ASCIIHexDecode), an image mask (its inverting decode array stays) and
-/// eight-bit grey of only black and white, all drawn at 600 ppi, are stored at half the size (as
+/// Group 4 (alone and behind ASCIIHexDecode), an image mask (its inverting decode array stays), and
+/// eight-bit grey and RGB of only black and white (the RGB also the other way round, with a decode
+/// array that inverts it, so its ties are 1s), all drawn at 600 ppi, are stored at half the size (as
 /// Group 4, or 1-bit Flate when that is smaller, as it is on this clean text), each new pixel the
 /// majority of the 2 × 2 it covers (a tie black, or for the mask painted). Left at their size: an image at 400 ppi (stored
 /// again as Group 4), a Group 4 one at 400 ppi (not even decoded), one behind ASCIIHexDecode at
 /// 400 ppi (stored again as Group 4 alone), and one with a soft mask. The page looks the same at
 /// screen size. With `downsample` off nothing is resampled; with Retain, Flate stays Flate, CCITT
-/// stays CCITT, and eight-bit grey is left to the grey settings.
+/// stays CCITT, and eight-bit grey and RGB are left to the grey and colour settings.
 #[test]
 fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     let mut doc = Document::new_empty();
@@ -842,7 +973,11 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     d.set(b"Height".to_vec(), Object::Int(h.into()));
     d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
     d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
-    let eight = doc.add(Object::Stream(Stream::flate(d, &eight_bit(&text, w, h))));
+    let eight = doc.add(Object::Stream(Stream::flate(d.clone(), &eight_bit(&text, w, h))));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+    let rgb = doc.add(Object::Stream(Stream::flate(d.clone(), &samples_of(&text, w, h, [&[0, 0, 0], &[255, 255, 255]], 8))));
+    d.set(b"Decode".to_vec(), Object::Array([1, 0, 1, 0, 1, 0].map(Object::Int).to_vec()));
+    let rgb_inverted = doc.add(Object::Stream(Stream::flate(d, &samples_of(&text, w, h, [&[255, 255, 255], &[0, 0, 0]], 8))));
     let at_400 = mono_image(&mut doc, w, h, &text, None, &grey);
     let fax_at_400 = g4(&mut doc, &grey);
     let mut sm = Dict::new();
@@ -856,10 +991,23 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     // 144 × 57.6 pt is 2 × 0.8 in: 600 ppi. 216 × 86.4 pt is 400 ppi.
     page(
         &mut doc,
-        &[("A", flate), ("B", fax), ("C", mask), ("D", eight), ("E", at_400), ("F", fax_at_400), ("G", soft), ("H", hex_fax), ("I", hex_at_400)],
+        &[
+            ("A", flate),
+            ("B", fax),
+            ("C", mask),
+            ("D", eight),
+            ("E", at_400),
+            ("F", fax_at_400),
+            ("G", soft),
+            ("H", hex_fax),
+            ("I", hex_at_400),
+            ("J", rgb),
+            ("K", rgb_inverted),
+        ],
         "q 144 0 0 57.6 20 700 cm /A Do Q q 144 0 0 57.6 200 700 cm /B Do Q q 0 0 1 rg 144 0 0 57.6 380 700 cm /C Do Q \
          q 144 0 0 57.6 20 600 cm /D Do Q q 216 0 0 86.4 200 580 cm /E Do Q q 216 0 0 86.4 20 480 cm /F Do Q \
-         q 144 0 0 57.6 260 480 cm /G Do Q q 144 0 0 57.6 430 600 cm /H Do Q q 216 0 0 86.4 20 360 cm /I Do Q",
+         q 144 0 0 57.6 260 480 cm /G Do Q q 144 0 0 57.6 430 600 cm /H Do Q q 216 0 0 86.4 20 360 cm /I Do Q q 144 0 0 57.6 260 380 cm /J Do Q \
+         q 144 0 0 57.6 430 480 cm /K Do Q",
     );
     let before = render(&doc);
     let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
@@ -886,17 +1034,19 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     let (halved, halved_mask) = (halve(false), halve(true));
     assert_ne!(halved, halved_mask, "the picture has ties");
 
-    // The grey settings left alone too: an eight-bit image would otherwise take them when smaller.
+    // The grey and colour settings left alone too: an image of more bits would otherwise take
+    // them when smaller.
     let mut off = doc.clone();
     let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
     let mono = MonoSettings { downsample: false, ..MonoSettings::REDUCE };
-    let r = optimize(&mut off, &Settings { mono, gray: keep, ..Settings::default() }).unwrap();
+    let r = optimize(&mut off, &Settings { mono, gray: keep, color: keep, ..Settings::default() }).unwrap();
     assert_eq!(r.images_resampled, 0, "{r:?}");
-    assert!([flate, fax, mask, eight, hex_fax].iter().all(|i| size(&off, *i) == (1200, 480)));
+    assert!([flate, fax, mask, eight, hex_fax, rgb, rgb_inverted].iter().all(|i| size(&off, *i) == (1200, 480)));
 
     let mut kept = doc.clone();
     let r = optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
-    assert_eq!(r.images_resampled, 5, "{r:?}");
+    // Not the inverted RGB: the colour settings leave an image with a decode array alone.
+    assert_eq!(r.images_resampled, 6, "{r:?}");
     assert_eq!(stream(&kept, flate).dict.name(b"Filter"), Some(&b"FlateDecode"[..]), "Retain: Flate stays Flate");
     for i in [fax, hex_fax] {
         assert_eq!(stream(&kept, i).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "and CCITT stays CCITT: {i:?}");
@@ -905,19 +1055,29 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     for i in [flate, fax, hex_fax] {
         assert_eq!((size(&kept, i), kept.decoded_image(&stream(&kept, i)).unwrap()), ((600, 240), halved.clone()), "{i:?}");
     }
-    assert_eq!(stream(&kept, eight).dict.int(b"BitsPerComponent"), Some(8), "Retain leaves eight bits to the grey settings");
+    let bits = [eight, rgb, rgb_inverted].map(|i| stream(&kept, i).dict.int(b"BitsPerComponent"));
+    assert_eq!(bits, [Some(8); 3], "Retain leaves eight bits to the grey and colour settings");
 
     let untouched = [fax_at_400].map(|r| raw(&doc, r));
     let hex_len = raw(&doc, hex_at_400).len();
     let r = optimize(&mut doc, &Settings::default()).unwrap();
-    assert_eq!((r.images_resampled, r.images_recompressed), (5, 3), "{r:?}");
-    for i in [flate, fax, mask, eight, hex_fax] {
+    assert_eq!((r.images_resampled, r.images_recompressed), (7, 3), "{r:?}");
+    assert_eq!(stream(&doc, rgb).dict.get(b"ColorSpace"), Some(&Object::name("DeviceGray")));
+    for i in [flate, fax, mask, eight, hex_fax, rgb] {
         let s = stream(&doc, i);
         assert_eq!((size(&doc, i), s.dict.int(b"BitsPerComponent")), ((600, 240), if i == mask { None } else { Some(1) }));
         assert!(matches!(s.dict.name(b"Filter"), Some(b"CCITTFaxDecode" | b"FlateDecode")), "{i:?}");
         assert_eq!(doc.decoded_image(&s).unwrap(), if i == mask { halved_mask.clone() } else { halved.clone() }, "{i:?}");
     }
     assert_eq!(stream(&doc, mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");
+    // Grey now, with grey's decode pair, which makes 1 black: its ties are black too.
+    let s = stream(&doc, rgb_inverted);
+    let inverting = Object::Array(vec![1.into(), 0.into()]);
+    assert_eq!(
+        (size(&doc, rgb_inverted), s.dict.get(b"ColorSpace"), s.dict.get(b"Decode")),
+        ((600, 240), Some(&Object::name("DeviceGray")), Some(&inverting))
+    );
+    assert_eq!(doc.decoded_image(&s).unwrap(), halved.iter().map(|b| !b).collect::<Vec<u8>>(), "the same picture, ties black");
     for i in [at_400, soft, hex_at_400] {
         assert_eq!((size(&doc, i), stream(&doc, i).dict.name(b"Filter")), ((1200, 480), Some(&b"CCITTFaxDecode"[..])), "{i:?}");
     }
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 56b10853a2..1cef4f5965 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,6 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: the optimizer stores Group 3 fax images as Group 4, and packs black-and-white RGB and two-entry indexed images to one bit; estimates unchanged)
 > **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white images above 450 ppi are averaged down to 300 ppi by the optimizer; estimates unchanged)
 > **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white pictures stay one bit when PDFs are created and optimized; CCITT images export; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
@@ -258,6 +259,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-24 | minor | M11: the PDF Optimizer and Reduce File Size store Group 3 fax images as Group 4 when smaller (`Document::fax_params`), and pack eight-bit `DeviceRGB` of only black and white (as grey) and indexed images of 2, 4 or 8 bits that use only palette entries 0 and 1 (keeping the palette) to one bit, so Monochrome Images compresses and downsamples them. Estimates unchanged. |
 | 2026-10-24 | minor | M11: monochrome downsampling: the PDF Optimizer and Reduce File Size average black-and-white images (1-bit, CCITT fax, eight-bit black-and-white grey) above 450 ppi down to 300 ppi, by area with ties black, as Monochrome Images ▸ Downsample to and `doc_optimize` `mono: { downsample, ppi, above_ppi }`; CCITT decoding moves into `pdfcraft-filters` (`decode_ccitt`) behind `Document::decoded_image`. Estimates unchanged. |
 | 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller, as they can a dithered scan, soft mask counted; Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index ecadea7b64..bc4c68d538 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7361,7 +7361,7 @@ status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
 evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::black_and_white_images_above_450_ppi_are_averaged_down_to_300", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, halftones and dithers (most of their new pixels would cover both black and white, and their tones turn solid), or images wider than a fax row (1,048,576 samples), and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax, and eight-bit black-and-white grey and RGB and indexed images of two palette entries) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, halftones and dithers (most of their new pixels would cover both black and white, and their tones turn solid), or images wider than a fax row (1,048,576 samples), and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]
 id = "optimize.recompress-images"
@@ -7384,8 +7384,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
-evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB and RGB with a profile aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From ff8a07f283757b875179c6b6e773b2ce66c9f682 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:19:30 +0100
Subject: [PATCH 192/270] M11: monochrome downsampling leaves halftones alone;
 bounds; an indexed tie under an inverting decode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Halftones and dithers: most of their new pixels cover both black and
  white, and taking the sample that covers more turned their tones
  solid (a 50% screen black, a 25% one white). An image whose new pixels
  mostly cover both is now left at its resolution; text covers both only
  along its edges and is still averaged down. downsample_bits says how
  many new pixels cover both.
- A counter for each column: an image wider than a fax row
  (MAX_CCITT_COLUMNS) isn't averaged, so a strip of 80 million columns
  can't make the counters 640 MB.
- A fax image's decoding is bounded at about a byte a pixel, as
  redaction's is (decoded_image_within), not 1 GiB; behind a Flate bomb
  it is left alone.
- An indexed image's tie went to sample 0, which an inverting decode
  array maps to entry 1, though the docs say entry 0. It goes to the
  sample that decodes to entry 0 now (ISO 32000-2 §8.9.5.2).

Each has a test that fails without it.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/src/images.rs     | 89 ++++++++++++++++++------------
 crates/optimize/tests/optimize.rs | 90 +++++++++++++++++++++++++++++++
 2 files changed, 146 insertions(+), 33 deletions(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 4c20c1b3e7..bb768551d5 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -565,7 +565,7 @@ fn one_component(doc: &Document, cs: &Object) -> bool {
 /// The samples of a black-and-white image, as rows of 1-bit samples each starting on a new byte,
 /// with its width and height, and whether they were packed from eight bits. Two kinds count:
 /// - one bit per pixel in one colour component, or an image mask, stored with no filter, with
-///   general-purpose ones, or with CCITT fax last ([`Document::decoded_image`]);
+///   general-purpose ones, or with CCITT fax last ([`Document::decoded_image_within`], no further than its rows can need);
 /// - with `eight_bit`, eight-bit grey whose every sample is 0 or 255. A decode array maps 0 and 255
 ///   at eight bits as it maps 0 and 1 at one bit, so it stays. Left out: indexed images (their
 ///   samples are palette indices) and a colour-key `/Mask` (its ranges are in eight-bit values).
@@ -581,13 +581,14 @@ fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32,
     let bits = d.int(b"BitsPerComponent");
     let mask = matches!(d.get(b"ImageMask"), Some(Object::Bool(true)));
     if (mask && bits.is_none_or(|b| b == 1)) || (bits == Some(1) && d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs))) {
-        // A fax image through its decoder; any other no further than its rows can need.
+        // No further than its rows can need: a fax image's code (the filters before its decoder
+        // produce it) takes at most about a byte a pixel and each row's end, as redaction allows.
         let len = stride.checked_mul(hu)?;
-        let mut data = match s.filters().last() {
-            Some((pdfcraft_filters::Filter::CcittFax, _)) => doc.decoded_image(s),
-            _ => doc.with_direct_parms(s).decoded_within(allowance(len, h)?),
-        }
-        .ok()?;
+        let max = match s.filters().last() {
+            Some((pdfcraft_filters::Filter::CcittFax, _)) => wu.checked_mul(hu)?.checked_add(hu.checked_mul(4)?)?.checked_add(4096)?,
+            _ => allowance(len, h)?,
+        };
+        let mut data = doc.decoded_image_within(s, max).ok()?;
         if data.len() < len {
             return None;
         }
@@ -624,8 +625,9 @@ fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32,
 /// Whether sample 1 is the dark one of the 1-bit image `d` describes, after its decode array
 /// (`[0 1]` when it has none of two numbers): the painted part of an image mask and black in grey
 /// decode to 0, and full ink in a separation (or a DeviceN of one colourant) to 1. An indexed image
-/// says 0: its palette, not its decode array, says which entry is darker, and the palette isn't
-/// read yet, so a tie goes to entry 0 whatever its colour.
+/// says the sample that decodes to entry 0 (its decode array maps samples to entries, ISO 32000-2
+/// §8.9.5.2): its palette says which entry is darker, and the palette isn't read yet, so a tie goes
+/// to entry 0 whatever its colour.
 fn dark_is_one(doc: &Document, d: &Dict) -> bool {
     let number = |v: Option<&Object>| v.and_then(|v| doc.resolve(v).as_f64());
     let (d0, d1) = match d.get(b"Decode").map(|v| doc.resolve(v)).as_deref() {
@@ -637,7 +639,6 @@ fn dark_is_one(doc: &Document, d: &Dict) -> bool {
     }
     match d.get(b"ColorSpace").map(|cs| doc.resolve(cs)).as_deref() {
         Some(Object::Array(a)) => match a.first().and_then(Object::as_name) {
-            Some(b"Indexed" | b"I") => false,
             Some(b"Separation" | b"DeviceN") => d1 > d0,
             _ => d1 < d0,
         },
@@ -648,8 +649,9 @@ fn dark_is_one(doc: &Document, d: &Dict) -> bool {
 /// `w` × `h` 1-bit rows (each starting on a new byte) averaged down to `nw` × `nh`, no larger:
 /// each new pixel takes the sample that covers more of its area, and the dark one when the two tie
 /// (1 if `dark_is_one`, see [`dark_is_one`]), so a dark line half a new pixel wide stays. `None`
-/// when the rows are short or the new size isn't smaller in both directions or empty.
-pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dark_is_one: bool) -> Option<Vec<u8>> {
+/// when the rows are short or the new size isn't smaller in both directions or empty. Also says
+/// how many new pixels cover both samples.
+pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dark_is_one: bool) -> Option<(Vec<u8>, u64)> {
     if nw == 0 || nh == 0 || nw > w || nh > h {
         return None;
     }
@@ -662,6 +664,7 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
     let overlap = |a0: u64, a1: u64, b0: u64, b1: u64| a1.min(b1).saturating_sub(a0.max(b0));
     // Per source column, the area its 1 samples cover in the new row.
     let mut ones = vec![0u64; usize::try_from(w).ok()?];
+    let mut mixed = 0u64;
     for j in 0..nh {
         ones.fill(0);
         let (y0, y1) = (j * h, (j + 1) * h);
@@ -683,20 +686,23 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
             // Against what the 0 samples cover: covered is at most w·h, which can't overflow
             // (w·h < 2^64 for u32 sizes).
             let zeros = w * h - covered;
+            mixed += u64::from(covered > 0 && zeros > 0);
             if covered > zeros || (dark_is_one && covered == zeros) {
                 let i = usize::try_from(i).ok()?;
                 *out_row.get_mut(i / 8)? |= 0x80 >> (i % 8);
             }
         }
     }
-    Some(out)
+    Some((out, mixed))
 }
 
 /// A black-and-white image (see [`one_bit`]) resampled and stored again per `settings`, if that is
 /// smaller as stored; `ppi` is its effective resolution. Also says whether it was resampled.
 ///
 /// - **Resampled** ([`downsample_bits`]) when its resolution is above `above_ppi`, to `target_ppi`,
-///   unless it has a soft mask, whose own size would then have to follow.
+///   unless it has a soft mask, whose own size would then have to follow, or is a halftone or a
+///   dither: most of its new pixels would cover both black and white, and taking the sample that
+///   covers more would turn its tones solid (a 50% screen black, a 25% one white).
 /// - **Stored** as CCITT Group 4 with `CcittG4`, or as 1-bit Flate when that is smaller, which only
 ///   a resampled image or one packed from eight bits may be: a 1-bit image that is only stored again
 ///   becomes Group 4 or stays. With `Retain`, a resampled image keeps its kind of compression
@@ -719,14 +725,31 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     }
     let (data, w, h, eight_bit) = one_bit(doc, s, !retain)?;
     let k = settings.target_ppi / ppi;
+    // `downsample_bits` keeps a counter for each column: no more columns than a fax row may have,
+    // so a hostile strip of 80 million can't make it 640 MB.
+    let narrow = w <= pdfcraft_filters::MAX_CCITT_COLUMNS;
     // At most `w` × `h`, as k < 1: no overflow.
-    let (nw, nh) =
-        if downsample && k < 1.0 { (((f64::from(w) * k).round() as u32).max(1), ((f64::from(h) * k).round() as u32).max(1)) } else { (w, h) };
-    let resampled = (nw, nh) != (w, h);
+    let (nw, nh) = if downsample && narrow && k < 1.0 {
+        (((f64::from(w) * k).round() as u32).max(1), ((f64::from(h) * k).round() as u32).max(1))
+    } else {
+        (w, h)
+    };
+    let averaged = if (nw, nh) != (w, h) {
+        let (out, mixed) = downsample_bits(&data, w, h, nw, nh, dark_is_one(doc, d))?;
+        // A halftone or dither: most new pixels cover both samples. Text covers both only along
+        // its edges.
+        (mixed.saturating_mul(2) <= u64::from(nw) * u64::from(nh)).then_some(out)
+    } else {
+        None
+    };
+    let resampled = averaged.is_some();
+    let (data, nw, nh) = match averaged {
+        Some(out) => (out, nw, nh),
+        None => (data, w, h),
+    };
     if (retain || fax_alone) && !resampled {
         return None;
     }
-    let data = if resampled { downsample_bits(&data, w, h, nw, nh, dark_is_one(doc, d))? } else { data };
     let mut dict = d.clone();
     for key in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
         dict.remove(key);
@@ -931,18 +954,18 @@ mod downsample_tests {
     #[test]
     fn each_new_pixel_takes_the_sample_covering_more_of_it() {
         // 4 × 2 to 2 × 1: three 1s of four on the left, none on the right.
-        assert_eq!(downsample_bits(&[0b1100_0000, 0b1000_0000], 4, 2, 2, 1, false), Some(vec![0b1000_0000]));
+        assert_eq!(downsample_bits(&[0b1100_0000, 0b1000_0000], 4, 2, 2, 1, false).map(|(out, _)| out), Some(vec![0b1000_0000]));
         // A tie gives the dark sample: 0, black in grey, so a black line half a new pixel wide
         // stays (the second of four white columns is black); a white one that thin on black doesn't.
-        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1, false), Some(vec![0b0100_0000]));
-        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1, false), Some(vec![0]));
+        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1, false).map(|(out, _)| out), Some(vec![0b0100_0000]));
+        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1, false).map(|(out, _)| out), Some(vec![0]));
         // With 1 the dark sample (an inverting decode array, a separation), that line is a 1.
-        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1, true), Some(vec![0b1000_0000]));
-        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1, true), Some(vec![0b1100_0000]));
+        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1, true).map(|(out, _)| out), Some(vec![0b1000_0000]));
+        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1, true).map(|(out, _)| out), Some(vec![0b1100_0000]));
         // The same size gives the same bits; padding bits are 0.
-        assert_eq!(downsample_bits(&[0b1010_1111], 3, 1, 3, 1, false), Some(vec![0b1010_0000]));
+        assert_eq!(downsample_bits(&[0b1010_1111], 3, 1, 3, 1, false).map(|(out, _)| out), Some(vec![0b1010_0000]));
         // 3 to 2 across: the middle column counts half to each new one.
-        assert_eq!(downsample_bits(&[0b1100_0000], 3, 1, 2, 1, false), Some(vec![0b1000_0000]));
+        assert_eq!(downsample_bits(&[0b1100_0000], 3, 1, 2, 1, false).map(|(out, _)| out), Some(vec![0b1000_0000]));
     }
 
     /// The dark sample: 0 in grey and of an image mask, 1 in a separation, each the other way round
@@ -971,7 +994,7 @@ mod downsample_tests {
             (vec![separation.clone()], true),
             (vec![separation, inverted.clone()], false),
             (vec![indexed.clone()], false),
-            (vec![indexed, inverted], false),
+            (vec![indexed, inverted], true),
             (vec![("ColorSpace", Object::name("DeviceGray")), ("Decode", Object::Array(vec![Object::name("x"), 0.into()]))], false),
         ] {
             assert_eq!(dark_is_one(&doc, &image(&entries)), dark_one, "{entries:?}");
@@ -980,11 +1003,11 @@ mod downsample_tests {
 
     #[test]
     fn what_it_cannot_resample_is_none() {
-        assert_eq!(downsample_bits(&[0; 2], 4, 2, 5, 1, false), None, "wider");
-        assert_eq!(downsample_bits(&[0; 2], 4, 2, 2, 3, false), None, "taller");
-        assert_eq!(downsample_bits(&[0; 2], 4, 2, 0, 1, false), None);
-        assert_eq!(downsample_bits(&[0; 1], 4, 2, 2, 1, false), None, "short rows");
-        assert_eq!(downsample_bits(&[], u32::MAX, u32::MAX, 1, 1, true), None);
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 5, 1, false).map(|(out, _)| out), None, "wider");
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 2, 3, false).map(|(out, _)| out), None, "taller");
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 0, 1, false).map(|(out, _)| out), None);
+        assert_eq!(downsample_bits(&[0; 1], 4, 2, 2, 1, false).map(|(out, _)| out), None, "short rows");
+        assert_eq!(downsample_bits(&[], u32::MAX, u32::MAX, 1, 1, true).map(|(out, _)| out), None);
     }
 
     proptest::proptest! {
@@ -1002,8 +1025,8 @@ mod downsample_tests {
             let (nw, nh) = (1 + (f64::from(w - 1) * nw_part) as u32, 1 + (f64::from(h - 1) * nh_part) as u32);
             let len = (w as usize).div_ceil(8) * h as usize;
             let data: Vec<u8> = seed.iter().cycle().take(len).copied().collect();
-            proptest::prop_assert_eq!(downsample_bits(&data, w, h, nw, nh, dark_one), Some(naive(&data, w, h, nw, nh, dark_one)));
-            let white = downsample_bits(&vec![0xFF; len], w, h, nw, nh, dark_one).unwrap();
+            proptest::prop_assert_eq!(downsample_bits(&data, w, h, nw, nh, dark_one).map(|(out, _)| out), Some(naive(&data, w, h, nw, nh, dark_one)));
+            let white = downsample_bits(&vec![0xFF; len], w, h, nw, nh, dark_one).map(|(out, _)| out).unwrap();
             proptest::prop_assert_eq!(white, naive(&vec![0xFF; len], w, h, nw, nh, dark_one));
             proptest::prop_assert!(naive(&vec![0xFF; len], w, h, nw, nh, dark_one).iter().any(|b| *b != 0));
         }
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index ea2961513b..4efe4072d2 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -929,6 +929,96 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     assert!(differ * 200 < before.len(), "{differ} of {} channel values differ visibly", before.len());
 }
 
+/// Monochrome downsampling leaves a halftone or a dither at its resolution, as most new pixels
+/// would cover both black and white and taking the sample covering more would turn its tones
+/// solid: a 50% checkerboard, a 25% ordered dither and an error-diffused one, each at 600 ppi.
+/// Text at 600 ppi, which covers both only along its edges, is averaged down. Rows no wider than
+/// a fax row (`MAX_CCITT_COLUMNS`) are averaged down too, but not one column wider: the averaging
+/// keeps a counter for each column.
+#[test]
+fn monochrome_downsampling_leaves_halftones_and_overwide_rows_at_their_resolution() {
+    let (w, h) = (1200u32, 480u32);
+    let stride = (w as usize).div_ceil(8);
+    let pattern = |white: &dyn Fn(usize, usize) -> bool| {
+        let mut data = vec![0u8; stride * h as usize];
+        for y in 0..h as usize {
+            for x in 0..w as usize {
+                if white(x, y) {
+                    data[y * stride + x / 8] |= 0x80 >> (x % 8);
+                }
+            }
+        }
+        data
+    };
+    let diffused = dithered(w, h);
+    let grey = [("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))];
+    let mut doc = Document::new_empty();
+    let text = mono_image(&mut doc, w, h, &bilevel(w, h, false), None, &grey);
+    let halftones =
+        [pattern(&|x, y| (x + y) % 2 == 0), pattern(&|x, y| x % 2 == 1 || y % 2 == 1), pattern(&|x, y| diffused[y * w as usize + x] == 255)]
+            .map(|data| mono_image(&mut doc, w, h, &data, None, &grey));
+    // 144 × 57.6 pt is 600 ppi.
+    let names = ["T", "A", "B", "C"];
+    let content: String = (0..4).map(|i| format!("q 144 0 0 57.6 {} 600 cm /{} Do Q ", 6 + 150 * i, names[i])).collect();
+    page(&mut doc, &names.into_iter().zip([text, halftones[0], halftones[1], halftones[2]]).collect::<Vec<_>>(), &content);
+    optimize(&mut doc, &Settings::default()).unwrap();
+    let size = |r: ObjRef| {
+        let d = stream(&doc, r).dict;
+        (d.int(b"Width"), d.int(b"Height"))
+    };
+    assert_eq!(size(text), (Some(600), Some(240)), "text");
+    for (i, r) in halftones.iter().enumerate() {
+        assert_eq!(size(*r), (Some(1200), Some(480)), "halftone {i}");
+    }
+
+    for (columns, resampled) in [(pdfcraft_filters::MAX_CCITT_COLUMNS, 1), (pdfcraft_filters::MAX_CCITT_COLUMNS + 1, 0)] {
+        let mut doc = Document::new_empty();
+        let white = vec![0xFF; (columns as usize).div_ceil(8) * 2];
+        let img = mono_image(&mut doc, columns, 2, &white, None, &grey);
+        // Far above 450 ppi both ways.
+        page(&mut doc, &[("A", img)], "q 612 0 0 0.1 0 400 cm /A Do Q");
+        let r = optimize(&mut doc, &Settings::default()).unwrap();
+        assert_eq!(r.images_resampled, resampled, "{columns} columns: {r:?}");
+    }
+}
+
+/// A fax image behind a decompression bomb is left alone: the filters before its decoder may
+/// produce no more than a fax code of its size can take (about a byte a pixel), not the 1 GiB
+/// limit. Here a Group 4 page at 600 ppi behind Flate, with four megabytes of zeros after its
+/// code; without them it is averaged down.
+#[test]
+fn a_fax_image_behind_a_decompression_bomb_is_left_alone() {
+    let (w, h) = (1200u32, 480u32);
+    let g4 = pdfcraft_filters::encode_g4(&bilevel(w, h, false), w, h).unwrap();
+    for padding in [0, 4 << 20] {
+        let mut doc = Document::new_empty();
+        let mut code = g4.clone();
+        code.resize(g4.len() + padding, 0);
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"), Object::name("CCITTFaxDecode")]));
+        let mut parms = Dict::new();
+        parms.set(b"K".to_vec(), Object::Int(-1));
+        parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+        d.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Null, Object::Dict(parms)]));
+        let img = doc.add(Object::Stream(Stream::from_raw(d, pdfcraft_filters::encode_flate(&code))));
+        // 144 × 57.6 pt is 600 ppi.
+        page(&mut doc, &[("A", img)], "q 144 0 0 57.6 20 600 cm /A Do Q");
+        let before = stream(&doc, img).raw;
+        let r = optimize(&mut doc, &Settings::default()).unwrap();
+        if padding == 0 {
+            assert_eq!(r.images_resampled, 1, "{r:?}");
+        } else {
+            assert_eq!((r.images_resampled, r.images_recompressed), (0, 0), "{r:?}");
+            assert_eq!(stream(&doc, img).raw, before);
+        }
+    }
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();

From 450c327c6bcb1abad47d4f9fd52b1f8b34d11799 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 16:45:43 +0100
Subject: [PATCH 193/270] M11: black-and-white RGB stays RGB where grey would
 be drawn otherwise
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Packed to one bit, black-and-white DeviceRGB became DeviceGray. Where
  /DefaultGray or /DefaultRGB is in force (ISO 32000-2 §8.6.5.6), that
  drew it otherwise: through DefaultGray as grey, or no longer through
  DefaultRGB. The page walk now notes the images drawn, on any use, where
  a page's or form's resources (an enclosing one's included) name
  either, and those stay RGB. When a use couldn't be followed, every
  image counts as such.
- One whose soft mask has a /Matte stays RGB too: the matte has one
  number for each of the parent's components, three, and grey has one.
- The optimize README, the mono-compression parity note and doc_reduce's
  description said Group 3 to Group 4 wasn't done yet, that only images
  packed from eight bits could become Flate, and that the colour space
  and decode array always stay. They now match the code.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/automation/src/tools.rs    |  2 +-
 crates/optimize/README.md         | 30 +++++-----
 crates/optimize/src/images.rs     | 75 +++++++++++++++++-------
 crates/optimize/tests/optimize.rs | 97 +++++++++++++++++++++++++++++++
 parity/acrobat-features.toml      |  2 +-
 5 files changed, 169 insertions(+), 37 deletions(-)

diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 3f53a07ff9..838fa57ab4 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1332,7 +1332,7 @@ pub fn tools() -> Vec<ToolDef> {
             }),
             &["from"],
         )),
-        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images averaged down to 300 ppi above 450 ppi and each stored as CCITT Group 4 (or 1-bit Flate, once resampled) whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
+        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images averaged down to 300 ppi above 450 ppi and each stored as CCITT Group 4 (or 1-bit Flate, once resampled or packed from more bits) whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
             .cmd("optimize.reduce")
             .with(schema(json!({ "doc": doc(), "path": { "type": "string" } }), &["doc", "path"])),
         t("doc_initial_view", "Initial view", "Read or change how the document opens (Document Properties ▸ Initial View) and its reading options: navigation (page, bookmarks, pages, attachments, layers), layout (default, single, continuous, two_up, two_up_continuous, two_up_cover, two_up_continuous_cover), magnification (default, actual, fit_page, fit_width, fit_height, fit_visible, or a percentage), page, window options (fit_window, center_window, full_screen, display_title), interface options (hide_menubar, hide_toolbar, hide_window_ui), language and binding (left, right). Only the given ones change; returns the result. Undoable.").with(schema(
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 0b159229a0..e26ceba945 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -45,12 +45,15 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   row, not as T.4 sends them, is read as PdfCraft draws it, which at `/K 0` may be other rows than
   were coded, and an image stored again keeps them). Packed to one bit first, unless a colour-key `/Mask` is in the image's
   own values: eight-bit grey of only 0 and 255; eight-bit `DeviceRGB` of only black and white,
-  which becomes `DeviceGray` (not calibrated RGB or RGB with a profile); and an indexed image of 2,
-  4 or 8 bits that uses only palette entries 0 and 1, which keeps its palette, whatever its two
-  colours. A decode array stays when it means the same at one bit (grey's, or RGB's if the same
-  for each component, as grey's); otherwise the image is left alone. The grey or colour settings
-  take a packed image instead when they make it smaller still, its soft mask counted (resampled
-  with it there, kept as it is here), as they can a dithered scan by downsampling it to JPEG.
+  which becomes `DeviceGray` (not calibrated RGB or RGB with a profile, nor one drawn where
+  `/DefaultGray` or `/DefaultRGB` is in force, which would then draw it otherwise, nor one whose
+  soft mask has a `/Matte`); and an indexed image of 2, 4 or 8 bits that uses only palette entries
+  0 and 1, which keeps its palette, whatever its two colours. A decode array stays when it means
+  the same at one bit (grey's, or RGB's if the same for each component, as grey's), and an indexed
+  image's default one goes, as the default at one bit; otherwise the image is left alone. The grey
+  or colour settings take a packed image instead when they make it smaller still, its soft mask
+  counted (resampled with it there, kept as it is here), as they can a dithered scan by
+  downsampling it to JPEG.
   - **Downsampling:** one whose effective resolution is above `above_ppi` is averaged down to
     `target_ppi`: each new pixel takes the sample covering more of its area, and the dark one on a
     tie, so a dark line half a new pixel wide stays: black in grey and the painted part of an image
@@ -62,17 +65,18 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
     a fax row (`pdfcraft_filters::MAX_CCITT_COLUMNS`), as the averaging keeps a counter for each
     column. On a 600 ppi text page, Group 4 at 300 ppi is half the size.
   - **Compression:** CCITT Group 4 (`pdfcraft_filters::encode_g4`), or 1-bit Flate when that is
-    smaller, which only a resampled image or one packed from eight bits may be: a 1-bit image that
+    smaller, which only a resampled image or one packed from more bits may be: a 1-bit image that
     is only stored again becomes Group 4 or stays. Group 4 alone is only decoded to be resampled;
     Group 3, or Group 4 inside another filter such as `ASCII85Decode`, is stored again as Group 4
     alone when that is smaller. With Retain, a resampled image keeps its kind of compression (CCITT,
-    or Flate) and nothing else changes; eight-bit grey is then left to the grey settings. Every
-    change is kept only when it is smaller as stored.
+    or Flate) and nothing else changes; an image of more bits is then left to the grey or colour
+    settings. Every change is kept only when it is smaller as stored.
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
-    space, decode array and `/Mask` stay. Group 4 wins on scans, whose ragged edges defeat Flate;
-    on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, a lone Group 3 image to
-    Group 4 without resampling (one behind another filter is stored again as Group 4), inline images, an image's own `/SMask` or `/Mask` image (only images drawn
-    on a page are visited), and Group 4 for rows wider than 32,767 samples.
+    space, decode array and `/Mask` stay, but for packed RGB, which becomes grey with one decode
+    pair. Group 4 wins on scans, whose ragged edges defeat Flate; on clean computer-drawn 1-bit
+    art Flate can be smaller. Not yet: JBIG2, inline images, an image's own `/SMask` or `/Mask`
+    image (only images drawn on a page are visited), and Group 4 for rows wider than 32,767
+    samples.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 8b55d4aeb2..71fa945da4 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -41,9 +41,10 @@ struct Walk<'a> {
     doc: &'a Document,
     /// The forms being walked right now, outermost first: a form drawing one of these is a cycle.
     path: Vec<ObjRef>,
-    /// Forms with their own resources already walked, by the linear part of their matrix. Drawing
-    /// one again at the same scale (only moved) can't change any image's resolution.
-    walked: HashSet<(ObjRef, [u64; 4])>,
+    /// Forms with their own resources already walked, by the linear part of their matrix and
+    /// whether default colour spaces were in force. Drawing one again at the same scale (only
+    /// moved) can't change any image's resolution.
+    walked: HashSet<(ObjRef, [u64; 4], bool)>,
     /// Forms walked at least once.
     seen: HashSet<ObjRef>,
     rewalks: usize,
@@ -52,13 +53,17 @@ struct Walk<'a> {
     /// False once a use may have been missed (depth or work limit).
     complete: bool,
     out: HashMap<ObjRef, f64>,
+    /// Images drawn at least once where `/DefaultGray` or `/DefaultRGB` is in force.
+    defaults: HashSet<ObjRef>,
 }
 
 impl Walk<'_> {
     /// Walk one content stream, recording each image's displayed resolution (pixels per inch, the
-    /// smaller of the two axes) and descending into form XObjects.
-    fn content(&mut self, data: &[u8], resources: &Dict, ctm: Matrix) {
+    /// smaller of the two axes) and descending into form XObjects. `defaults`: an enclosing
+    /// stream's resources remap a device colour space.
+    fn content(&mut self, data: &[u8], resources: &Dict, ctm: Matrix, defaults: bool) {
         let doc = self.doc;
+        let defaults = defaults || remaps_device_spaces(doc, resources);
         let xobjects = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
         let mut stack = vec![ctm];
         for op in pdfcraft_content::parse(data).ops {
@@ -90,8 +95,11 @@ impl Walk<'_> {
                                 let e = self.out.entry(r).or_insert(f64::INFINITY);
                                 *e = e.min(ppi);
                             }
+                            if defaults {
+                                self.defaults.insert(r);
+                            }
                         }
-                        Some(b"Form") => self.form(r, s, resources, top),
+                        Some(b"Form") => self.form(r, s, resources, top, defaults),
                         _ => {}
                     }
                 }
@@ -101,7 +109,7 @@ impl Walk<'_> {
     }
 
     /// Descend into form `r` drawn with `ctm` from a stream whose resources are `resources`.
-    fn form(&mut self, r: ObjRef, s: &Stream, resources: &Dict, ctm: Matrix) {
+    fn form(&mut self, r: ObjRef, s: &Stream, resources: &Dict, ctm: Matrix, defaults: bool) {
         if self.path.contains(&r) {
             return;
         }
@@ -116,7 +124,7 @@ impl Walk<'_> {
         // A form without resources uses its caller's, so the same form can draw other images.
         if own.is_some() {
             let [a, b, c, d, ..] = inner.0;
-            if !self.walked.insert((r, [a.to_bits(), b.to_bits(), c.to_bits(), d.to_bits()])) {
+            if !self.walked.insert((r, [a.to_bits(), b.to_bits(), c.to_bits(), d.to_bits()], defaults)) {
                 return;
             }
         }
@@ -136,17 +144,30 @@ impl Walk<'_> {
             return;
         };
         self.path.push(r);
-        self.content(&data, own.as_ref().unwrap_or(resources), inner);
+        self.content(&data, own.as_ref().unwrap_or(resources), inner, defaults);
         self.path.pop();
     }
 }
 
+/// Whether `resources` remap a device colour space an image may be moved between, so that the
+/// same samples would be drawn otherwise: `/DefaultGray` or `/DefaultRGB` (ISO 32000-2 §8.6.5.6).
+fn remaps_device_spaces(doc: &Document, resources: &Dict) -> bool {
+    let spaces = resources.get(b"ColorSpace").map(|c| doc.resolve(c));
+    spaces.as_deref().and_then(Object::as_dict).is_some_and(|c| c.contains(b"DefaultGray") || c.contains(b"DefaultRGB"))
+}
+
 /// The effective resolution (ppi) of every image drawn by `pages`: the smallest over its uses.
 ///
 /// If forms nest too deeply, are drawn too many times, or a page's content doesn't decode within
 /// its budget, every image is given `INFINITY` (never resampled), since its largest use may be
 /// among those missed.
 pub fn effective_resolutions(doc: &Document, pages: &[ObjRef]) -> HashMap<ObjRef, f64> {
+    walk_pages(doc, pages).0
+}
+
+/// [`effective_resolutions`], and the images drawn where `/DefaultGray` or `/DefaultRGB` is in
+/// force: all of them when a use may have been missed.
+fn walk_pages(doc: &Document, pages: &[ObjRef]) -> (HashMap<ObjRef, f64>, HashSet<ObjRef>) {
     let mut walk = Walk {
         doc,
         path: Vec::new(),
@@ -156,6 +177,7 @@ pub fn effective_resolutions(doc: &Document, pages: &[ObjRef]) -> HashMap<ObjRef
         budget: DecodeBudget::page(),
         complete: true,
         out: HashMap::new(),
+        defaults: HashSet::new(),
     };
     for p in pages {
         let Some(dict) = doc.get(*p).as_dict().cloned() else { continue };
@@ -169,12 +191,13 @@ pub fn effective_resolutions(doc: &Document, pages: &[ObjRef]) -> HashMap<ObjRef
         };
         // Content coordinates are in page units; image resolution is in physical inches.
         let unit = page.user_unit(doc);
-        walk.content(&data, &res, Matrix([unit, 0.0, 0.0, unit, 0.0, 0.0]));
+        walk.content(&data, &res, Matrix([unit, 0.0, 0.0, unit, 0.0, 0.0]), false);
     }
     if !walk.complete {
         walk.out.values_mut().for_each(|v| *v = f64::INFINITY);
+        walk.defaults.extend(walk.out.keys());
     }
-    walk.out
+    (walk.out, walk.defaults)
 }
 
 /// Colour components of a colour space PdfCraft resamples: gray (1) or RGB (3).
@@ -577,11 +600,13 @@ type Pixel = fn(&[u8]) -> Option<bool>;
 ///   - eight-bit `DeviceRGB` whose every pixel is black or white, which becomes `DeviceGray`. A
 ///     decode array the same for all three components becomes that one pair; another stops it.
 ///     Calibrated RGB and RGB with a profile are left out, as the profile could make them other
-///     than black and white;
+///     than black and white; so is one drawn where `/DefaultGray` or `/DefaultRGB` is in force
+///     (`defaults`), which would draw it otherwise as grey, and one whose soft mask has a `/Matte`
+///     of three components;
 ///   - an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1, which stay 0 and
 ///     1 at one bit, whatever their colours, so the colour space stays. A decode array other than
 ///     the default stops it: in index units it would mean something else at one bit.
-fn one_bit(doc: &Document, s: &Stream, pack: bool) -> Option<(Vec<u8>, u32, u32, Option<Dict>)> {
+fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool) -> Option<(Vec<u8>, u32, u32, Option<Dict>)> {
     let d = &s.dict;
     // Through u32 first, as everywhere here, so the product can't overflow.
     let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
@@ -633,6 +658,10 @@ fn one_bit(doc: &Document, s: &Stream, pack: bool) -> Option<(Vec<u8>, u32, u32,
             })
         }
         Object::Name(name) if matches!(name.as_slice(), b"DeviceRGB" | b"RGB") && bits == Some(8) => {
+            let matte = |m: &Object| matches!(&*doc.resolve(m), Object::Stream(m) if m.dict.contains(b"Matte"));
+            if defaults || d.get(b"SMask").is_some_and(matte) {
+                return None;
+            }
             match decode.as_deref() {
                 None => {}
                 Some(Object::Array(v)) if v.len() == 6 && v.chunks(2).all(|pair| Some(pair) == v.get(..2)) => {
@@ -768,7 +797,8 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
 }
 
 /// A black-and-white image (see [`one_bit`]) resampled and stored again per `settings`, if that is
-/// smaller as stored; `ppi` is its effective resolution. Also says whether it was resampled.
+/// smaller as stored; `ppi` is its effective resolution, and `defaults` says it is drawn where
+/// `/DefaultGray` or `/DefaultRGB` is in force. Also says whether it was resampled.
 ///
 /// - **Resampled** ([`downsample_bits`]) when its resolution is above `above_ppi`, to `target_ppi`,
 ///   unless it has a soft mask, whose own size would then have to follow, or is a halftone or a
@@ -781,9 +811,10 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
 ///   (CCITT, or Flate), and nothing else changes: an image of more bits stays as it is, for the
 ///   grey or colour settings.
 ///
-/// The samples keep their meaning, so the decode array and `/Mask` stay as they are, and the
-/// colour space too, but for black-and-white RGB, which becomes grey.
-fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option<(Stream, bool)> {
+/// The samples keep their meaning, so the colour space, decode array and `/Mask` stay, but for
+/// black-and-white RGB, which becomes grey with one decode pair, and an indexed image's default
+/// decode array, which goes as the default at one bit.
+fn mono(doc: &Document, s: &Stream, ppi: f64, defaults: bool, settings: &MonoSettings) -> Option<(Stream, bool)> {
     let d = &s.dict;
     let downsample = settings.downsample && ppi.is_finite() && ppi > settings.above_ppi && settings.target_ppi > 0.0 && !d.contains(b"SMask");
     let retain = settings.compression == MonoCompression::Retain;
@@ -796,7 +827,7 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     if (retain || g4_alone) && !downsample {
         return None;
     }
-    let (data, w, h, packed) = one_bit(doc, s, !retain)?;
+    let (data, w, h, packed) = one_bit(doc, s, !retain, defaults)?;
     let packed_from_more = packed.is_some();
     let k = settings.target_ppi / ppi;
     // `downsample_bits` keeps a counter for each column: no more columns than a fax row may have,
@@ -858,7 +889,7 @@ pub(crate) fn run(
     report: &mut Report,
     progress: &mut dyn FnMut(Stage) -> bool,
 ) -> Result<(), OptimizeError> {
-    let ppi = effective_resolutions(doc, pages);
+    let (ppi, defaults) = walk_pages(doc, pages);
     // Soft masks are processed with their image, not on their own.
     let masks: HashSet<ObjRef> = ppi
         .keys()
@@ -877,10 +908,10 @@ pub(crate) fn run(
         let obj = doc.get(r);
         let Object::Stream(s) = &*obj else { continue };
         report.images += 1;
-        // Packed from more bits a sample, it is lossless at one bit, but the grey settings can
-        // make it smaller still (below).
+        // Packed from more bits a sample, it is lossless at one bit, but the grey or colour
+        // settings can make it smaller still (below).
         let packed_from_more = s.dict.int(b"BitsPerComponent").is_some_and(|b| b > 1);
-        let (packed, mono) = match mono(doc, s, ppi, &settings.mono) {
+        let (packed, mono) = match mono(doc, s, ppi, defaults.contains(&r), &settings.mono) {
             Some(m) if packed_from_more => (Some(m), None),
             m => (None, m),
         };
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index cc8f2f4683..259e11c771 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -918,6 +918,103 @@ fn rgb_and_two_colour_indexed_black_and_white_images_become_one_bit() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// Black-and-white RGB stays RGB where grey would be drawn otherwise: drawn, on any of its uses,
+/// where `/DefaultGray` or `/DefaultRGB` is in force (ISO 32000-2 §8.6.5.6), from a page's
+/// resources or a form's own, as grey would then go through DefaultGray, or no longer through
+/// DefaultRGB; or with a soft mask whose `/Matte` has three components, one for each of RGB's. A
+/// form drawn where they are in force counts too, though it has resources of its own. The same
+/// image drawn plainly, or with a soft mask and no `/Matte`, becomes grey.
+#[test]
+fn black_and_white_rgb_stays_rgb_where_grey_would_be_drawn_otherwise() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200u32, 480u32);
+    let rgb_data = samples_of(&bilevel(w, h, false), w, h, [&[0, 0, 0], &[255, 255, 255]], 8);
+    let image = |doc: &mut Document, cs: &str, data: &[u8], entries: &[(&str, Object)]| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), Object::name(cs));
+        for (k, v) in entries {
+            d.set(k.as_bytes().to_vec(), v.clone());
+        }
+        doc.add(Object::Stream(Stream::flate(d, data)))
+    };
+    let opaque = vec![255u8; (w * h) as usize];
+    let plain_mask = image(&mut doc, "DeviceGray", &opaque, &[]);
+    let matte_mask = image(&mut doc, "DeviceGray", &opaque, &[("Matte", Object::Array(vec![0.into(); 3]))]);
+    let plain = image(&mut doc, "DeviceRGB", &rgb_data, &[]);
+    let masked = image(&mut doc, "DeviceRGB", &rgb_data, &[("SMask", Object::Ref(plain_mask))]);
+    let matted = image(&mut doc, "DeviceRGB", &rgb_data, &[("SMask", Object::Ref(matte_mask))]);
+    let [under_gray, under_rgb, shared, in_form, nested] = [(); 5].map(|_| image(&mut doc, "DeviceRGB", &rgb_data, &[]));
+    let mut white_point = Dict::new();
+    white_point.set(b"WhitePoint".to_vec(), Object::Array(vec![Object::Real(0.9505), 1.into(), Object::Real(1.089)]));
+    let spaces = |key: &str| {
+        let family = if key == "DefaultGray" { "CalGray" } else { "CalRGB" };
+        let mut c = Dict::new();
+        c.set(key.as_bytes().to_vec(), Object::Array(vec![Object::name(family), Object::Dict(white_point.clone())]));
+        Object::Dict(c)
+    };
+    let draw = |names: &[&str]| names.iter().enumerate().map(|(i, n)| format!("q 200 0 0 80 6 {} cm /{n} Do Q ", 690 - 100 * i)).collect::<String>();
+    let form = |doc: &mut Document, im: ObjRef, spaces: Option<Object>| {
+        let mut xobjects = Dict::new();
+        xobjects.set(b"Im".to_vec(), Object::Ref(im));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xobjects));
+        if let Some(spaces) = spaces {
+            resources.set(b"ColorSpace".to_vec(), spaces);
+        }
+        let mut f = Dict::new();
+        f.set(b"Type".to_vec(), Object::name("XObject"));
+        f.set(b"Subtype".to_vec(), Object::name("Form"));
+        f.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 612.into(), 792.into()]));
+        f.set(b"Resources".to_vec(), Object::Dict(resources));
+        doc.add(Object::Stream(Stream::from_raw(f, draw(&["Im"]).into_bytes())))
+    };
+    // Drawn plainly first, then where DefaultGray is in force: the second walk must happen.
+    let plain_form = form(&mut doc, nested, None);
+    page(&mut doc, &[("A", plain), ("B", masked), ("C", matted), ("D", shared), ("E", plain_form)], &draw(&["A", "B", "C", "D", "E"]));
+    for (key, xobjects) in [("DefaultGray", vec![("A", under_gray), ("B", shared), ("C", plain_form)]), ("DefaultRGB", vec![("A", under_rgb)])] {
+        let names: Vec<&str> = xobjects.iter().map(|(n, _)| *n).collect();
+        let p = page(&mut doc, &xobjects, &draw(&names));
+        doc.update_dict(p, |d| {
+            let mut res = d.get(b"Resources").and_then(Object::as_dict).cloned().unwrap();
+            res.set(b"ColorSpace".to_vec(), spaces(key));
+            d.set(b"Resources".to_vec(), Object::Dict(res));
+        })
+        .unwrap();
+    }
+    // A form with its own resources, DefaultGray among them, on a page without any.
+    let gray_form = form(&mut doc, in_form, Some(spaces("DefaultGray")));
+    page(&mut doc, &[("F", gray_form)], "/F Do");
+    let kept = [under_gray, under_rgb, shared, in_form, nested, matted];
+    let before = kept.map(|r| stream(&doc, r));
+    // Colour and grey settings that leave images alone, so only this conversion acts.
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    let settings = Settings { color: keep, gray: keep, ..Settings::default() };
+    let r = optimize(&mut doc, &settings).unwrap();
+    assert_eq!((r.images_resampled, r.images_recompressed), (0, 2), "{r:?}");
+    for i in [plain, masked] {
+        let s = stream(&doc, i);
+        assert_eq!((s.dict.get(b"ColorSpace"), s.dict.int(b"BitsPerComponent")), (Some(&Object::name("DeviceGray")), Some(1)), "{i:?}");
+    }
+    for (i, b) in kept.iter().zip(&before) {
+        let s = stream(&doc, *i);
+        assert_eq!((&s.dict, &s.raw), (&b.dict, &b.raw), "{i:?}");
+    }
+
+    // A use that couldn't be followed (forms nested too deep) may be where DefaultGray is in force.
+    let mut doc = Document::new_empty();
+    let img = image(&mut doc, "DeviceRGB", &rgb_data, &[]);
+    let deep = nested_forms(&mut doc, img, 13);
+    page(&mut doc, &[("Im", img), ("F", deep)], &draw(&["Im", "F"]));
+    let before = stream(&doc, img);
+    optimize(&mut doc, &settings).unwrap();
+    assert_eq!(stream(&doc, img).raw, before.raw, "a use not followed");
+}
+
 /// Black-and-white images above 450 ppi are averaged down to 300 ppi, by default: 1-bit Flate, CCITT
 /// Group 4 (alone and behind ASCIIHexDecode), an image mask (its inverting decode array stays), and
 /// eight-bit grey and RGB of only black and white (the RGB also the other way round, with a decode
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index bc4c68d538..048afd9a36 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB and RGB with a profile aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn where /DefaultGray or /DefaultRGB is in force, and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 68c6d4b052e17943bedec0461a295f29362f4718 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:29:04 +0100
Subject: [PATCH 194/270] M11: redaction's decode allowance takes ASCIIHex text
 broken into lines; tests for the bounds

- Redaction decodes an image no further than twice its raster plus a
  byte a row, meant for ASCIIHex text under Flate; hex text broken into
  lines is a little more, so such an image was removed whole instead of
  cleared (already so on main). It is three bytes for each now, as the
  optimizer allows.
- Tests: grey stored as hex text in lines under Flate, and RGB behind a
  filter array (which a fax image's bound would refuse), are cleared;
  decoded_image_within gives a fax image no more rows than its bound
  holds.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/cos/src/document/tests.rs |  7 +++++++
 crates/redact/src/image.rs       |  5 +++--
 crates/redact/src/tests.rs       | 33 ++++++++++++++++++++++++++++++++
 3 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index aeb5184729..53941f02b1 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -118,6 +118,13 @@ fn fax_images_decode_with_their_parameters() {
         [0b0000_0111, 0b1100_0000, 0b0000_0111, 0b1100_0000, 0b0000_0111, 0b1100_0000]
     );
     assert_eq!(image(&doc, Some(Object::Dict(parms.clone())), 10, 2).unwrap(), bits[..4], "at most /Height rows");
+    // Within a bound: no more rows than it holds.
+    let mut bounded = Dict::new();
+    bounded.set(b"Width".to_vec(), Object::Int(10));
+    bounded.set(b"Height".to_vec(), Object::Int(3));
+    bounded.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+    bounded.set(b"DecodeParms".to_vec(), Object::Dict(parms.clone()));
+    assert_eq!(doc.decoded_image_within(&Stream::from_raw(bounded, coded.clone()), 5).unwrap(), bits[..4], "two rows of two bytes in five");
     let mut by_reference = Dict::new();
     by_reference.set(b"K".to_vec(), Object::Ref(doc.add(Object::Int(-1))));
     by_reference.set(b"Columns".to_vec(), Object::Ref(doc.add(Object::Int(10))));
diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index a1bf022df1..297b3510c4 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -86,14 +86,15 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     let row_bits = row.checked_mul(8)?;
     bytes.checked_mul(8)?;
     // Decode no further than the raster can need: a filter stage may legitimately produce up to
-    // twice it (ASCIIHex text under Flate) plus a PNG predictor's byte per row. A fax image's
+    // three bytes for each of it and a PNG predictor's byte per row (ASCIIHex text under Flate,
+    // two digits a byte broken into lines or spaced), as the optimizer allows. A fax image's
     // code, which the filters before its decoder produce, takes at most about a byte per pixel
     // plus each row's end. Data past that can only be a decompression bomb; the image is then
     // removed whole.
     let allowance = if is_fax {
         w.checked_mul(h)?.checked_add(h.checked_mul(4)?)?.checked_add(4096)?
     } else {
-        bytes.checked_add(h)?.checked_mul(2)?.checked_add(4096)?
+        bytes.checked_add(h)?.checked_mul(3)?.checked_add(4096)?
     };
     // Through the document, which reads `/DecodeParms` given by reference (`Stream::decoded*`
     // alone would skip such a predictor, and the cleared bytes would then miss the covered pixels).
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index c6885eaf11..33dc675cdd 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -626,6 +626,39 @@ fn a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed() {
     }
 }
 
+/// Images whose data is more than twice their raster before its last filter are cleared, not
+/// taken for decompression bombs: grey stored as ASCIIHex text broken into lines under Flate (two
+/// digits a byte and a line break every 64), and RGB behind an array of filters, which a fax
+/// image's bound (a byte a pixel) would refuse.
+#[test]
+fn images_behind_ascii_hex_in_lines_or_a_filter_array_are_cleared() {
+    let (w, h) = (1000usize, 200usize);
+    let grey: Vec<u8> = (0..w * h).map(|i| (i % 251) as u8).collect();
+    let digits: Vec<u8> = grey.iter().flat_map(|b| format!("{b:02X}").into_bytes()).collect();
+    let mut lines: Vec<u8> = digits.chunks(64).flat_map(|line| line.iter().copied().chain(*b"\n")).collect();
+    lines.push(b'>');
+    let rgb: Vec<u8> = (0..100 * 100 * 3).map(|i| (i % 253) as u8).collect();
+    let rgb_hex: Vec<u8> = pdfcraft_filters::encode_flate(&rgb).iter().flat_map(|b| format!("{b:02x}").into_bytes()).chain(*b">").collect();
+    for (dict, data) in [
+        (
+            format!(
+                "/Type /XObject /Subtype /Image /Width {w} /Height {h} /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter [/FlateDecode /ASCIIHexDecode]"
+            ),
+            pdfcraft_filters::encode_flate(&lines),
+        ),
+        (
+            "/Type /XObject /Subtype /Image /Width 100 /Height 100 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter [/ASCIIHexDecode /FlateDecode]"
+                .to_string(),
+            rgb_hex,
+        ),
+    ] {
+        let mut doc = one_page(b"q 100 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(&dict, data)]);
+        mark(&mut doc, 0, &[[0.0, 0.0, 10.0, 10.0]], "");
+        let report = apply(&mut doc, None).unwrap();
+        assert_eq!((report.images_cleared, report.images_removed), (1, 0), "{dict}");
+    }
+}
+
 /// A fax image that can't be decoded in full is removed whole, as any other image is: one whose
 /// code is cut short, and one behind a filter that inflates past what a code for its pixels can
 /// take (a decompression bomb, which `decoded_image` alone would undo up to a gigabyte).

From cb1e573c081bbda5df72f8ecefd759d11cfca03b Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:38:22 +0100
Subject: [PATCH 195/270] M11: tests for packing in other one-component spaces,
 mixed Group 3 and Flate after resampling

Mutation testing found three behaviours no test held:
- eight-bit black-and-white in calibrated grey, an ICC profile of one
  component or a separation is packed, each keeping its colour space,
  and calibrated RGB of only 0 and 1 isn't (taking every array colour
  space for an indexed one passed every test);
- mixed Group 3 (/K 1, with end-of-line codes) is stored again as
  Group 4 (taking /K above 0 for Group 4 passed);
- a resampled Group 4 image of vertical stripes is stored as 1-bit Flate,
  which is smaller (ruling Flate out for any CCITT image passed).

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/tests/optimize.rs | 152 +++++++++++++++++++++++-------
 1 file changed, 120 insertions(+), 32 deletions(-)

diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 259e11c771..528f43d5fe 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -918,6 +918,83 @@ fn rgb_and_two_colour_indexed_black_and_white_images_become_one_bit() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// Eight-bit black-and-white images in other one-component spaces are packed too: calibrated
+/// grey, an ICC profile of one component, a separation, each keeping its colour space. Calibrated
+/// RGB whose samples are only 0 and 1 is no indexed image, and stays as it is.
+#[test]
+fn eight_bit_black_and_white_in_other_one_component_spaces_is_packed() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200u32, 480u32);
+    let text = bilevel(w, h, false);
+    let image = |doc: &mut Document, data: &[u8], cs: Object| {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), cs);
+        doc.add(Object::Stream(Stream::flate(d, data)))
+    };
+    let mut white_point = Dict::new();
+    white_point.set(b"WhitePoint".to_vec(), Object::Array(vec![Object::Real(0.9505), 1.into(), Object::Real(1.089)]));
+    let mut profile = Dict::new();
+    profile.set(b"N".to_vec(), Object::Int(1));
+    let profile = doc.add(Object::Stream(Stream::from_raw(profile, Vec::new())));
+    let mut tint = Dict::new();
+    tint.set(b"FunctionType".to_vec(), Object::Int(2));
+    tint.set(b"Domain".to_vec(), Object::Array(vec![0.into(), 1.into()]));
+    tint.set(b"N".to_vec(), Object::Int(1));
+    let spaces = [
+        Object::Array(vec![Object::name("CalGray"), Object::Dict(white_point.clone())]),
+        Object::Array(vec![Object::name("ICCBased"), Object::Ref(profile)]),
+        Object::Array(vec![Object::name("Separation"), Object::name("Spot"), Object::name("DeviceGray"), Object::Dict(tint)]),
+    ];
+    let grey = samples_of(&text, w, h, [&[0], &[255]], 8);
+    let packed = spaces.clone().map(|cs| image(&mut doc, &grey, cs));
+    let cal_rgb = Object::Array(vec![Object::name("CalRGB"), Object::Dict(white_point)]);
+    let cal_rgb = image(&mut doc, &samples_of(&text, w, h, [&[0, 0, 0], &[1, 1, 1]], 8), cal_rgb);
+    let names = ["A", "B", "C", "D"];
+    // 200 × 80 pt is 432 ppi: below where monochrome downsampling starts.
+    let content: String = (0..4).map(|i| format!("q 200 0 0 80 6 {} cm /{} Do Q ", 690 - 100 * i, names[i])).collect();
+    page(&mut doc, &names.into_iter().zip([packed[0], packed[1], packed[2], cal_rgb]).collect::<Vec<_>>(), &content);
+    let untouched = stream(&doc, cal_rgb).raw;
+    // Colour and grey settings that leave images alone, so only the packing acts.
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    optimize(&mut doc, &Settings { color: keep, gray: keep, ..Settings::default() }).unwrap();
+    for (r, cs) in packed.iter().zip(&spaces) {
+        let s = stream(&doc, *r);
+        assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.get(b"ColorSpace")), (Some(1), Some(cs)), "{cs:?}");
+    }
+    assert_eq!(stream(&doc, cal_rgb).raw, untouched, "calibrated RGB");
+}
+
+/// A resampled Group 4 image is stored as 1-bit Flate when that is smaller, as any resampled image
+/// may be: here vertical stripes, whose identical rows Flate takes for almost nothing.
+#[test]
+fn a_resampled_group_4_image_is_stored_as_flate_when_smaller() {
+    let (w, h) = (1200u32, 480u32);
+    let stripes = vec![0x0Fu8; (w as usize).div_ceil(8) * h as usize];
+    let mut doc = Document::new_empty();
+    let mut d = Dict::new();
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w.into()));
+    d.set(b"Height".to_vec(), Object::Int(h.into()));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+    let mut parms = Dict::new();
+    parms.set(b"K".to_vec(), Object::Int(-1));
+    parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+    d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+    let img = doc.add(Object::Stream(Stream::from_raw(d, pdfcraft_filters::encode_g4(&stripes, w, h).unwrap())));
+    // 144 × 57.6 pt is 600 ppi.
+    page(&mut doc, &[("A", img)], "q 144 0 0 57.6 20 600 cm /A Do Q");
+    let r = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(r.images_resampled, 1, "{r:?}");
+    let s = stream(&doc, img);
+    assert_eq!((s.dict.int(b"Width"), s.dict.name(b"Filter")), (Some(600), Some(&b"FlateDecode"[..])));
+}
+
 /// Black-and-white RGB stays RGB where grey would be drawn otherwise: drawn, on any of its uses,
 /// where `/DefaultGray` or `/DefaultRGB` is in force (ISO 32000-2 §8.6.5.6), from a page's
 /// resources or a form's own, as grey would then go through DefaultGray, or no longer through
@@ -1375,7 +1452,7 @@ fn monochrome_images_keep_what_they_should() {
 
 /// `rows` coded as CCITT Group 3, one-dimensional (`/K 0`): each row its runs in turn, white first,
 /// with ITU-T T.4's terminating codes for the few lengths used here.
-fn group_3(rows: &[&[u32]]) -> Vec<u8> {
+fn group_3(rows: &[&[u32]], mixed: bool) -> Vec<u8> {
     let code = |white: bool, run: u32| match (white, run) {
         (true, 0) => "00110101",
         (true, 8) => "10011",
@@ -1386,12 +1463,20 @@ fn group_3(rows: &[&[u32]]) -> Vec<u8> {
         (false, 32) => "000001101010",
         _ => panic!("no code here for a run of {run}"),
     };
-    let bits: String = rows.iter().flat_map(|row| row.iter().enumerate().map(|(i, run)| code(i % 2 == 0, *run))).collect();
+    let mut bits = String::new();
+    for row in rows {
+        // Mixed coding (/K above 0): an end-of-line code, then a 1 bit, the row one-dimensional.
+        if mixed {
+            bits.push_str("0000000000011");
+        }
+        row.iter().enumerate().for_each(|(i, run)| bits.push_str(code(i % 2 == 0, *run)));
+    }
     bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
 }
 
 /// A Group 3 fax image is stored again as Group 4 when that is smaller, the same picture (to the
-/// pixel on the page); with Retain it stays Group 3.
+/// pixel on the page); with Retain it stays Group 3. One-dimensional (/K 0) and mixed (/K 1, with
+/// end-of-line codes) alike.
 #[test]
 fn group_3_fax_images_become_group_4() {
     let (w, h) = (64u32, 64u32);
@@ -1411,38 +1496,41 @@ fn group_3_fax_images_become_group_4() {
         }
         bits.extend(packed);
     }
-    let g3 = group_3(&runs);
-    let p = pdfcraft_filters::CcittParams { k: 0, columns: w.into(), ..Default::default() };
-    assert_eq!(pdfcraft_filters::decode_ccitt(&g3, &p, h).unwrap(), bits, "the Group 3 data is the picture");
+    for k in [0, 1] {
+        let g3 = group_3(&runs, k > 0);
+        let p = pdfcraft_filters::CcittParams { k, columns: w.into(), end_of_line: k > 0, ..Default::default() };
+        assert_eq!(pdfcraft_filters::decode_ccitt(&g3, &p, h).unwrap(), bits, "/K {k}: the Group 3 data is the picture");
 
-    let mut doc = Document::new_empty();
-    let mut d = Dict::new();
-    d.set(b"Subtype".to_vec(), Object::name("Image"));
-    d.set(b"Width".to_vec(), Object::Int(w.into()));
-    d.set(b"Height".to_vec(), Object::Int(h.into()));
-    d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
-    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
-    d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
-    let mut parms = Dict::new();
-    parms.set(b"K".to_vec(), Object::Int(0));
-    parms.set(b"Columns".to_vec(), Object::Int(w.into()));
-    parms.set(b"Rows".to_vec(), Object::Int(h.into()));
-    d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
-    let fax = doc.add(Object::Stream(Stream::from_raw(d, g3.clone())));
-    page(&mut doc, &[("A", fax)], "q 64 0 0 64 100 600 cm /A Do Q");
-    let before = render(&doc);
+        let mut doc = Document::new_empty();
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+        let mut parms = Dict::new();
+        parms.set(b"K".to_vec(), Object::Int(k));
+        parms.set(b"EndOfLine".to_vec(), Object::Bool(k > 0));
+        parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+        parms.set(b"Rows".to_vec(), Object::Int(h.into()));
+        d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        let fax = doc.add(Object::Stream(Stream::from_raw(d, g3.clone())));
+        page(&mut doc, &[("A", fax)], "q 64 0 0 64 100 600 cm /A Do Q");
+        let before = render(&doc);
 
-    let mut kept = doc.clone();
-    optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
-    assert_eq!(stream(&kept, fax).raw[..], g3[..], "Retain keeps Group 3");
+        let mut kept = doc.clone();
+        optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
+        assert_eq!(stream(&kept, fax).raw[..], g3[..], "/K {k}: Retain keeps Group 3");
 
-    let r = optimize(&mut doc, &Settings::default()).unwrap();
-    assert_eq!((r.images_resampled, r.images_recompressed), (0, 1), "{r:?}");
-    let s = stream(&doc, fax);
-    assert_eq!(doc.fax_params(&s).map(|p| p.k), Some(-1), "Group 4");
-    assert!(s.raw.len() < g3.len(), "{} bytes, from {}", s.raw.len(), g3.len());
-    assert_eq!(doc.decoded_image(&s).unwrap(), bits, "the same picture");
-    assert!(render(&doc) == before, "the page looks the same");
+        let r = optimize(&mut doc, &Settings::default()).unwrap();
+        assert_eq!((r.images_resampled, r.images_recompressed), (0, 1), "/K {k}: {r:?}");
+        let s = stream(&doc, fax);
+        assert_eq!(doc.fax_params(&s).map(|p| p.k), Some(-1), "/K {k}: Group 4");
+        assert!(s.raw.len() < g3.len(), "{} bytes, from {}", s.raw.len(), g3.len());
+        assert_eq!(doc.decoded_image(&s).unwrap(), bits, "/K {k}: the same picture");
+        assert!(render(&doc) == before, "/K {k}: the page looks the same");
+    }
 }
 
 #[test]

From d92ec2101a75ce1b097d26e383f64c5b0c546995 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:30:23 +0100
Subject: [PATCH 196/270] M11: monochrome downsampling's docs: halftones, the
 column cap, mask streams, what is left alone

- The optimize README, the crate doc and both parity notes say a
  halftone or dither, and an image wider than a fax row, isn't averaged
  down.
- The README's "Left alone" list is the colour and grey settings'; image
  masks, decode arrays and CCITT go to Monochrome Images now. Its
  monochrome "Not yet" names an image's own /SMask or /Mask image again
  (only images drawn on a page are visited), as the parity note does;
  the parity note's row limit is Group 4's.
- docs/architecture.md says CCITT decodes through pdfcraft-filters for
  export, redaction and the optimizer, not only the renderer.
- docs/target-app-parity.md no longer lists monochrome downsampling as
  missing.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/README.md    | 18 ++++++++++++------
 crates/optimize/src/lib.rs   | 13 +++++++------
 docs/architecture.md         |  6 ++++--
 docs/target-app-parity.md    |  4 +++-
 parity/acrobat-features.toml |  4 ++--
 5 files changed, 28 insertions(+), 17 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 3ff33728db..4709111278 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -29,8 +29,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   measured (forms nested deeper, or drawn too many times), no image is resampled. Colour and grayscale images above a
   threshold are resampled with a bicubic (Catmull-Rom) filter to a target resolution and
   stored as JPEG (Acrobat's quality steps) or ZIP; soft masks are resampled with their image.
-  An image is replaced only if the result is smaller. Left alone: CMYK and other colour spaces,
-  image masks, decode arrays, more than 8 bits, JPEG 2000, JBIG2 and CCITT. A JPEG is read with
+  An image is replaced only if the result is smaller. Left alone by these colour and grey
+  settings: CMYK and other colour spaces, image masks, decode arrays, more than 8 bits, JPEG 2000,
+  JBIG2 and CCITT (black-and-white images, CCITT among them, are below). A JPEG is read with
   its colour transform (an Adobe marker's, else `/ColorTransform`, ISO 32000-2 §7.4.8), so one
   stored untransformed keeps its colours; one whose marker and `/ColorTransform` disagree is left
   alone, since readers differ on which wins. Samples are read with `/DecodeParms` given by
@@ -39,7 +40,8 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
 - **Monochrome images** (`Settings::mono`, `MonoSettings::REDUCE` by default: to 300 ppi above
   450 ppi, CCITT Group 4). Black-and-white images are a 1-bit image with one colour component
   (grey, indexed, a separation) or an image mask, stored with no filter, with general-purpose ones
-  or with CCITT fax after any of those (decoded by `Document::decoded_image`), and an eight-bit grey image of
+  or with CCITT fax after any of those (decoded by `Document::decoded_image_within`, no further
+  than its rows can need), and an eight-bit grey image of
   only 0 and 255, packed to one bit (not an indexed image, whose samples are palette indices, nor
   one with a colour-key `/Mask`) unless the grey settings make it smaller still, its soft mask counted
   (resampled with it there, kept as it is here), as they can a dithered scan by downsampling it to
@@ -49,8 +51,11 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
     tie, so a dark line half a new pixel wide stays: black in grey and the painted part of an image
     mask (a 0, or a 1 with an inverting decode array), full ink in a separation (a 1, or a 0), and
     entry 0 of an indexed image, whatever colour its palette gives it (the palette isn't read yet).
-    Not one with a soft mask, whose own size would have to follow. On a 600 ppi text page, Group 4
-    at 300 ppi is half the size.
+    Not one with a soft mask, whose own size would have to follow; not a halftone or a dither,
+    most of whose new pixels would cover both black and white, so that taking the sample covering
+    more would turn its tones solid (a 50% screen black, a 25% one white); and not one wider than
+    a fax row (`pdfcraft_filters::MAX_CCITT_COLUMNS`), as the averaging keeps a counter for each
+    column. On a 600 ppi text page, Group 4 at 300 ppi is half the size.
   - **Compression:** CCITT Group 4 (`pdfcraft_filters::encode_g4`), or 1-bit Flate when that is
     smaller, which only a resampled image or one packed from eight bits may be: a 1-bit image that
     is only stored again becomes Group 4 or stays. A CCITT image is only decoded to be resampled,
@@ -60,7 +65,8 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
     space, decode array and `/Mask` stay. Group 4 wins on scans, whose ragged edges defeat Flate;
     on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, Group 3 to Group 4
-    without resampling, inline images, and Group 4 for rows wider than 32,767 samples.
+    without resampling, inline images, an image's own `/SMask` or `/Mask` image (only images drawn
+    on a page are visited), and Group 4 for rows wider than 32,767 samples.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index e911055941..a8a24b6aed 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -7,12 +7,13 @@
 //! - **Images:** each image's effective resolution is measured where pages draw it (the
 //!   smallest over its uses, through form XObjects); colour and grayscale images above a
 //!   threshold are resampled (bicubic) to a target resolution and recompressed as JPEG or Flate.
-//!   A new image replaces the old one only if it is smaller. Images PdfCraft can't decode
-//!   faithfully (CMYK and other colour spaces, masks, decode arrays other than the default,
-//!   JPEG 2000, JBIG2, CCITT, other than 8 bits, JPEGs whose Adobe marker and `/ColorTransform`
-//!   disagree) are left alone. Black-and-white images (1-bit, CCITT fax among them, and eight-bit
-//!   grey of only black and white) above a threshold are averaged down to a target resolution, and
-//!   are stored as CCITT Group 4 when that is smaller.
+//!   A new image replaces the old one only if it is smaller. The colour and grey settings leave
+//!   alone images they can't decode faithfully (CMYK and other colour spaces, masks, decode arrays
+//!   other than the default, JPEG 2000, JBIG2, CCITT, other than 8 bits, JPEGs whose Adobe marker
+//!   and `/ColorTransform` disagree). Black-and-white images (1-bit, image masks
+//!   and CCITT fax among them, and eight-bit grey of only black and white) above a threshold are
+//!   averaged down to a target resolution, halftones and dithers aside, and are stored as CCITT
+//!   Group 4 when that is smaller.
 //! - **Discard objects:** page thumbnails, alternate images, document tags (structure tree),
 //!   print settings.
 //! - **Clean up:** drop images and forms that pages list but never draw (such as a deleted
diff --git a/docs/architecture.md b/docs/architecture.md
index 07448054bd..008cae903d 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -71,8 +71,10 @@ The PDF object graph *is* the model (`crates/engine/README.md` §The editing mod
 ## File I/O
 
 - PDF in: any revision chain, xref tables or streams, hybrid files, damaged files (repaired and
-  logged), all standard-security revisions. Image codecs (DCT, JPX, JBIG2, CCITT) decode through
-  the bootstrap renderer for display; Export ▸ Images decodes CCITT (`hayro-ccitt`) and JPEG itself.
+  logged), all standard-security revisions. Image codecs (DCT, JPX, JBIG2) decode through the
+  bootstrap renderer; CCITT decodes through `pdfcraft-filters` (`decode_ccitt`, behind
+  `Document::decoded_image`) for export, redaction and the optimizer, and through the renderer
+  for display. Export ▸ Images decodes JPEG itself.
 - PDF out: incremental or full saves, object streams, re-encryption, resource de-duplication when
   combining.
 - Other formats: images and text in (`create`); PNG/JPEG/TIFF, text, RTF, Word and HTML out
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index d790e98178..33eb645155 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,5 +1,6 @@
 # PdfCraft parity with Adobe Acrobat Pro
 
+> **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-26 · **Change:** minor (K Optimize and standards no longer lists monochrome downsampling as missing; scores and estimates unchanged)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-26 · **Change:** minor (`optimize.mono-compression` partial (CCITT Group 4): K Optimize and standards 15 shipped and 11 partial of 58, 35.3%; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497); estimates unchanged)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-25 · **Change:** minor (localization current state: Arabic logical catalog, explicit RTL direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite. Scores and estimates unchanged)
 
@@ -209,7 +210,7 @@ full parity in that area.
 | H Digital signatures | 45 | 23 | 10 | 62.2% | 45% | 40–70 | PAdES B-B signing and validation (PKCS #12, macOS Keychain, Windows store with PIN prompts), certification, encrypted documents, certificate usage checks; B-T, LTV, OCSP/CRL with caller-supplied evidence. Missing: PKCS #11 and smart cards outside Windows, timestamp-server preferences, online revocation fetching, FieldMDP and field locking, OS trust store, EU Trusted Lists, compare signed version |
 | I Scan and OCR | 26 | 5 | 2 | 23.1% | 15% | 40–75 | Searchable image (ocrs, Latin script without accents) on pages, ranges and many files. Missing: every other language (#744 Dutch; accents, CJK, Cyrillic, Arabic), editable-text output, deskew, rotation, despeckle, camera images beyond straightening (found or placed corners): orientation, clean-up, MRC compression, scanners |
 | J Create and export | 34 | 12 | 3 | 39.7% | 25% | 55–100 | Create from images, multipage TIFF, text, clipboard, blank, many files at once; export PNG/JPEG/TIFF, text, RTF; Word and HTML partial. Missing: Office/HTML/web/PostScript to PDF, Excel and PowerPoint export, Word layout fidelity (#773), SVG/XML/EPS/PS/JPEG 2000 export, accessible text |
-| K Optimize and standards | 58 | 15 | 11 | 35.3% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2 and downsampling |
+| K Optimize and standards | 58 | 15 | 11 | 35.3% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2 |
 | L Print | 39 | 15 | 1 | 39.7% | 35% | 30–55 | Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, print-ready PDF, CUPS on macOS/Linux, the Windows spooler (#756) and the browser's print dialog on the web. Missing: print as image, PostScript, all print-production tools (output preview, separations, ink manager, printer marks, colour conversion) |
 | M Accessibility | 61 | 38 | 1 | 63.1% | 30% | 40–70 | Accessibility Checker (all 32 rules, report, fixes), alternate text, title and language. Missing: autotag, Tags/Order/Content panels, Reading Order tool, artifact marking, table editor, Read Out Loud, full keyboard operation of the app, screen-reader audit |
 | N Automation, preferences, misc | 75 | 20 | 5 | 30.0% | 35% | 25–45 | CLI, MCP, UI control channel, 141 automation tools, Action Wizard (run, create), compare (text, visual, report, side by side, Text/Visual filter). Missing: most Preferences pages, Acrobat's finer compare filters, Action Wizard management, custom commands, AI providers, rich media/3D, hosted web app |
@@ -295,6 +296,7 @@ licensed OCR or AI model.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | K Optimize and standards no longer lists monochrome downsampling as missing (black-and-white images above 450 ppi are averaged down to 300). Scores and estimates unchanged. |
 | 2026-10-26 | minor | `optimize.mono-compression` became partial (CCITT Group 4), counted on the table's own measurement: K Optimize and standards 15 shipped and 11 partial of 58 (35.3%), no longer listing CCITT as missing; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497). Estimates unchanged. |
 | 2026-10-25 | minor | Localization current state: Arabic catalogs stay logical, Arabic/Kurdish labels take an explicit RTL direction, and stock chrome mirrors; native/browser RTL input, IME and complex workflows remain unqualified. Native Simplified Chinese uses LXGW WenKai Lite; the web build has no Hans face. Scores and estimates unchanged. |
 | 2026-10-20 | minor | M12 #3673: the Character encoding rule accepts Identity-H/V fonts with Adobe CJK collections, or a predefined non-Identity CMap, while rejecting unknown names and foreign registries. Synthetic checker and read-only automation regressions passed after failing before the fix; per-glyph mapping validation and embedded-font extraction remain separate. Breadth, readiness and hours unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 6e67d4aa9a..d656b51a22 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7361,7 +7361,7 @@ status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
 evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::black_and_white_images_above_450_ppi_are_averaged_down_to_300", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, halftones and dithers (most of their new pixels would cover both black and white, and their tones turn solid), or images wider than a fax row (1,048,576 samples), and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]
 id = "optimize.recompress-images"
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), Group 3 to Group 4 without resampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), Group 3 to Group 4 without resampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 740bb874a4c5b998d49e08cbc3e4fe6dfe13ddce Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:38:22 +0100
Subject: [PATCH 197/270] M11: say damaged Group 3 with end-of-line codes is
 stored as the decoder recovers it

With end-of-line codes, the CCITT decoder picks a bad row up again at
the next code and reports no damage (an invalid code, a row of too many
pixels: probed as a black box), so such an image is stored again as
Group 4 the way it decodes. Without them, damage stops the decoding,
too few rows come out, and the image is left alone. Telling damage
apart would take a Group 3 parser of our own; the optimize README and
the mono-compression parity note say so instead.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/README.md    | 9 ++++++---
 parity/acrobat-features.toml | 2 +-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index e26ceba945..6383510c96 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -68,9 +68,12 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
     smaller, which only a resampled image or one packed from more bits may be: a 1-bit image that
     is only stored again becomes Group 4 or stays. Group 4 alone is only decoded to be resampled;
     Group 3, or Group 4 inside another filter such as `ASCII85Decode`, is stored again as Group 4
-    alone when that is smaller. With Retain, a resampled image keeps its kind of compression (CCITT,
-    or Flate) and nothing else changes; an image of more bits is then left to the grey or colour
-    settings. Every change is kept only when it is smaller as stored.
+    alone when that is smaller. Damaged Group 3 with end-of-line codes is stored as the decoder
+    recovers it, a bad row picked up again at the next code, as it reports no damage there; without
+    them, damage stops the decoding and the image is left alone. With Retain, a resampled image
+    keeps its kind of compression (CCITT, or Flate) and nothing else changes; an image of more bits
+    is then left to the grey or colour settings. Every change is kept only when it is smaller as
+    stored.
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
     space, decode array and `/Mask` stay, but for packed RGB, which becomes grey with one decode
     pair. Group 4 wins on scans, whose ragged edges defeat Flate; on clean computer-drawn 1-bit
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 048afd9a36..6cc4f4797c 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn where /DefaultGray or /DefaultRGB is in force, and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn where /DefaultGray or /DefaultRGB is in force, and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 5f3fde33d69da18575ef285e4fc878bf0b8acd3d Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 18:07:40 +0100
Subject: [PATCH 198/270] M11: tests for what Monochrome Images keeps, and for
 the fax bounds; Retain's wording

Mutation testing found behaviour no test held, now covered:
- a Group 4 halftone above 450 ppi isn't resampled and stays byte for
  byte, alone by default and behind ASCIIHexDecode with Retain;
- under Retain a resampled Flate scan stays Flate, though Group 4 would
  be smaller (ragged bands);
- sixteen-bit grey of only 0x0000 and 0xFFFF keeps its bytes;
- a busy Group 4 image behind ASCIIHexDecode, whose code is over three
  times its raster, decodes within the fax bound and is stored again as
  Group 4 alone. Redaction's busy-fax test is that busy again: since the
  bound for other images is three times the raster, the old checkerboard
  fitted it, and dropping the fax bound passed.
The redaction README says three times, and doc_optimize's description
says what Retain keeps: CCITT stays CCITT, anything else becomes Flate.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/automation/src/tools.rs    |  2 +-
 crates/optimize/tests/optimize.rs | 97 +++++++++++++++++++++++++++++++
 crates/redact/README.md           |  5 +-
 crates/redact/src/tests.rs        | 11 ++--
 4 files changed, 107 insertions(+), 8 deletions(-)

diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index cdf62ebd8e..3f53a07ff9 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1433,7 +1433,7 @@ pub fn tools() -> Vec<ToolDef> {
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
             .with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
-        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 when that is smaller, counted in images_recompressed; retain resamples only, keeping each image's kind of compression). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
+        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 when that is smaller, counted in images_recompressed; retain resamples only, a CCITT image staying CCITT and any other becoming Flate). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
             .cmd("optimize.advanced")
             .with(schema(
                 json!({
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 4efe4072d2..f9676144c4 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1019,6 +1019,103 @@ fn a_fax_image_behind_a_decompression_bomb_is_left_alone() {
     }
 }
 
+/// A CCITT image `w` × `h` coded as Group 4 from `bits`, behind ASCIIHexDecode when `hex`.
+fn g4_image(doc: &mut Document, bits: &[u8], (w, h): (u32, u32), hex: bool) -> ObjRef {
+    let g4 = pdfcraft_filters::encode_g4(bits, w, h).unwrap();
+    let mut d = Dict::new();
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w.into()));
+    d.set(b"Height".to_vec(), Object::Int(h.into()));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    let mut parms = Dict::new();
+    parms.set(b"K".to_vec(), Object::Int(-1));
+    parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+    let data = if hex {
+        d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("ASCIIHexDecode"), Object::name("CCITTFaxDecode")]));
+        d.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Null, Object::Dict(parms)]));
+        g4.iter().flat_map(|b| format!("{b:02x}").into_bytes()).chain(*b">").collect()
+    } else {
+        d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+        d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        g4
+    };
+    doc.add(Object::Stream(Stream::from_raw(d, data)))
+}
+
+/// What Monochrome Images leaves alone and what it may still do. A Group 4 halftone above 450 ppi
+/// isn't resampled, so it stays byte for byte: alone, by default; behind ASCIIHexDecode, with
+/// Retain (by default it is stored again as Group 4 alone). Under Retain a resampled Flate scan
+/// stays Flate though Group 4 would be smaller. A busy Group 4 image behind ASCIIHexDecode, whose
+/// code is more than three times its raster, decodes within a fax code's bound and is stored
+/// again as Group 4 alone. Sixteen-bit grey of only 0x0000 and 0xFFFF isn't eight-bit black and
+/// white, and keeps its bytes.
+#[test]
+fn monochrome_images_keep_what_they_should() {
+    let (w, h) = (1200u32, 480u32);
+    let stride = (w as usize).div_ceil(8);
+    let checker: Vec<u8> = (0..h as usize).flat_map(|y| vec![if y % 2 == 0 { 0xAA } else { 0x55 }; stride]).collect();
+    let mut seed = 0x2545_F491_4F6C_DD1Du64;
+    let mut next = move || {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        seed
+    };
+    // Twelve dark bands a row, their edges ragged by up to five samples, as a scan's are.
+    let mut ragged = vec![0xFFu8; stride * h as usize];
+    for y in 0..h as usize {
+        for band in 0..12 {
+            let (x0, x1) = (band * 100 + (next() % 5) as usize, band * 100 + 50 + (next() % 5) as usize);
+            for x in x0..x1.min(w as usize) {
+                ragged[y * stride + x / 8] &= !(0x80 >> (x % 8));
+            }
+        }
+    }
+    let busy: Vec<u8> = (0..256).flat_map(|y| [if y % 2 == 0 { 0xAA } else { 0xFF }; 32]).collect();
+    let build = || {
+        let mut doc = Document::new_empty();
+        let alone = g4_image(&mut doc, &checker, (w, h), false);
+        let wrapped = g4_image(&mut doc, &checker, (w, h), true);
+        let grey = [("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))];
+        let scan = mono_image(&mut doc, w, h, &ragged, None, &grey);
+        let fax = g4_image(&mut doc, &busy, (256, 256), true);
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(16));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        let samples: Vec<u8> = eight_bit(&bilevel(w, h, false), w, h).iter().flat_map(|v| [*v, *v]).collect();
+        let deep = doc.add(Object::Stream(Stream::flate(d, &samples)));
+        // 144 × 57.6 pt is 600 ppi; 46.08 pt for 256 samples is 400 ppi.
+        page(
+            &mut doc,
+            &[("A", alone), ("B", wrapped), ("C", scan), ("D", fax), ("E", deep)],
+            "q 144 0 0 57.6 20 700 cm /A Do Q q 144 0 0 57.6 200 700 cm /B Do Q q 144 0 0 57.6 20 600 cm /C Do Q \
+             q 46.08 0 0 46.08 200 600 cm /D Do Q q 144 0 0 57.6 20 500 cm /E Do Q",
+        );
+        (doc, [alone, wrapped, scan, fax, deep])
+    };
+    let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
+    let filters = |doc: &Document, r: ObjRef| stream(doc, r).filters().len();
+
+    let (mut doc, [alone, wrapped, scan, fax, deep]) = build();
+    let before = [alone, deep].map(|r| raw(&doc, r));
+    optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!([alone, deep].map(|r| raw(&doc, r)), before, "a Group 4 halftone alone, and sixteen-bit grey");
+    assert_eq!(filters(&doc, wrapped), 1, "a wrapped Group 4 halftone is stored again alone by default");
+    assert_eq!(stream(&doc, scan).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "the scan: Group 4 is smaller");
+    assert_eq!((stream(&doc, fax).dict.name(b"Filter"), filters(&doc, fax)), (Some(&b"CCITTFaxDecode"[..]), 1), "the busy fax image");
+
+    let (mut doc, [_, wrapped, scan, _, _]) = build();
+    let before = raw(&doc, wrapped);
+    let r = optimize(&mut doc, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
+    assert_eq!(raw(&doc, wrapped), before, "Retain: a wrapped Group 4 halftone stays as it is");
+    let s = stream(&doc, scan);
+    assert_eq!((s.dict.int(b"Width"), s.dict.name(b"Filter")), (Some(600), Some(&b"FlateDecode"[..])), "Retain: Flate stays Flate: {r:?}");
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();
diff --git a/crates/redact/README.md b/crates/redact/README.md
index 75648b3cc4..6d273c2341 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -22,8 +22,9 @@ clear_marks(&mut doc, None)?;                        // remove marks without app
   filter, decoded through `Document::decoded_image_within`; `/DecodeParms` given by reference,
   numbers inside included, count). Codecs redaction doesn't decode (DCT, JPX, JBIG2) are removed
   whole (fail-closed); inline images under an area are removed. Images with separate `/SMask`
-  or `/Mask` data, and images whose data decodes to more than twice their declared raster (plus
-  a byte per row and 4 KiB; for a fax image's code, about a byte per pixel), are removed whole;
+  or `/Mask` data, and images whose data decodes to more than three times their declared raster
+  and a byte per row, plus 4 KiB (ASCIIHex text broken into lines under Flate is a little over
+  twice; for a fax image's code, about a byte per pixel), are removed whole;
   cleared copies drop `/Alternates` so alternate pixels cannot survive;
 - **vectors**: covered paths are removed; partly covered paths and shadings are clipped so
   nothing paints inside the areas;
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index 33dc675cdd..ffa02d939c 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -684,15 +684,16 @@ fn a_fax_image_that_cannot_be_decoded_in_full_is_removed_whole() {
     }
 }
 
-/// A busy fax image is cleared, though its code is bigger than twice its raster (the bound for
-/// other images): a code takes up to about a byte per pixel, and the fax image gets that much.
+/// A busy fax image is cleared, though its code is bigger than three times its raster (the bound
+/// for other images): a code takes up to about a byte per pixel, and the fax image gets that much.
 #[test]
 fn a_busy_fax_image_behind_another_filter_is_cleared() {
-    // A 256 × 256 checkerboard, the worst case for a fax code.
-    let rows: Vec<u8> = (0..256).flat_map(|y| [if y % 2 == 0 { 0xAA } else { 0x55 }; 32]).collect();
+    // 256 × 256, rows of a one-pixel checkerboard between white ones: each checkered row is coded
+    // afresh against the white one above it, about four bits a pixel.
+    let rows: Vec<u8> = (0..256).flat_map(|y| [if y % 2 == 0 { 0xAA } else { 0xFF }; 32]).collect();
     let g4 = pdfcraft_filters::encode_g4(&rows, 256, 256).unwrap();
     let raster = 32 * 256;
-    assert!(g4.len() > (raster + 256) * 2 + 4096, "{} bytes: within the bound for other images", g4.len());
+    assert!(g4.len() > (raster + 256) * 3 + 4096, "{} bytes: within the bound for other images", g4.len());
     let dict = "/Type /XObject /Subtype /Image /Width 256 /Height 256 /ColorSpace /DeviceGray /BitsPerComponent 1 \
                 /Filter [/FlateDecode /CCITTFaxDecode] /DecodeParms [null << /K -1 /Columns 256 /Rows 256 >>]";
     let mut doc = one_page(b"q 256 0 0 256 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(dict, pdfcraft_filters::encode_flate(&g4))]);

From 2cbbae458c189a278d58eede9c96bc2291946727 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 18:12:37 +0100
Subject: [PATCH 199/270] M11: decode arrays read as numbers however written;
 Retain keeps a Group 3 halftone

- Packing compared an indexed image's decode array, and RGB's pairs, as
  written: [0 255.0], an entry by reference or a real among RGB's pairs
  stopped it, though they mean the same as integers. Each entry is
  resolved and read as a number now, as is_identity_decode and
  dark_is_one read them; RGB's pair is written back direct.
- A test holds that Retain stores nothing again it doesn't resample: a
  Group 3 halftone above 450 ppi, which isn't averaged down, stays Group
  3 byte for byte (the guard's || as && passed every test).

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/src/images.rs     | 15 ++++--
 crates/optimize/tests/optimize.rs | 79 +++++++++++++++++++++++++++++++
 2 files changed, 90 insertions(+), 4 deletions(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 71fa945da4..a9e87e1afc 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -637,7 +637,13 @@ fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool) -> Option<(Ve
         return None;
     }
     let cs = d.get(b"ColorSpace")?;
-    let decode = d.get(b"Decode").map(|v| doc.resolve(v));
+    // The decode array's numbers, each given directly or by reference, as integers or reals; `None`
+    // when it has something else.
+    let decode = match d.get(b"Decode").map(|v| doc.resolve(v)).as_deref() {
+        None => None,
+        Some(Object::Array(v)) => Some(v.iter().map(|e| doc.resolve(e).as_f64()).collect::<Option<Vec<f64>>>()?),
+        Some(_) => return None,
+    };
     let mut packed = d.clone();
     packed.set(b"BitsPerComponent".to_vec(), Object::Int(1));
     // Components a pixel, bits a component, and a pixel's samples as 1 or 0.
@@ -646,7 +652,7 @@ fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool) -> Option<(Ve
             let bpc = bits.filter(|b| matches!(b, 2 | 4 | 8))?;
             match decode.as_deref() {
                 None => {}
-                Some(Object::Array(v)) if v[..] == [Object::Int(0), Object::Int((1 << bpc) - 1)] => {
+                Some([d0, d1]) if *d0 == 0.0 && *d1 == f64::from((1u32 << bpc) - 1) => {
                     packed.remove(b"Decode");
                 }
                 Some(_) => return None,
@@ -664,8 +670,9 @@ fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool) -> Option<(Ve
             }
             match decode.as_deref() {
                 None => {}
-                Some(Object::Array(v)) if v.len() == 6 && v.chunks(2).all(|pair| Some(pair) == v.get(..2)) => {
-                    packed.set(b"Decode".to_vec(), Object::Array(v.get(..2)?.to_vec()));
+                Some(v @ [d0, d1, ..]) if v.len() == 6 && v.chunks(2).all(|pair| pair == [*d0, *d1]) => {
+                    let number = |n: f64| if n.fract() == 0.0 { Object::Int(n as i64) } else { Object::Real(n) };
+                    packed.set(b"Decode".to_vec(), Object::Array(vec![number(*d0), number(*d1)]));
                 }
                 Some(_) => return None,
             }
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 528f43d5fe..28ccca1874 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -995,6 +995,83 @@ fn a_resampled_group_4_image_is_stored_as_flate_when_smaller() {
     assert_eq!((s.dict.int(b"Width"), s.dict.name(b"Filter")), (Some(600), Some(&b"FlateDecode"[..])));
 }
 
+/// A decode array is read as numbers, whichever way they are written: an indexed image's default
+/// as `[0 255.0]` or with an entry by reference, and RGB's inverting pairs with a real among them,
+/// pack as when written as integers.
+#[test]
+fn decode_arrays_read_as_numbers_however_written() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200u32, 480u32);
+    let text = bilevel(w, h, false);
+    let image = |doc: &mut Document, data: &[u8], cs: Object, decode: Object| {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), cs);
+        d.set(b"Decode".to_vec(), decode);
+        doc.add(Object::Stream(Stream::flate(d, data)))
+    };
+    let palette = Object::Array(vec![
+        Object::name("Indexed"),
+        Object::name("DeviceRGB"),
+        1.into(),
+        Object::String(pdfcraft_cos::PdfString::literal(vec![0, 0, 255, 255, 255, 255])),
+    ]);
+    let indices = samples_of(&text, w, h, [&[0], &[1]], 8);
+    let max = doc.add(Object::Int(255));
+    let real = image(&mut doc, &indices, palette.clone(), Object::Array(vec![0.into(), Object::Real(255.0)]));
+    let referred = image(&mut doc, &indices, palette, Object::Array(vec![0.into(), Object::Ref(max)]));
+    let rgb = samples_of(&text, w, h, [&[0, 0, 0], &[255, 255, 255]], 8);
+    let pairs = Object::Array(vec![1.into(), 0.into(), 1.into(), 0.into(), Object::Real(1.0), 0.into()]);
+    let inverted = image(&mut doc, &rgb, Object::name("DeviceRGB"), pairs);
+    page(
+        &mut doc,
+        &[("A", real), ("B", referred), ("C", inverted)],
+        "q 200 0 0 80 6 690 cm /A Do Q q 200 0 0 80 6 590 cm /B Do Q q 200 0 0 80 6 490 cm /C Do Q",
+    );
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    optimize(&mut doc, &Settings { color: keep, gray: keep, ..Settings::default() }).unwrap();
+    for r in [real, referred] {
+        let s = stream(&doc, r);
+        assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.get(b"Decode")), (Some(1), None), "{r:?}");
+    }
+    let s = stream(&doc, inverted);
+    let decode = Object::Array(vec![1.into(), 0.into()]);
+    assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.get(b"Decode")), (Some(1), Some(&decode)));
+}
+
+/// With Retain, a Group 3 halftone above 450 ppi, which isn't resampled, stays Group 3 byte for
+/// byte: Retain stores nothing again that it doesn't resample.
+#[test]
+fn retain_keeps_a_group_3_halftone_as_it_is() {
+    let (w, h) = (64u32, 64u32);
+    let a: Vec<u32> = vec![1; 64];
+    let b: Vec<u32> = std::iter::once(0).chain(std::iter::repeat_n(1, 64)).collect();
+    let runs: Vec<&[u32]> = (0..h).map(|y| if y % 2 == 0 { &a[..] } else { &b[..] }).collect();
+    let g3 = group_3(&runs, false);
+    let mut doc = Document::new_empty();
+    let mut d = Dict::new();
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w.into()));
+    d.set(b"Height".to_vec(), Object::Int(h.into()));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+    let mut parms = Dict::new();
+    parms.set(b"K".to_vec(), Object::Int(0));
+    parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+    d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+    let fax = doc.add(Object::Stream(Stream::from_raw(d, g3.clone())));
+    // 7.68 pt for 64 samples is 600 ppi.
+    page(&mut doc, &[("A", fax)], "q 7.68 0 0 7.68 100 600 cm /A Do Q");
+    assert_eq!(doc.decoded_image(&stream(&doc, fax)).unwrap().len(), 64 * 8, "the fixture decodes");
+    let r = optimize(&mut doc, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
+    assert_eq!((r.images_resampled, r.images_recompressed), (0, 0), "{r:?}");
+    assert_eq!(stream(&doc, fax).raw[..], g3[..]);
+}
+
 /// Black-and-white RGB stays RGB where grey would be drawn otherwise: drawn, on any of its uses,
 /// where `/DefaultGray` or `/DefaultRGB` is in force (ISO 32000-2 §8.6.5.6), from a page's
 /// resources or a form's own, as grey would then go through DefaultGray, or no longer through
@@ -1455,6 +1532,8 @@ fn monochrome_images_keep_what_they_should() {
 fn group_3(rows: &[&[u32]], mixed: bool) -> Vec<u8> {
     let code = |white: bool, run: u32| match (white, run) {
         (true, 0) => "00110101",
+        (true, 1) => "000111",
+        (false, 1) => "010",
         (true, 8) => "10011",
         (true, 16) => "101010",
         (true, 32) => "00011011",

From f98a5033e2fd9be2473b8b0de1ab859a427a2869 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 20:12:13 +0100
Subject: [PATCH 200/270] M11: decode_ccitt: tests for byte-aligned Group 3
 read by the codes in its data
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The rule came into decode_ccitt with the decoding it moved from Export ▸
Images (#4335's "Export reads byte-aligned Group 3 by the codes in its
data"), where the create test checks it through the export. Here it gets
tests of its own:
- 32 seeded text-like pictures, 8 to 207 samples wide, at k 0 and 1, in
  each layout (no codes, with end_of_line and without; codes, each
  starting on a byte or ending on one, with and without). Each decodes to
  its picture and, a byte short, to fewer rows, not to other rows read
  another way.
- Group 4 rows on bytes keep their aligned read, end_of_line or not.
- The any-input property varies end_of_line and encoded_byte_align too.

With the rule this replaced (rows on bytes read unaligned under
end_of_line, aligned otherwise) the test fails; cargo-mutants leaves no
mutant of the rule's lines alive. The filters README says how rows on
bytes are read.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/filters/README.md    |   2 +-
 crates/filters/src/ccitt.rs | 140 +++++++++++++++++++++++++++++++++++-
 2 files changed, 139 insertions(+), 3 deletions(-)

diff --git a/crates/filters/README.md b/crates/filters/README.md
index b59b170c90..b8a4c53727 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -43,7 +43,7 @@ decode_ccitt(data, &params, max_rows) -> Result<Vec<u8>, FilterError>   // CCITT
 | ASCIIHexDecode | white space ignored, odd digit padded with 0, `>` EOD (optional), other characters → Corrupt | upper case, newline every 64 digits, `>` |
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
-| CCITTFaxDecode | not in a chain (`Unsupported`); `decode_ccitt` decodes Group 3 and Group 4 on its own, as rows of 1-bit samples each on a new byte, black 0 unless `black_is_1`, at most `max_rows` rows (fewer with `/Rows`), the rows before any damage, up to 1,048,576 samples a row (`pdfcraft_cos::Document::decoded_image` calls it for a fax image, after the filters before it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
+| CCITTFaxDecode | not in a chain (`Unsupported`); `decode_ccitt` decodes Group 3 and Group 4 on its own, as rows of 1-bit samples each on a new byte, black 0 unless `black_is_1`, at most `max_rows` rows (fewer with `/Rows`), the rows before any damage, up to 1,048,576 samples a row; Group 3 rows on bytes are read by their end-of-line codes when the data starts with one and on bytes otherwise, whatever `end_of_line` says (`pdfcraft_cos::Document::decoded_image` calls it for a fax image, after the filters before it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
 
 ## Tests
 
diff --git a/crates/filters/src/ccitt.rs b/crates/filters/src/ccitt.rs
index 731a1a6de5..7a2a310775 100644
--- a/crates/filters/src/ccitt.rs
+++ b/crates/filters/src/ccitt.rs
@@ -318,6 +318,135 @@ mod tests {
         assert_eq!(CcittParams::default().columns, 1728, "Table 11");
     }
 
+    /// Group 3 data: rows of run lengths below 64, white first, coded one-dimensionally with T.4's
+    /// terminating codes (ITU-T T.4 Tables 2 and 3). Each row starts with an end-of-line code with
+    /// `eol`, then with `tag` a 1 bit (the next row one-dimensional, as `k` above 0 has it). Fill
+    /// bits (0s) go where `fill` says.
+    fn group_3(rows: &[Vec<u32>], eol: bool, tag: bool, fill: Fill) -> Vec<u8> {
+        // The codes for runs 0 to 63, in order.
+        const WHITE: &str = concat!(
+            "00110101 000111 0111 1000 1011 1100 1110 1111 10011 10100 00111 01000 001000 000011 110100 110101 101010 101011 ",
+            "0100111 0001100 0001000 0010111 0000011 0000100 0101000 0101011 0010011 0100100 0011000 00000010 00000011 00011010 ",
+            "00011011 00010010 00010011 00010100 00010101 00010110 00010111 00101000 00101001 00101010 00101011 00101100 00101101 ",
+            "00000100 00000101 00001010 00001011 01010010 01010011 01010100 01010101 00100100 00100101 01011000 01011001 01011010 ",
+            "01011011 01001010 01001011 00110010 00110011 00110100",
+        );
+        const BLACK: &str = concat!(
+            "0000110111 010 11 10 011 0011 0010 00011 000101 000100 0000100 0000101 0000111 00000100 00000111 000011000 0000010111 ",
+            "0000011000 0000001000 00001100111 00001101000 00001101100 00000110111 00000101000 00000010111 00000011000 ",
+            "000011001010 000011001011 000011001100 000011001101 000001101000 000001101001 000001101010 000001101011 000011010010 ",
+            "000011010011 000011010100 000011010101 000011010110 000011010111 000001101100 000001101101 000011011010 000011011011 ",
+            "000001010100 000001010101 000001010110 000001010111 000001100100 000001100101 000001010010 000001010011 000000100100 ",
+            "000000110111 000000111000 000000100111 000000101000 000001011000 000001011001 000000101011 000000101100 000001011010 ",
+            "000001100110 000001100111",
+        );
+        let code = |white: bool, run: u32| (if white { WHITE } else { BLACK }).split(' ').nth(run as usize).expect("a run below 64");
+        let mut bits = String::new();
+        for row in rows {
+            // The end-of-line code is 12 bits.
+            let ends_code = if fill == Fill::CodeEnd && eol { 12 } else { 0 };
+            while fill != Fill::None && !(bits.len() + ends_code).is_multiple_of(8) {
+                bits.push('0');
+            }
+            if eol {
+                bits.push_str("000000000001");
+            }
+            if tag {
+                bits.push('1');
+            }
+            row.iter().enumerate().for_each(|(i, run)| bits.push_str(code(i % 2 == 0, *run)));
+        }
+        bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
+    }
+
+    /// Where [`group_3`] puts fill bits: none; so each row, its end-of-line code first, starts on a
+    /// byte; or so each end-of-line code ends on one (T.4's fill, as TIFF writes it).
+    #[derive(Clone, Copy, Debug, PartialEq)]
+    enum Fill {
+        None,
+        RowStart,
+        CodeEnd,
+    }
+
+    /// `rows` text-like rows of `columns` samples as runs, white first, from `seed`: long white runs
+    /// and short black ones; a row may start black.
+    fn text_like(seed: u64, columns: u32, rows: u32) -> Vec<Vec<u32>> {
+        let mut seed = seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1;
+        let mut random = |n: u64| {
+            seed ^= seed << 13;
+            seed ^= seed >> 7;
+            seed ^= seed << 17;
+            (seed % n) as u32
+        };
+        (0..rows)
+            .map(|_| {
+                let (mut runs, mut left) = (Vec::new(), columns);
+                while left > 0 {
+                    let run = match runs.len() % 2 {
+                        0 if runs.is_empty() => random(31),
+                        0 => 1 + random(30),
+                        _ => 1 + random(5),
+                    };
+                    runs.push(run.min(left));
+                    left -= run.min(left);
+                }
+                runs
+            })
+            .collect()
+    }
+
+    /// Rows of runs, white first, packed as `decode_ccitt` gives them (white 1).
+    fn pack(runs: &[Vec<u32>], columns: u32) -> Vec<u8> {
+        let stride = (columns as usize).div_ceil(8);
+        let mut out = vec![0u8; stride * runs.len()];
+        for (y, row) in runs.iter().enumerate() {
+            let mut x = 0;
+            for (i, run) in row.iter().enumerate() {
+                if i % 2 == 0 {
+                    (x..x + *run as usize).for_each(|x| out[y * stride + x / 8] |= 0x80 >> (x % 8));
+                }
+                x += *run as usize;
+            }
+        }
+        out
+    }
+
+    /// Group 3 rows on bytes in each layout, over many pictures, as how a misreading comes out
+    /// depends on the picture: no codes (as TIFF's Modified Huffman has it), and `end_of_line`
+    /// without them; codes, each starting on a byte or ending on one, `end_of_line` or not. Each
+    /// decodes to its picture, and a byte short to fewer rows, not to other rows read another way.
+    /// Group 4 rows on bytes keep their aligned read, `end_of_line` or not.
+    #[test]
+    fn group_3_rows_on_bytes_read_by_the_codes_in_the_data() {
+        for seed in 0..32u64 {
+            let (columns, rows) = (8 + (seed as u32 * 37) % 200, 2 + seed as u32 % 20);
+            let runs = text_like(seed, columns, rows);
+            let picture = pack(&runs, columns);
+            for k in [0, 1] {
+                for (codes, fill, end_of_line) in [
+                    (false, Fill::RowStart, false),
+                    (false, Fill::RowStart, true),
+                    (true, Fill::RowStart, false),
+                    (true, Fill::RowStart, true),
+                    (true, Fill::CodeEnd, false),
+                    (true, Fill::CodeEnd, true),
+                ] {
+                    let p = CcittParams { k, columns: i64::from(columns), end_of_line, encoded_byte_align: true, ..CcittParams::default() };
+                    let mut data = group_3(&runs, codes, k > 0, fill);
+                    let case = format!("seed {seed}, {columns} × {rows}, k {k}, codes {codes}, fill {fill:?}, end_of_line {end_of_line}");
+                    assert_eq!(decode_ccitt(&data, &p, rows).unwrap(), picture, "{case}");
+                    data.pop();
+                    assert!(decode_ccitt(&data, &p, rows).unwrap().len() < picture.len(), "{case}, a byte short");
+                }
+            }
+        }
+        // White rows, each the one code 1 (vertical, no change) and its fill.
+        for end_of_line in [false, true] {
+            let p = CcittParams { k: -1, columns: 64, end_of_line, encoded_byte_align: true, ..CcittParams::default() };
+            assert_eq!(decode_ccitt(&[0x80; 16], &p, 16).unwrap(), [0xFF; 8 * 16], "Group 4, end_of_line {end_of_line}");
+        }
+    }
+
     proptest::proptest! {
         /// Any bitmap, of noise or of runs, decodes to its own bits, through an independent decoder
         /// and through `decode_ccitt`.
@@ -337,9 +466,16 @@ mod tests {
 
         /// Whatever it is given, it returns.
         #[test]
-        fn any_input_returns(data in proptest::collection::vec(0u8..=255, 0..600), columns in 0u32..40_000, rows in 0u32..80, k in -2i64..3) {
+        fn any_input_returns(
+            data in proptest::collection::vec(0u8..=255, 0..600),
+            columns in 0u32..40_000,
+            rows in 0u32..80,
+            k in -2i64..3,
+            end_of_line in proptest::bool::ANY,
+            encoded_byte_align in proptest::bool::ANY,
+        ) {
             let _ = encode_g4(&data, columns, rows);
-            let p = CcittParams { k, columns: i64::from(columns), ..CcittParams::default() };
+            let p = CcittParams { k, columns: i64::from(columns), end_of_line, encoded_byte_align, ..CcittParams::default() };
             if let Ok(out) = decode_ccitt(&data, &p, rows) {
                 proptest::prop_assert!(out.len() <= (columns as usize).div_ceil(8) * rows as usize);
             }

From abae2472d3240dd3e5cc9f67e672e7ac5c5655b5 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 18:12:37 +0100
Subject: [PATCH 201/270] M11: the crate docs, doc_optimize's mono and the M11
 row name what the black-and-white step does now

The optimize crate doc and MonoSettings named only 1-bit, CCITT and
eight-bit grey images; doc_optimize's mono said Group 4 only; the M11
milestone row stopped at Group 4 compression. They now include
downsampling (halftones aside), Group 3 to Group 4, 1-bit Flate, and
black-and-white RGB and indexed images that use only palette entries 0
and 1, packed to one bit. That last isn't "two-entry", as the roadmap and
the downsampling parity note had it: an indexed image packs whatever its
palette's size, when its samples are 0 and 1. The mono-compression note
says byte-aligned Group 3 with end-of-line codes but none before the
first row is stored again as PdfCraft draws it, which at /K 0 may be
other rows than were coded.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/automation/src/tools.rs |  2 +-
 crates/optimize/src/lib.rs     | 14 ++++++++------
 docs/roadmap.md                |  4 ++--
 parity/acrobat-features.toml   |  4 ++--
 4 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 838fa57ab4..45471f47df 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1433,7 +1433,7 @@ pub fn tools() -> Vec<ToolDef> {
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
             .with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
-        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 when that is smaller, counted in images_recompressed; retain resamples only, a CCITT image staying CCITT and any other becoming Flate). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
+        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 (or 1-bit Flate, once resampled or packed from more bits) when that is smaller, Group 3 fax images, black-and-white RGB and indexed images using only palette entries 0 and 1 among them, counted in images_recompressed; retain resamples only, a CCITT image staying CCITT and any other becoming Flate). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
             .cmd("optimize.advanced")
             .with(schema(
                 json!({
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index a8a24b6aed..3a920d1f13 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -10,10 +10,11 @@
 //!   A new image replaces the old one only if it is smaller. The colour and grey settings leave
 //!   alone images they can't decode faithfully (CMYK and other colour spaces, masks, decode arrays
 //!   other than the default, JPEG 2000, JBIG2, CCITT, other than 8 bits, JPEGs whose Adobe marker
-//!   and `/ColorTransform` disagree). Black-and-white images (1-bit, image masks
-//!   and CCITT fax among them, and eight-bit grey of only black and white) above a threshold are
-//!   averaged down to a target resolution, halftones and dithers aside, and are stored as CCITT
-//!   Group 4 when that is smaller.
+//!   and `/ColorTransform` disagree). Black-and-white images (1-bit, image masks and CCITT fax,
+//!   Group 3 among them; and eight-bit grey and RGB of only black and white, and indexed images
+//!   that use only palette entries 0 and 1, packed to one bit) above a threshold are averaged down to a
+//!   target resolution, halftones and dithers aside, and are stored as CCITT Group 4, or 1-bit
+//!   Flate once resampled or packed, when that is smaller.
 //! - **Discard objects:** page thumbnails, alternate images, document tags (structure tree),
 //!   print settings.
 //! - **Clean up:** drop images and forms that pages list but never draw (such as a deleted
@@ -130,8 +131,9 @@ pub enum MonoCompression {
     Retain,
 }
 
-/// How black-and-white images (1-bit, CCITT fax among them, and eight-bit grey of only black
-/// and white), and image masks, are resampled and stored.
+/// How black-and-white images (1-bit, CCITT fax among them; and eight-bit grey and RGB of only black
+/// and white, and indexed images that use only palette entries 0 and 1, packed to one bit), and
+/// image masks, are resampled and stored.
 #[derive(Clone, Copy, Debug, PartialEq)]
 pub struct MonoSettings {
     /// Average images whose effective resolution is above `above_ppi` down to `target_ppi`.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 1cef4f5965..f5d3d1b44b 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,7 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
-> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: the optimizer stores Group 3 fax images as Group 4, and packs black-and-white RGB and two-entry indexed images to one bit; estimates unchanged)
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: the optimizer stores Group 3 fax images as Group 4, and packs black-and-white RGB and indexed images that use only palette entries 0 and 1 to one bit; estimates unchanged)
 > **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white images above 450 ppi are averaged down to 300 ppi by the optimizer; estimates unchanged)
 > **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white pictures stay one bit when PDFs are created and optimized; CCITT images export; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
@@ -199,7 +199,7 @@ total matches the parity estimate.
 | M8 | Security + redaction | 100–180 | 68% | 15–30 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize.<br>Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and `redact_mark`). Redaction cleans indirect and form structure references, preserving surviving form tags. Redaction retires inherited resource dictionaries, so a parent `/Pages` can't keep a removed XObject reachable; unredacted pages are left untouched. Image redaction removes alternate images and unsupported masks only on affected images. Changed marked-content spans lose replacement descriptions; untouched spans keep theirs. Hidden-text cleanup retires unused named descriptions across inherited/shared page and form resources (64 focused tests and scoped Rust 1.96 Clippy/wasm checks pass; publication CI pending). The redaction audit counts a filled cover that hides half of any one word of a long line (#2662), applied or not. Phone-pattern redaction also matches labelled Italian geographic numbers with `+39` and a slash after the area code (#3205 follow-up); unlabelled international slash numbers remain unsupported. Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding |
 | M9 | Signatures (PAdES, validation) | 160–280 | 60% | 40–70 | Done: new `sign` crate (DER, X.509, CMS, PKCS #12 on RustCrypto; aws-lc-rs for RSA private keys); PAdES B-B signing (visible, invisible, existing fields, certification with DocMDP); validation with trust store and changes-after-signing classification; self-signed digital IDs; Signatures panel, message bar, sign dialogs; agent tools. Checked with pdfsig and OpenSSL.<br>Done since: macOS Keychain and Windows Current User Personal store signing (software-backed CNG keys), certificate viewer, signed documents protected from rewrites, page validation overlays separate from original signature artwork (baked Not Verified captions remain; #79 open), snapshot tabs that reuse instead of multiplying. Missing: timestamps (B-T), LTV (DSS, OCSP, CRL), FieldMDP, smart cards, PKCS #11 |
 | M10 | OCR, create, export, print | 200–350 | 33% | 120–215 | Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, the CUPS and Windows spoolers, print-ready PDF).<br>Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; architectural/ANSI/large ISO sheet presets, Match page at 100% and PDF-scale preview (#599 follow-up); Create PDF from multiple files (PDFs, images and text, edited as pages in the grid); OCR can also read pictures on pages that have text, without adding that text twice (#1028). Model staging fetches SHA-256-verified ONNX detection/recognition files after the upstream RTEN URL brownout; runtime discovery prefers complete ONNX pairs per directory, then complete legacy RTEN pairs, without mixing formats or changing directory precedence. Done since: Word invoice export uses borderless inferred tables, floating positioned text/artwork only where text overlaps an image or is rotated, and per-page sizes, covered by synthetic invoice automation regressions (#773); printing on the web through the browser's print dialog, sheets drawn by PdfCraft (gap 4). Lossless image export applies per-component Decode, including Indexed mapping (#1201 partial). Existing 16-bit precision and color-management limits remain. #3532 partial: vector printing retains existing appearances with absent Subtype through a print-owned Form copy; source artwork stays unchanged. #3120: Office export reads form XObjects 50 levels deep, as the renderer does, and up to 50 000 a page; pages past that are listed in `truncated_pages`. Word table cells use the grid columns they span, including cells after a merged cell. Done since: text in a table slot covered by another cell's span remains as paragraph text in Word, HTML, RTF and PowerPoint. Missing: OCR languages beyond Latin, editable-text OCR output, full Office layout fidelity/import. Done since: dotted-leader contents entries stay in separate complete paragraphs (#1757) #2156 candidate: last selected print paper persists across sessions; other print preferences unchanged. Image export applies soft-mask Decode opacity intervals before resizing, including indirect entries and inverted ranges. Vector printing gives annotation appearances unoccupied XObject names so existing page artwork survives. |
-| M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Target-version compatibility is partial: newer content is not detected or converted. Content stream boundaries preserve comments, split operands and graphics state when image fragments merge. Image downsampling includes page-local `/UserUnit` scaling when measuring physical resolution. Done since: reject invalid image and soft-mask dimensions with checked sizing (#2178); black-and-white images stored losslessly as CCITT Group 4 when smaller. Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
+| M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Target-version compatibility is partial: newer content is not detected or converted. Content stream boundaries preserve comments, split operands and graphics state when image fragments merge. Image downsampling includes page-local `/UserUnit` scaling when measuring physical resolution. Done since: reject invalid image and soft-mask dimensions with checked sizing (#2178); black-and-white images stored losslessly as CCITT Group 4 when smaller, averaged down to 300 ppi above 450 (halftones aside), Group 3 stored again as Group 4, and black-and-white RGB and indexed images that use only palette entries 0 and 1 packed to one bit. Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds. Character encoding accepts Identity-H/V with Adobe CJK collections and predefined CJK CMaps independently (#3673); per-glyph validation and embedded-font extraction remain separate.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded, text-only auto-tag proposal tool for one page. Marking a figure decorative rewrites only that stream (#1324). An XFA radio item whose value contains a space is written back unchanged (#1319). Done since: #2569: Growable multiline XFA text reflows after edits, with undo/redo, save/reopen and print coverage; oversized fields still become read-only page text. Structured-data synchronization warnings retain accepted whitespace without relayout from stale data. Done since: #2572: Every repeated page-master button resolves its own field to the shared XFA click script, including print buttons. Done since: #2570: Dynamic XFA rich-text fields carry exData/maxLength into AcroForm MaxLen for reported and enforced Unicode character limits, retained after save/reopen. Done since: #2589: Active XFA skips PDF-container fallback scripts while retaining requested messages and saved scripts; ordinary/static/unlaid-out documents and explicit console/field calls keep their existing behavior. Missing: writing proposed tags and parent tree, field autotag, visual Tags/Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA<br>Reading colours: pending page backgrounds follow the configured colour (#2059). |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers<br>Done since: CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. `text_find` also caps the per-page match ranges it materializes at the remaining result limit plus one continuation match. CLI robustness scans visit each directory once through overlapping roots and symlink aliases. |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds. Character encoding accepts Identity-H/V with Adobe CJK collections and predefined CJK CMaps independently (#3673); per-glyph validation and embedded-font extraction remain separate.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded text-only auto-tag proposal tool; text-only Apply writes marked content, paragraph tags and a parent tree, then opens the Tags panel for review. Missing: mixed-content and field autotag, heading/list/table/figure classification, Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA<br>Done since: CLI info, text and render use dynamic XFA layout pages, with synthetic count/text/pixel and copy-permission regressions (#1645).<br>Reading colours: pending page backgrounds follow the configured colour (#2059). |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 6cc4f4797c..99deb812bc 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7361,7 +7361,7 @@ status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
 evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::black_and_white_images_above_450_ppi_are_averaged_down_to_300", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax, and eight-bit black-and-white grey and RGB and indexed images of two palette entries) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, halftones and dithers (most of their new pixels would cover both black and white, and their tones turn solid), or images wider than a fax row (1,048,576 samples), and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax, and eight-bit black-and-white grey and RGB, and indexed images that use only palette entries 0 and 1) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, halftones and dithers (most of their new pixels would cover both black and white, and their tones turn solid), or images wider than a fax row (1,048,576 samples), and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]
 id = "optimize.recompress-images"
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn where /DefaultGray or /DefaultRGB is in force, and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn where /DefaultGray or /DefaultRGB is in force, and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From aaa3d815c18b2b822f4a9b7f207d4ee03f6b8741 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 20:38:49 +0100
Subject: [PATCH 202/270] M11: say where Group 3 with no code before the first
 row is written back as read

decode_ccitt reads byte-aligned Group 3 whose data has end-of-line codes
but none before the first row (not as T.4 sends them) on bytes. At /K 0
with the fill ending each code on a byte, about one small picture in
five is then read as other rows; at fax width almost none are, as such
pages come out short and are refused. Export already said so. The
optimizer, when it resamples such an image or stores it again as Group 4
from behind another filter, and redaction, when it clears pixels in one,
write those rows back, and nothing said that.

Black-box, PdfCraft's renderer draws such an image exactly as
decode_ccitt reads it (all 42 misread of 200 seeded pictures, behind
ASCII85Decode too), so the written image is what PdfCraft showed before.
Refusing such data instead (a code after nearly every row but none
first) would also refuse some ordinary Modified Huffman images, whose
rows can meet 11 zeros by chance (0.5 to 5% of small ones in a
black-box probe), so the limit is stated rather than guarded: in
decode_ccitt's doc, the filters, optimize and redact READMEs, and the
core.image-filters and mono-compression notes. The optimize README's and
the mono-compression note's "not yet: Group 3 to Group 4 without
resampling" now say a lone Group 3 image: one behind another filter is
stored again as Group 4.

Also from the review: docs/roadmap.md keeps #4335's status line under
this PR's, rather than replacing it; the filters README's tests and the
core.image-filters evidence name the Group 3 layout test; the filters
crate's description names Group 3 and 4 decoding.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/filters/Cargo.toml    | 2 +-
 crates/filters/README.md     | 4 ++--
 crates/filters/src/ccitt.rs  | 4 +++-
 crates/optimize/README.md    | 9 ++++++---
 crates/redact/README.md      | 4 +++-
 docs/roadmap.md              | 1 +
 parity/acrobat-features.toml | 6 +++---
 7 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/crates/filters/Cargo.toml b/crates/filters/Cargo.toml
index 91b5d3d578..fd63ac2b0b 100644
--- a/crates/filters/Cargo.toml
+++ b/crates/filters/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "pdfcraft-filters"
-description = "PDF stream filters (ISO 32000-2 §7.4): Flate, LZW, predictors, ASCII85, ASCIIHex, RunLength, CCITT Group 4 encoding"
+description = "PDF stream filters (ISO 32000-2 §7.4): Flate, LZW, predictors, ASCII85, ASCIIHex, RunLength, CCITT Group 4 encoding and Group 3 and 4 decoding"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
diff --git a/crates/filters/README.md b/crates/filters/README.md
index b8a4c53727..b8c1d22815 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -43,14 +43,14 @@ decode_ccitt(data, &params, max_rows) -> Result<Vec<u8>, FilterError>   // CCITT
 | ASCIIHexDecode | white space ignored, odd digit padded with 0, `>` EOD (optional), other characters → Corrupt | upper case, newline every 64 digits, `>` |
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
-| CCITTFaxDecode | not in a chain (`Unsupported`); `decode_ccitt` decodes Group 3 and Group 4 on its own, as rows of 1-bit samples each on a new byte, black 0 unless `black_is_1`, at most `max_rows` rows (fewer with `/Rows`), the rows before any damage, up to 1,048,576 samples a row; Group 3 rows on bytes are read by their end-of-line codes when the data starts with one and on bytes otherwise, whatever `end_of_line` says (`pdfcraft_cos::Document::decoded_image` calls it for a fax image, after the filters before it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
+| CCITTFaxDecode | not in a chain (`Unsupported`); `decode_ccitt` decodes Group 3 and Group 4 on its own, as rows of 1-bit samples each on a new byte, black 0 unless `black_is_1`, at most `max_rows` rows (fewer with `/Rows`), the rows before any damage, up to 1,048,576 samples a row; Group 3 rows on bytes are read by their end-of-line codes when the data starts with one and on bytes otherwise, whatever `end_of_line` says, so data with codes but none before the first row (not as T.4 sends them) is read on bytes, as the renderer draws it, and at `k` 0 may come out as other rows (`pdfcraft_cos::Document::decoded_image` calls it for a fax image, after the filters before it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
 
 ## Tests
 
 - Unit tests per filter with hand-computed vectors (the ISO 32000-2 LZW example, RFC 1951 stored blocks, PNG/TIFF rows).
 - LZW is cross-checked against `weezl` (dev-dependency) in both directions for both early-change settings.
 - `tests/proptests.rs`: encode→decode round trips for every encodable filter × predictor × colors × bpc × columns, two-filter chains, output-limit checks, and fuzz-style no-panic tests (random bytes, random/nonsense params, bit-flipped valid streams).
-- `ccitt.rs`: `decode_ccitt` gives back the rows `encode_g4` was given (with `/BlackIs1`, `/Rows` and a row limit), refuses bad widths, and bounds its output for any input. Group 4 output decoded by `hayro-ccitt` (an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
+- `ccitt.rs`: `decode_ccitt` gives back the rows `encode_g4` was given (with `/BlackIs1`, `/Rows` and a row limit), refuses bad widths, and bounds its output for any input; byte-aligned Group 3 in each layout, over 32 seeded pictures, decodes to its picture, and a byte short to fewer rows. Group 4 output decoded by `hayro-ccitt` (an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
 - `fuzz/`: a detached cargo-fuzz crate (`cargo +nightly fuzz run decode`, run from `crates/filters/`).
 
 ## Status
diff --git a/crates/filters/src/ccitt.rs b/crates/filters/src/ccitt.rs
index 7a2a310775..e87a82fe16 100644
--- a/crates/filters/src/ccitt.rs
+++ b/crates/filters/src/ccitt.rs
@@ -84,7 +84,9 @@ impl Default for CcittParams {
 /// Group 3 rows on bytes (`k` from 0, `encoded_byte_align`) are read by their end-of-line codes,
 /// whether the fill starts each code on a byte or ends it on one, when `data` starts with one (T.4
 /// sends one before the first row when it sends them at all), and on bytes otherwise, whatever
-/// `end_of_line` says. Group 4 is read as its parameters say.
+/// `end_of_line` says. Group 4 is read as its parameters say. Data with codes but none before the
+/// first row is read on bytes, as PdfCraft's renderer draws it; with `k` 0 and the fill ending each
+/// code on a byte, that may be other rows than were coded.
 ///
 /// Errors: `columns` that aren't from 1 to [`MAX_CCITT_COLUMNS`] ([`FilterError::Unsupported`]).
 pub fn decode_ccitt(data: &[u8], p: &CcittParams, max_rows: u32) -> Result<Vec<u8>, FilterError> {
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 4709111278..2c90981770 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -41,7 +41,10 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   450 ppi, CCITT Group 4). Black-and-white images are a 1-bit image with one colour component
   (grey, indexed, a separation) or an image mask, stored with no filter, with general-purpose ones
   or with CCITT fax after any of those (decoded by `Document::decoded_image_within`, no further
-  than its rows can need), and an eight-bit grey image of
+  than its rows can need; byte-aligned Group 3 with end-of-line codes but none before the first
+  row, not as T.4 sends them, is read as PdfCraft draws it, which at `/K 0` may be other rows than
+  were coded, and an image resampled, or stored again as Group 4 from behind another filter,
+  keeps them), and an eight-bit grey image of
   only 0 and 255, packed to one bit (not an indexed image, whose samples are palette indices, nor
   one with a colour-key `/Mask`) unless the grey settings make it smaller still, its soft mask counted
   (resampled with it there, kept as it is here), as they can a dithered scan by downsampling it to
@@ -64,8 +67,8 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
     settings. Every change is kept only when it is smaller as stored.
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
     space, decode array and `/Mask` stay. Group 4 wins on scans, whose ragged edges defeat Flate;
-    on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, Group 3 to Group 4
-    without resampling, inline images, an image's own `/SMask` or `/Mask` image (only images drawn
+    on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, a lone Group 3 image to
+    Group 4 without resampling (one behind another filter is stored again as Group 4), inline images, an image's own `/SMask` or `/Mask` image (only images drawn
     on a page are visited), and Group 4 for rows wider than 32,767 samples.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
diff --git a/crates/redact/README.md b/crates/redact/README.md
index 6d273c2341..74509a5d06 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -20,7 +20,9 @@ clear_marks(&mut doc, None)?;                        // remove marks without app
 - **images**: fully covered → removed; partly covered → a copy with the covered pixels cleared
   (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx, and CCITT fax as the last
   filter, decoded through `Document::decoded_image_within`; `/DecodeParms` given by reference,
-  numbers inside included, count). Codecs redaction doesn't decode (DCT, JPX, JBIG2) are removed
+  numbers inside included, count; byte-aligned Group 3 with end-of-line codes but none before the
+  first row, not as T.4 sends them, is cleared as PdfCraft draws it, which at `/K 0` may be other
+  rows than were coded). Codecs redaction doesn't decode (DCT, JPX, JBIG2) are removed
   whole (fail-closed); inline images under an area are removed. Images with separate `/SMask`
   or `/Mask` data, and images whose data decodes to more than three times their declared raster
   and a byte per row, plus 4 KiB (ASCIIHex text broken into lines under Flate is a little over
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 6d12e87564..56b10853a2 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -3,6 +3,7 @@
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
 > **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white images above 450 ppi are averaged down to 300 ppi by the optimizer; estimates unchanged)
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white pictures stay one bit when PDFs are created and optimized; CCITT images export; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index d656b51a22..8f22714769 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -130,8 +130,8 @@ milestone = "M1"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/filters/src/ccitt.rs::decoding_gives_the_rows_back", "crates/cos/src/document/tests.rs::fax_images_decode_with_their_parameters"]
-notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images, the optimizer and redaction"
+evidence = ["crates/filters/src/ccitt.rs::decoding_gives_the_rows_back", "crates/filters/src/ccitt.rs::group_3_rows_on_bytes_read_by_the_codes_in_the_data", "crates/cos/src/document/tests.rs::fax_images_decode_with_their_parameters"]
+notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images, the optimizer and redaction. Byte-aligned Group 3 is read by its end-of-line codes when the data starts with one and on bytes otherwise; still limited: data with codes but none before the first row (not as T.4 sends them) is read on bytes, as the renderer draws it, and at /K 0 may come out as other rows, which the optimizer and redaction then write back"
 
 [[feature]]
 id = "core.decompression-limits"
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), Group 3 to Group 4 without resampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), a lone Group 3 image to Group 4 without resampling (one behind another filter is stored again as Group 4; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 952eb344e9c552cf5ed62822710baf295e1438aa Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 20:44:04 +0100
Subject: [PATCH 203/270] M11: Group 3 on bytes through the Group 4 step: tests
 against the picture

group_3_fax_images_become_group_4 coded its rows only off bytes. It now
also stores again rows on bytes: Modified Huffman (no end-of-line codes),
and codes whose fill ends each on a byte, as TIFF writes them, at /K 0 and
1 without /EndOfLine, which reading by that flag misread (the test fails
with that rule). Each becomes Group 4, smaller, decoding to the picture.

The page is compared with the picture in Flate rather than with itself
before: PdfCraft's bootstrap renderer draws TIFF's layout (the fill
ending each code on a byte) as other rows, at every /K and with
/EndOfLine or not (black box), so storing it as Group 4 corrects what
PdfCraft shows rather than keeping it. (Redaction removes such images
whole, for that reason, since #4384's "redaction removes Group 3 on
bytes whole".)

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/tests/optimize.rs | 54 ++++++++++++++++++++-----------
 1 file changed, 36 insertions(+), 18 deletions(-)

diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 28ccca1874..edfb339d72 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1050,7 +1050,7 @@ fn retain_keeps_a_group_3_halftone_as_it_is() {
     let a: Vec<u32> = vec![1; 64];
     let b: Vec<u32> = std::iter::once(0).chain(std::iter::repeat_n(1, 64)).collect();
     let runs: Vec<&[u32]> = (0..h).map(|y| if y % 2 == 0 { &a[..] } else { &b[..] }).collect();
-    let g3 = group_3(&runs, false);
+    let g3 = group_3(&runs, false, None);
     let mut doc = Document::new_empty();
     let mut d = Dict::new();
     d.set(b"Subtype".to_vec(), Object::name("Image"));
@@ -1528,8 +1528,10 @@ fn monochrome_images_keep_what_they_should() {
 }
 
 /// `rows` coded as CCITT Group 3, one-dimensional (`/K 0`): each row its runs in turn, white first,
-/// with ITU-T T.4's terminating codes for the few lengths used here.
-fn group_3(rows: &[&[u32]], mixed: bool) -> Vec<u8> {
+/// with ITU-T T.4's terminating codes for the few lengths used here. With `on_bytes`, each row
+/// starts on a byte: `Some(false)`, with no end-of-line codes (TIFF's Modified Huffman); `Some(true)`,
+/// after an end-of-line code that the fill ends on a byte (T.4's fill, as TIFF writes it).
+fn group_3(rows: &[&[u32]], mixed: bool, on_bytes: Option<bool>) -> Vec<u8> {
     let code = |white: bool, run: u32| match (white, run) {
         (true, 0) => "00110101",
         (true, 1) => "000111",
@@ -1544,9 +1546,19 @@ fn group_3(rows: &[&[u32]], mixed: bool) -> Vec<u8> {
     };
     let mut bits = String::new();
     for row in rows {
-        // Mixed coding (/K above 0): an end-of-line code, then a 1 bit, the row one-dimensional.
+        let codes = mixed || on_bytes == Some(true);
+        if on_bytes.is_some() {
+            // The end-of-line code is 12 bits.
+            while !(bits.len() + if codes { 12 } else { 0 }).is_multiple_of(8) {
+                bits.push('0');
+            }
+        }
+        if codes {
+            bits.push_str("000000000001");
+        }
+        // Mixed coding (/K above 0): a 1 bit after the code, the row one-dimensional.
         if mixed {
-            bits.push_str("0000000000011");
+            bits.push('1');
         }
         row.iter().enumerate().for_each(|(i, run)| bits.push_str(code(i % 2 == 0, *run)));
     }
@@ -1554,8 +1566,9 @@ fn group_3(rows: &[&[u32]], mixed: bool) -> Vec<u8> {
 }
 
 /// A Group 3 fax image is stored again as Group 4 when that is smaller, the same picture (to the
-/// pixel on the page); with Retain it stays Group 3. One-dimensional (/K 0) and mixed (/K 1, with
-/// end-of-line codes) alike.
+/// pixel on the page, against the picture in Flate); with Retain it stays Group 3. One-dimensional (/K 0) and mixed (/K 1, with
+/// end-of-line codes) alike, and rows on bytes, with no codes and with codes the fill ends on a byte
+/// (without `/EndOfLine`, which reading by the flag misread).
 #[test]
 fn group_3_fax_images_become_group_4() {
     let (w, h) = (64u32, 64u32);
@@ -1575,10 +1588,11 @@ fn group_3_fax_images_become_group_4() {
         }
         bits.extend(packed);
     }
-    for k in [0, 1] {
-        let g3 = group_3(&runs, k > 0);
-        let p = pdfcraft_filters::CcittParams { k, columns: w.into(), end_of_line: k > 0, ..Default::default() };
-        assert_eq!(pdfcraft_filters::decode_ccitt(&g3, &p, h).unwrap(), bits, "/K {k}: the Group 3 data is the picture");
+    for (k, on_bytes) in [(0, None), (1, None), (0, Some(false)), (0, Some(true)), (1, Some(true))] {
+        let g3 = group_3(&runs, k > 0, on_bytes);
+        let (end_of_line, encoded_byte_align) = (k > 0 && on_bytes.is_none(), on_bytes.is_some());
+        let p = pdfcraft_filters::CcittParams { k, columns: w.into(), end_of_line, encoded_byte_align, ..Default::default() };
+        assert_eq!(pdfcraft_filters::decode_ccitt(&g3, &p, h).unwrap(), bits, "/K {k}, on bytes {on_bytes:?}: the Group 3 data is the picture");
 
         let mut doc = Document::new_empty();
         let mut d = Dict::new();
@@ -1587,28 +1601,32 @@ fn group_3_fax_images_become_group_4() {
         d.set(b"Height".to_vec(), Object::Int(h.into()));
         d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
         d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        // The page with the picture in Flate, as it should look.
+        let mut control = Document::new_empty();
+        let flate = control.add(Object::Stream(Stream::flate(d.clone(), &bits)));
+        page(&mut control, &[("A", flate)], "q 64 0 0 64 100 600 cm /A Do Q");
         d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
         let mut parms = Dict::new();
         parms.set(b"K".to_vec(), Object::Int(k));
-        parms.set(b"EndOfLine".to_vec(), Object::Bool(k > 0));
+        parms.set(b"EndOfLine".to_vec(), Object::Bool(end_of_line));
+        parms.set(b"EncodedByteAlign".to_vec(), Object::Bool(encoded_byte_align));
         parms.set(b"Columns".to_vec(), Object::Int(w.into()));
         parms.set(b"Rows".to_vec(), Object::Int(h.into()));
         d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
         let fax = doc.add(Object::Stream(Stream::from_raw(d, g3.clone())));
         page(&mut doc, &[("A", fax)], "q 64 0 0 64 100 600 cm /A Do Q");
-        let before = render(&doc);
 
         let mut kept = doc.clone();
         optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
-        assert_eq!(stream(&kept, fax).raw[..], g3[..], "/K {k}: Retain keeps Group 3");
+        assert_eq!(stream(&kept, fax).raw[..], g3[..], "/K {k}, on bytes {on_bytes:?}: Retain keeps Group 3");
 
         let r = optimize(&mut doc, &Settings::default()).unwrap();
-        assert_eq!((r.images_resampled, r.images_recompressed), (0, 1), "/K {k}: {r:?}");
+        assert_eq!((r.images_resampled, r.images_recompressed), (0, 1), "/K {k}, on bytes {on_bytes:?}: {r:?}");
         let s = stream(&doc, fax);
-        assert_eq!(doc.fax_params(&s).map(|p| p.k), Some(-1), "/K {k}: Group 4");
+        assert_eq!(doc.fax_params(&s).map(|p| p.k), Some(-1), "/K {k}, on bytes {on_bytes:?}: Group 4");
         assert!(s.raw.len() < g3.len(), "{} bytes, from {}", s.raw.len(), g3.len());
-        assert_eq!(doc.decoded_image(&s).unwrap(), bits, "/K {k}: the same picture");
-        assert!(render(&doc) == before, "/K {k}: the page looks the same");
+        assert_eq!(doc.decoded_image(&s).unwrap(), bits, "/K {k}, on bytes {on_bytes:?}: the same picture");
+        assert!(render(&doc) == render(&control), "/K {k}, on bytes {on_bytes:?}: the page looks as the picture does");
     }
 }
 

From 1ad951e25bac86f77e75e060dcce34cc32a0f9a3 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 21:25:07 +0100
Subject: [PATCH 204/270] M11: redaction removes Group 3 on bytes whole, which
 the renderer may draw as other rows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PdfCraft's bootstrap renderer draws byte-aligned Group 3 whose fill ends
each end-of-line code on a byte (as TIFF writes it) as other rows than
decode_ccitt reads (black box, at every /K, with /EndOfLine or not:
mostly the first row, then blank). Redaction cleared pixels in the
picture decode_ccitt reads, so a mark over what PdfCraft showed needn't
cover what was cleared, and content shown blank stayed in the copy. Such
an image (/K 0 or more, /EncodedByteAlign) is now removed whole, as
every CCITT image was before this PR; Group 3 off bytes and Group 4 are
still cleared.

The image's parameters come from Document::fax_params, the reading of a
fax image's /DecodeParms entry that decoded_image already did, now on
its own (it was to come with #4404, which uses it too). The redaction
README, the module doc, the redaction and core.image-filters notes and
the spec parity table's status line and revision row say so, and the
core.image-filters note now records the renderer's misdrawing.

group_3_on_bytes_is_removed_whole_and_other_fax_images_cleared: a white
16 × 2 picture, checked to decode as such, is removed whole on bytes (no
codes; codes at /K 0; at /K 1 with /EncodedByteAlign by reference) and
cleared off bytes and as Group 4 on bytes. It fails without the guard;
cargo-mutants catches every viable mutant of it.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/cos/README.md               |  1 +
 crates/cos/src/document/objects.rs | 69 ++++++++++++++++++------------
 crates/cos/src/document/tests.rs   | 10 ++++-
 crates/redact/README.md            |  8 ++--
 crates/redact/src/image.rs         | 14 ++++--
 crates/redact/src/tests.rs         | 34 +++++++++++++++
 docs/pdf-spec-parity.md            |  4 +-
 parity/acrobat-features.toml       |  6 +--
 8 files changed, 105 insertions(+), 41 deletions(-)

diff --git a/crates/cos/README.md b/crates/cos/README.md
index 8358a220a0..2cf3342954 100644
--- a/crates/cos/README.md
+++ b/crates/cos/README.md
@@ -26,6 +26,7 @@ let d    = doc.dict(&obj);                           // Option<Dict>, resolving
 let data = stream.decoded()?;                        // filters applied on demand
 let data = doc.with_direct_parms(&stream).decoded()?; // /DecodeParms given by reference too
 let px   = doc.decoded_image(&stream)?;              // an image's samples, a CCITT fax image's too
+let fax  = doc.fax_params(&stream);                  // a CCITT fax image's /DecodeParms, Table 11 defaults
 
 doc.set(r, Object::Dict(d));                         // edit: lands in the overlay
 let r = doc.add(obj);                                // append a new object
diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index 4c03d04243..4f05d03ae0 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -224,26 +224,15 @@ impl Document {
         self.resolve(o).as_dict().cloned()
     }
 
-    /// The samples of image `s`, decoded: through its filters ([`Stream::decoded`]), or, for a
-    /// CCITT fax image (its last filter), through the filters before it and then
-    /// [`pdfcraft_filters::decode_ccitt`] with its `/DecodeParms` (resolved; the dictionary of a
-    /// lone filter, or its entry in an array), as `CCITTFaxDecode` gives them (ISO 32000-2 §7.4.6).
-    /// Parameters given by reference count, for every filter ([`Document::with_direct_parms`]).
-    /// A fax image's `/Columns` has to be its `/Width`. Up to its `/Height` rows are decoded,
-    /// whatever `/Rows` says, within [`MAX_DECODED`] bytes; damaged data gives fewer, so a caller
-    /// checks it has the rows it needs.
-    pub fn decoded_image(&self, s: &Stream) -> Result<Vec<u8>, CosError> {
-        self.decoded_image_within(s, MAX_DECODED)
-    }
-
-    /// [`Document::decoded_image`] for an image whose decoding has a tighter bound than
-    /// [`MAX_DECODED`]: no stage, the filters before a fax decoder included, may produce more than
-    /// `max` bytes.
-    pub fn decoded_image_within(&self, s: &Stream, max: usize) -> Result<Vec<u8>, CosError> {
-        let max = max.min(MAX_DECODED);
-        let s = &*self.with_direct_parms(s);
-        let chain = s.readable_filters().map_err(|e| CosError::Filter(e.to_string()))?;
-        let Some(((pdfcraft_filters::Filter::CcittFax, _), before)) = chain.split_last() else { return s.decoded_within(max) };
+    /// The CCITT parameters of image `s` when its last filter is `CCITTFaxDecode`: its
+    /// `/DecodeParms` (resolved; the dictionary of a lone filter, or its entry in an array), with the
+    /// defaults of ISO 32000-2 Table 11 for what that leaves out. `None` for another image, and for
+    /// one whose `/Filter` isn't a name or an array of names.
+    pub fn fax_params(&self, s: &Stream) -> Option<pdfcraft_filters::CcittParams> {
+        let chain = s.readable_filters().ok()?;
+        if !matches!(chain.last(), Some((pdfcraft_filters::Filter::CcittFax, _))) {
+            return None;
+        }
         // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1): the
         // last filter but a /Crypt, which `filters` leaves out wherever it stands.
         let index = match s.dict.get(b"Filter") {
@@ -262,17 +251,38 @@ impl Document {
             _ => default,
         };
         let d = pdfcraft_filters::CcittParams::default();
-        let p = pdfcraft_filters::CcittParams {
+        Some(pdfcraft_filters::CcittParams {
             k: int(b"K", d.k),
             columns: int(b"Columns", d.columns),
-            // As many rows as the image has: a /Rows below /Height would cut the picture short,
-            // and rows past /Height aren't drawn.
-            rows: 0,
+            rows: int(b"Rows", d.rows),
             end_of_line: flag(b"EndOfLine", d.end_of_line),
             encoded_byte_align: flag(b"EncodedByteAlign", d.encoded_byte_align),
             end_of_block: flag(b"EndOfBlock", d.end_of_block),
             black_is_1: flag(b"BlackIs1", d.black_is_1),
-        };
+        })
+    }
+
+    /// The samples of image `s`, decoded: through its filters ([`Stream::decoded`]), or, for a
+    /// CCITT fax image (its last filter), through the filters before it and then
+    /// [`pdfcraft_filters::decode_ccitt`] with its [`Document::fax_params`], as `CCITTFaxDecode`
+    /// gives them (ISO 32000-2 §7.4.6). Parameters given by reference count, for every filter
+    /// ([`Document::with_direct_parms`]). A fax image's `/Columns` has to be its `/Width`. Up to
+    /// its `/Height` rows are decoded, whatever `/Rows` says, within [`MAX_DECODED`] bytes; damaged
+    /// data gives fewer, so a caller checks it has the rows it needs.
+    pub fn decoded_image(&self, s: &Stream) -> Result<Vec<u8>, CosError> {
+        self.decoded_image_within(s, MAX_DECODED)
+    }
+
+    /// [`Document::decoded_image`] for an image whose decoding has a tighter bound than
+    /// [`MAX_DECODED`]: no stage, the filters before a fax decoder included, may produce more than
+    /// `max` bytes.
+    pub fn decoded_image_within(&self, s: &Stream, max: usize) -> Result<Vec<u8>, CosError> {
+        let max = max.min(MAX_DECODED);
+        let s = &*self.with_direct_parms(s);
+        let Some(p) = self.fax_params(s) else { return s.decoded_within(max) };
+        // As many rows as the image has: a /Rows below /Height would cut the picture short, and
+        // rows past /Height aren't drawn.
+        let p = pdfcraft_filters::CcittParams { rows: 0, ..p };
         if s.dict.int(b"Width") != Some(p.columns) {
             return Err(CosError::Filter("a fax image's /Columns aren't its /Width".into()));
         }
@@ -280,9 +290,12 @@ impl Document {
         let stride = usize::try_from(p.columns).unwrap_or(usize::MAX).div_ceil(8).max(1);
         let rows = u32::try_from(max / stride).unwrap_or(u32::MAX).min(height);
         // The filters before it, such as ASCII85Decode, are undone first.
-        let data = match before {
-            [] => Cow::Borrowed(&s.raw[..]),
-            _ => Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, max).map_err(|e| CosError::Filter(e.to_string()))?.0),
+        let chain = s.readable_filters().map_err(|e| CosError::Filter(e.to_string()))?;
+        let data = match chain.split_last() {
+            Some((_, before)) if !before.is_empty() => {
+                Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, max).map_err(|e| CosError::Filter(e.to_string()))?.0)
+            }
+            _ => Cow::Borrowed(&s.raw[..]),
         };
         pdfcraft_filters::decode_ccitt(&data, &p, rows).map_err(|e| CosError::Filter(e.to_string()))
     }
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index 53941f02b1..96b4078342 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -131,7 +131,15 @@ fn fax_images_decode_with_their_parameters() {
     assert_eq!(image(&doc, Some(Object::Dict(by_reference)), 10, 3).unwrap(), bits, "/K and /Columns by reference");
     let mut understated = parms.clone();
     understated.set(b"Rows".to_vec(), Object::Int(1));
-    assert_eq!(image(&doc, Some(Object::Dict(understated)), 10, 3).unwrap(), bits, "/Height rows, whatever /Rows says");
+    assert_eq!(image(&doc, Some(Object::Dict(understated.clone())), 10, 3).unwrap(), bits, "/Height rows, whatever /Rows says");
+    // The parameters as the file gives them, /Rows included, and Table 11's defaults.
+    let mut d = Dict::new();
+    d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+    d.set(b"DecodeParms".to_vec(), Object::Dict(understated));
+    let p = doc.fax_params(&Stream::from_raw(d.clone(), Vec::new())).unwrap();
+    assert_eq!((p.k, p.columns, p.rows, p.end_of_block, p.black_is_1), (-1, 10, 1, true, false));
+    d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+    assert!(doc.fax_params(&Stream::from_raw(d, Vec::new())).is_none(), "not a fax image");
     assert!(matches!(image(&doc, Some(Object::Dict(parms.clone())), 12, 3), Err(CosError::Filter(_))), "/Columns other than /Width");
     assert!(matches!(image(&doc, None, 10, 3), Err(CosError::Filter(_))), "the default 1728 /Columns");
     let mut plain = Dict::new();
diff --git a/crates/redact/README.md b/crates/redact/README.md
index 74509a5d06..8383f0119f 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -20,10 +20,10 @@ clear_marks(&mut doc, None)?;                        // remove marks without app
 - **images**: fully covered → removed; partly covered → a copy with the covered pixels cleared
   (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx, and CCITT fax as the last
   filter, decoded through `Document::decoded_image_within`; `/DecodeParms` given by reference,
-  numbers inside included, count; byte-aligned Group 3 with end-of-line codes but none before the
-  first row, not as T.4 sends them, is cleared as PdfCraft draws it, which at `/K 0` may be other
-  rows than were coded). Codecs redaction doesn't decode (DCT, JPX, JBIG2) are removed
-  whole (fail-closed); inline images under an area are removed. Images with separate `/SMask`
+  numbers inside included, count). Codecs redaction doesn't decode (DCT, JPX, JBIG2) are removed
+  whole (fail-closed), and so is Group 3 on bytes (`/K` 0 or more, `/EncodedByteAlign`): PdfCraft's
+  renderer draws some of its layouts (the fill ending each end-of-line code on a byte) as other
+  rows than the decoder reads, so a mark over what is shown needn't cover what is cleared; inline images under an area are removed. Images with separate `/SMask`
   or `/Mask` data, and images whose data decodes to more than three times their declared raster
   and a byte per row, plus 4 KiB (ASCIIHex text broken into lines under Flate is a little over
   twice; for a fax image's code, about a byte per pixel), are removed whole;
diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index 297b3510c4..f662849c12 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -1,9 +1,10 @@
 //! Clearing the pixels of an image under redaction regions. The image is decoded, every pixel
 //! whose footprint intersects a region is set to zero (no ink for image masks), and the result is
 //! written as a new Flate image; the original object is untouched (other pages may use it).
-//! CCITT fax images decode through `Document::decoded_image_within`. Images whose codec PdfCraft can't
-//! decode (DCT, JPX, JBIG2) return `None`, and the caller removes the whole image instead; that
-//! is fail-closed.
+//! CCITT fax images decode through `Document::decoded_image_within`, but for Group 3 on bytes,
+//! which PdfCraft's renderer may draw as other rows. Images whose codec PdfCraft can't decode
+//! (DCT, JPX, JBIG2), and Group 3 on bytes, return `None`, and the caller removes the whole image
+//! instead; that is fail-closed.
 
 use pdfcraft_content::{Matrix, overlaps};
 use pdfcraft_cos::{Document, Object, Stream};
@@ -68,6 +69,13 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     if !ok {
         return None;
     }
+    // Group 3 on bytes is removed whole for now. The decoder reads it by its end-of-line codes
+    // when the data starts with one, but PdfCraft's renderer draws such rows (the fill ending
+    // each code on a byte) as other rows, so the pixels a mark covers on screen needn't be the
+    // ones cleared.
+    if is_fax && doc.fax_params(s).is_none_or(|p| p.k >= 0 && p.encoded_byte_align) {
+        return None;
+    }
     let (w, h) = (s.dict.int(b"Width")?, s.dict.int(b"Height")?);
     if w <= 0 || h <= 0 || (w as u64) * (h as u64) > MAX_PIXELS {
         return None;
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index ffa02d939c..125f00fc5c 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -684,6 +684,40 @@ fn a_fax_image_that_cannot_be_decoded_in_full_is_removed_whole() {
     }
 }
 
+/// Group 3 on bytes is removed whole: the renderer draws some of its layouts as other rows than
+/// the decoder reads, so the pixels a mark covers on screen needn't be the ones cleared. Group 3
+/// off bytes and Group 4 on bytes are cleared. Each picture is 16 × 2 white, each row a white run
+/// of 16 (`101010`): off bytes; on bytes with no end-of-line codes; on bytes after codes whose fill
+/// ends each on a byte, at `/K 0` and at `/K 1` (a 1 after each code), `/EncodedByteAlign` given by
+/// reference there; and Group 4 rows on bytes, each the one code 1 (vertical, no change).
+#[test]
+fn group_3_on_bytes_is_removed_whole_and_other_fax_images_cleared() {
+    let image = "/Type /XObject /Subtype /Image /Width 16 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 1 /Filter /CCITTFaxDecode";
+    for (k, on_bytes, parms, data, extra, removed) in [
+        (0, false, "<< /K 0 /Columns 16 >>", vec![0xAA, 0xA0], vec![], false),
+        (0, true, "<< /K 0 /Columns 16 /EncodedByteAlign true >>", vec![0xA8, 0xA8], vec![], true),
+        (0, true, "<< /K 0 /Columns 16 /EncodedByteAlign true >>", vec![0x00, 0x01, 0xA8, 0x00, 0x01, 0xA8], vec![], true),
+        (1, true, "<< /K 1 /Columns 16 /EncodedByteAlign 8 0 R >>", vec![0x00, 0x01, 0xD4, 0x00, 0x01, 0xD4], vec![b"true".to_vec()], true),
+        (-1, true, "<< /K -1 /Columns 16 /EncodedByteAlign true >>", vec![0x80, 0x80], vec![], false),
+    ] {
+        let p = pdfcraft_filters::CcittParams { k, columns: 16, encoded_byte_align: on_bytes, ..Default::default() };
+        assert_eq!(pdfcraft_filters::decode_ccitt(&data, &p, 2).unwrap(), [0xFF; 4], "{parms}: the picture is white");
+        let dict = format!("{image} /DecodeParms {parms}");
+        let mut objs = vec![stream(&dict, data)];
+        objs.extend(extra);
+        let mut doc = one_page(b"q 160 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", objs);
+        mark(&mut doc, 0, &[[0.0, 12.0, 75.0, 18.0]], "");
+        let report = apply(&mut doc, None).unwrap();
+        if removed {
+            assert_eq!((report.images_cleared, report.images_removed), (0, 1), "{parms}");
+        } else {
+            assert_eq!((report.images_cleared, report.images_removed), (1, 0), "{parms}");
+            let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+            assert_eq!(named_image(&saved, 0, b"PCRedacted1").as_deref(), Some(&[0x00, 0xFF, 0xFF, 0xFF][..]), "{parms}");
+        }
+    }
+}
+
 /// A busy fax image is cleared, though its code is bigger than three times its raster (the bound
 /// for other images): a code takes up to about a byte per pixel, and the fax image gets that much.
 #[test]
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index b68c5b641d..458f6a7100 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,6 +1,6 @@
 # PDF specification and standards parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: redaction decodes CCITT fax images; earlier, §7.4: CCITT decoding in `pdfcraft-filters`) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: redaction decodes CCITT fax images, Group 3 on bytes aside; earlier, §7.4: CCITT decoding in `pdfcraft-filters`) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -130,7 +130,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-10-26 | minor | §7.4: redaction clears pixels in CCITT fax images through the CCITT decoder, instead of removing them whole |
+| 2026-10-26 | minor | §7.4: redaction clears pixels in CCITT fax images through the CCITT decoder, instead of removing them whole (Group 4 and Group 3 off bytes; Group 3 on bytes is still removed whole, as the bootstrap renderer may draw it as other rows than the decoder reads) |
 | 2026-10-26 | minor | §7.4: CCITT decoding (`hayro-ccitt`) in `pdfcraft-filters`, for export and the Optimizer |
 | 2026-10-26 | minor | §7.4: CCITT Group 4 encoding (`fax`) in the Optimizer |
 | 2026-10-14 | minor | §12.4.4: `/Trans` and `/Dur` read into `DocInfo::transitions` and reported by `doc_info` |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 8f22714769..ea60fc2857 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -131,7 +131,7 @@ status = "partial"
 commands = []
 tools = []
 evidence = ["crates/filters/src/ccitt.rs::decoding_gives_the_rows_back", "crates/filters/src/ccitt.rs::group_3_rows_on_bytes_read_by_the_codes_in_the_data", "crates/cos/src/document/tests.rs::fax_images_decode_with_their_parameters"]
-notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images, the optimizer and redaction. Byte-aligned Group 3 is read by its end-of-line codes when the data starts with one and on bytes otherwise; still limited: data with codes but none before the first row (not as T.4 sends them) is read on bytes, as the renderer draws it, and at /K 0 may come out as other rows, which the optimizer and redaction then write back"
+notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images, the optimizer and redaction. Byte-aligned Group 3 is read by its end-of-line codes when the data starts with one and on bytes otherwise; still limited: data with codes but none before the first row (not as T.4 sends them) is read on bytes, as the renderer draws it, and at /K 0 may come out as other rows, which the optimizer then writes back. The bootstrap renderer draws byte-aligned Group 3 whose fill ends each end-of-line code on a byte as other rows (black box, at every /K), which decode_ccitt reads right; redaction removes Group 3 on bytes whole"
 
 [[feature]]
 id = "core.decompression-limits"
@@ -5792,8 +5792,8 @@ milestone = "M8"
 status = "shipped"
 commands = ["redact.apply"]
 tools = ["redact_apply"]
-evidence = ["crates/redact/src/tests.rs::images_are_removed_or_have_their_pixels_cleared", "crates/redact/src/tests.rs::redaction_clears_pixels_intersected_without_covering_their_centres", "crates/redact/src/tests.rs::a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed", "crates/redact/src/tests.rs::an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared"]
-notes = "intersected pixel footprints are cleared conservatively in a copy, CCITT fax images (scans stored as Group 4) included; DCT/JPX/JBIG2 images removed whole"
+evidence = ["crates/redact/src/tests.rs::images_are_removed_or_have_their_pixels_cleared", "crates/redact/src/tests.rs::redaction_clears_pixels_intersected_without_covering_their_centres", "crates/redact/src/tests.rs::a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed", "crates/redact/src/tests.rs::group_3_on_bytes_is_removed_whole_and_other_fax_images_cleared", "crates/redact/src/tests.rs::an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared"]
+notes = "intersected pixel footprints are cleared conservatively in a copy, CCITT fax images (scans stored as Group 4) included; DCT/JPX/JBIG2 images, and Group 3 on bytes (which the bootstrap renderer may draw as other rows than the decoder reads), removed whole"
 
 [[feature]]
 id = "protect.redact-vectors"

From 210ba20fe69e701286bbfdbd924cfc01d9aaa9f4 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 19:11:29 +0100
Subject: [PATCH 205/270] M11: the architecture doc says Export decodes CCITT
 and JPEG; the progress logs' wording
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

docs/architecture.md said every image codec decodes through the
bootstrap renderer; Export ▸ Images decodes CCITT (hayro-ccitt) and JPEG
itself. The progress logs' "(a dithered scan)" sat after "soft mask
counted", as if it described the mask, and so did the
optimize.mono-compression note's "(a dithered scan downsampled to JPEG)".

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 ROADMAP.md                   | 2 +-
 docs/architecture.md         | 2 +-
 docs/roadmap.md              | 2 +-
 parity/acrobat-features.toml | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 0d1332e862..2b2f785167 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,7 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
-- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller, soft mask counted (a dithered scan), and Export ▸ Images reads CCITT fax images.
+- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller, as they can a dithered scan, soft mask counted, and Export ▸ Images reads CCITT fax images.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
diff --git a/docs/architecture.md b/docs/architecture.md
index 40084794b4..07448054bd 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -72,7 +72,7 @@ The PDF object graph *is* the model (`crates/engine/README.md` §The editing mod
 
 - PDF in: any revision chain, xref tables or streams, hybrid files, damaged files (repaired and
   logged), all standard-security revisions. Image codecs (DCT, JPX, JBIG2, CCITT) decode through
-  the bootstrap renderer.
+  the bootstrap renderer for display; Export ▸ Images decodes CCITT (`hayro-ccitt`) and JPEG itself.
 - PDF out: incremental or full saves, object streams, re-encryption, resource de-duplication when
   combining.
 - Other formats: images and text in (`create`); PNG/JPEG/TIFF, text, RTF, Word and HTML out
diff --git a/docs/roadmap.md b/docs/roadmap.md
index c4efe2f004..3e4c971b2f 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -257,7 +257,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller, soft mask counted (a dithered scan); Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
+| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller, as they can a dithered scan, soft mask counted; Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 6c5547c06e..376131a974 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, its soft mask counted (a dithered scan downsampled to JPEG). Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 4cfd592730d3ff74ac6b5d30f02685d487d21e05 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Fri, 23 Oct 2026 18:56:40 +0200
Subject: [PATCH 206/270] M6: calculation checks: a formula that reads a field
 the form doesn't have, and a script that builds the names it reads

calculation_order flags MissingField (a field deleted from under a sum, a
typo in notation, a script's getField; a group's name and a widget's
number count as there) and BuiltNames (a getField or AFSimple_Calculate
list built at run time, found as af::Site::Built in the same pass as the
literal names). form_calculation_order gives each field's formula and the
two new issues; form_fields shows a custom Calculate script; the
Calculation order page explains both in its row tooltips.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 ROADMAP.md                                |  1 +
 crates/automation/src/forms.rs            | 41 ++++++++++++++----
 crates/automation/src/tools.rs            |  4 +-
 crates/automation/tests/it/automation.rs  | 33 ++++++++++++++
 crates/forms/README.md                    |  5 ++-
 crates/forms/src/af.rs                    |  2 +-
 crates/forms/src/af/calc.rs               | 53 ++++++++++++++++-------
 crates/forms/src/af/tests.rs              | 31 +++++++++++++
 crates/forms/src/calc_order.rs            | 38 +++++++++++++++-
 crates/forms/src/tests.rs                 | 39 +++++++++++++++++
 crates/ui-egui/src/i18n/ar.tsv            |  2 +
 crates/ui-egui/src/i18n/bg.tsv            |  2 +
 crates/ui-egui/src/i18n/ca.tsv            |  2 +
 crates/ui-egui/src/i18n/cs.tsv            |  2 +
 crates/ui-egui/src/i18n/de.tsv            |  2 +
 crates/ui-egui/src/i18n/el.tsv            |  2 +
 crates/ui-egui/src/i18n/es.tsv            |  2 +
 crates/ui-egui/src/i18n/fi.tsv            |  3 ++
 crates/ui-egui/src/i18n/fr.tsv            |  2 +
 crates/ui-egui/src/i18n/hi.tsv            |  2 +
 crates/ui-egui/src/i18n/hu.tsv            |  2 +
 crates/ui-egui/src/i18n/id.tsv            |  2 +
 crates/ui-egui/src/i18n/it.tsv            |  2 +
 crates/ui-egui/src/i18n/ja.tsv            |  2 +
 crates/ui-egui/src/i18n/kk.tsv            |  2 +
 crates/ui-egui/src/i18n/ko.tsv            |  2 +
 crates/ui-egui/src/i18n/lt.tsv            |  2 +
 crates/ui-egui/src/i18n/pl.tsv            |  2 +
 crates/ui-egui/src/i18n/pt-br.tsv         |  2 +
 crates/ui-egui/src/i18n/ro.tsv            |  2 +
 crates/ui-egui/src/i18n/ru.tsv            |  2 +
 crates/ui-egui/src/i18n/sl.tsv            |  2 +
 crates/ui-egui/src/i18n/sq.tsv            |  2 +
 crates/ui-egui/src/i18n/te.tsv            |  2 +
 crates/ui-egui/src/i18n/tr.tsv            |  2 +
 crates/ui-egui/src/i18n/uk.tsv            |  2 +
 crates/ui-egui/src/i18n/vi.tsv            |  2 +
 crates/ui-egui/src/i18n/zh-hans.tsv       |  2 +
 crates/ui-egui/src/i18n/zh-hant.tsv       |  2 +
 crates/ui-egui/src/tools/calc_order_ui.rs |  6 +++
 docs/roadmap.md                           |  2 +
 parity/acrobat-features.toml              |  8 ++--
 42 files changed, 288 insertions(+), 34 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index f5de8044e1..2c86653a4d 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,6 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
+- **2026-10-23 (M6, calculation checks):** The calculation order now flags a formula that reads a field the form doesn't have (a field deleted from under a sum, a typo in notation, a script's `getField`) and a script that builds the names it reads at run time. `form_calculation_order` gives each field's formula, and `form_fields` shows a custom Calculate script.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
 - **2026-10-23 (M7, #2636 partial):** A new `PasteContent` edit pastes an added text box or image copied in the same document or another, keeping its style, picture, turns, flips and crop, as one undo step; `content_copy` drives it headlessly. A paste lands beside earlier copies (18 pt steps) and stays on the page. A pasted image reuses its picture object in its own document and after the first paste into another; there a colour profile is dropped and CMYK colours stored losslessly are turned to RGB. The desktop keys and menus follow in separate PRs. Estimates unchanged.
diff --git a/crates/automation/src/forms.rs b/crates/automation/src/forms.rs
index 1c1e3c3371..1dec77bf03 100644
--- a/crates/automation/src/forms.rs
+++ b/crates/automation/src/forms.rs
@@ -116,6 +116,9 @@ fn calculate_arg(v: &Value) -> Result<Calculate> {
     if let Some(n) = o.get("notation").and_then(Value::as_str) {
         return Ok(Calculate::Notation(n.to_string()));
     }
+    if o.contains_key("script") {
+        return Err(bad("a custom calculate script is set with form_set_script (event: calculate)"));
+    }
     let op = match o.get("op").and_then(Value::as_str).unwrap_or("") {
         "sum" => CalcOp::Sum,
         "product" => CalcOp::Product,
@@ -132,6 +135,17 @@ fn calculate_arg(v: &Value) -> Result<Calculate> {
     Ok(Calculate::Simple { op, fields })
 }
 
+/// A field's calculation as `form_fields` and `form_calculation_order` show it, in
+/// `form_set_props`'s shape, or `{"script": …}` for a custom Calculate script; `None` without one.
+fn calculate_json(f: &FormField) -> Option<Value> {
+    match (&f.actions.calculate, &f.actions.scripts.calculate) {
+        (Calculate::Simple { op, fields }, _) => Some(json!({ "op": op.code().to_lowercase(), "fields": fields })),
+        (Calculate::Notation(n), _) => Some(json!({ "notation": n })),
+        (Calculate::None, Some(js)) => Some(json!({ "script": js })),
+        (Calculate::None, None) => None,
+    }
+}
+
 fn format_json(f: &Format) -> Value {
     match f {
         Format::None => Value::Null,
@@ -220,14 +234,8 @@ impl Automation {
                 if let Validate::Range { min, max } = &f.actions.validate {
                     o.insert("validate".into(), json!({ "min": min, "max": max }));
                 }
-                match &f.actions.calculate {
-                    Calculate::Simple { op, fields } => {
-                        o.insert("calculate".into(), json!({ "op": op.code().to_lowercase(), "fields": fields }));
-                    }
-                    Calculate::Notation(n) => {
-                        o.insert("calculate".into(), json!({ "notation": n }));
-                    }
-                    Calculate::None => {}
+                if let Some(c) = calculate_json(f) {
+                    o.insert("calculate".into(), c);
                 }
                 if !f.actions.unsupported.is_empty() {
                     o.insert("unsupported_scripts".into(), json!(f.actions.unsupported));
@@ -653,15 +661,30 @@ impl Automation {
         };
         let order = self.doc(a)?.calculation_order();
         let issue = |i: &CalculationIssue| match i {
+            CalculationIssue::MissingField { field } => json!({ "issue": "missing_field", "field": field }),
             CalculationIssue::RunsTooEarly { field } => json!({ "issue": "runs_too_early", "field": field }),
             CalculationIssue::Cycle { fields } => json!({ "issue": "cycle", "fields": fields }),
             CalculationIssue::NotInOrder => json!({ "issue": "not_in_order" }),
+            CalculationIssue::BuiltNames => json!({ "issue": "built_names" }),
         };
+        let doc = self.doc(a)?;
+        let mut by_name: std::collections::HashMap<&str, &FormField> = std::collections::HashMap::with_capacity(doc.form.len());
+        for f in doc.form.iter() {
+            by_name.entry(f.name.as_str()).or_insert(f);
+        }
         out["calculation_order"] = json!(order.fields.iter().map(|f| f.name.as_str()).collect::<Vec<_>>());
         out["fields"] = order
             .fields
             .iter()
-            .map(|f| json!({ "name": f.name, "reads": f.reads, "listed": f.listed, "issues": f.issues.iter().map(issue).collect::<Vec<_>>() }))
+            .map(|f| {
+                json!({
+                    "name": f.name,
+                    "formula": by_name.get(f.name.as_str()).and_then(|x| calculate_json(x)),
+                    "reads": f.reads,
+                    "listed": f.listed,
+                    "issues": f.issues.iter().map(issue).collect::<Vec<_>>(),
+                })
+            })
             .collect();
         out["extra"] = json!(order.extra);
         out["fixable"] = json!(order.fixable());
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 53c4582af9..b41e114442 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -391,7 +391,7 @@ pub fn tools() -> Vec<ToolDef> {
             }),
             &["doc", "from", "to"],
         )),
-        t("form_fields", "List form fields", "Every interactive form field: name, type (text, checkbox, radio, combo, list, button, signature), value, options, page, rect (top-left-origin points) and rotation (0, 90, 180 or 270 degrees counterclockwise), read-only and required flags. Push buttons include caption (first widget's normal label) and captions [{widget, caption}] for all widgets (1-based).")
+        t("form_fields", "List form fields", "Every interactive form field: name, type (text, checkbox, radio, combo, list, button, signature), value, options, page, rect (top-left-origin points) and rotation (0, 90, 180 or 270 degrees counterclockwise), read-only and required flags. A calculated field includes calculate: {op, fields} or {notation} as form_set_props takes them, or {script} for a custom Calculate script (set with form_set_script). Push buttons include caption (first widget's normal label) and captions [{widget, caption}] for all widgets (1-based).")
             .ro()
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t(
@@ -502,7 +502,7 @@ pub fn tools() -> Vec<ToolDef> {
                 json!({ "doc": doc(), "order": { "type": "string", "enum": ["row", "column", "structure", "annotations"] }, "pages": pages("to set (default: all)"), "field": { "type": "string" }, "move": { "type": "string", "enum": ["earlier", "later"] } }),
                 &["doc"],
             )),
-        t("form_calculation_order", "Read or set the calculation order", "The calculated fields in the order they calculate (Acrobat: Set Field Calculation Order), each with the fields its formula reads (`reads`; a script's names built at run time aren't known) and its `issues`: runs_too_early (it reads `field`, which calculates after it, so it shows a stale value), cycle (it reads `fields`, which read it back: no order fixes that, a formula has to change) and not_in_order (the PDF's order leaves it out, so other viewers may not calculate it). `extra` lists entries of the PDF's order that calculate nothing. Without a change it only reads. Changes, one at a time: `order` (these fields first, in this order, then the other calculated fields in their order), `field` with `move` earlier|later (one place), or `fix` true (only what must move moves, so every field calculates after the fields it reads, and the extra entries go). A change recalculates the form. Undoable.")
+        t("form_calculation_order", "Read or set the calculation order", "The calculated fields in the order they calculate (Acrobat: Set Field Calculation Order), each with its `formula` (as form_fields shows calculate), the fields it reads (`reads`; a script's names built at run time aren't known) and its `issues`: missing_field (it reads `field`, which the form doesn't have, so it gets no value there), runs_too_early (it reads `field`, which calculates after it, so it shows a stale value), cycle (it reads `fields`, which read it back: no order fixes that, a formula has to change) and not_in_order (the PDF's order leaves it out, so other viewers may not calculate it) and built_names (its script also reads fields by names it builds at run time, which aren't checked). `extra` lists entries of the PDF's order that calculate nothing. Without a change it only reads. Changes, one at a time: `order` (these fields first, in this order, then the other calculated fields in their order), `field` with `move` earlier|later (one place), or `fix` true (only what must move moves, so every field calculates after the fields it reads, and the extra entries go). A change recalculates the form. Undoable.")
             .cmd("form.calculation_order")
             .with(schema(
                 json!({ "doc": doc(), "order": { "type": "array", "items": { "type": "string" } }, "field": { "type": "string" }, "move": { "type": "string", "enum": ["earlier", "later"] }, "fix": { "type": "boolean" } }),
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 01d0d1eb24..22b5cd17e2 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -5058,6 +5058,39 @@ fn the_calculation_order_is_read_fixed_and_set() {
     assert_eq!((value(&mut a, "total"), value(&mut a, "tax")), (json!("0"), json!("0")), "undone with the values it recalculated");
 }
 
+/// The calculation order through the tool shows each formula, in form_set_props's shape or as a
+/// script, and flags a read of a field the form doesn't have and a script that builds the names
+/// it reads; form_fields shows a custom script too.
+#[test]
+fn the_calculation_order_shows_formulas_and_what_they_cannot_read() {
+    let dir = workdir("calcformulas");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    for (i, name) in ["qty", "price", "sub", "tax", "total"].into_iter().enumerate() {
+        let y = 20 + 30 * i;
+        ok(&mut a, "form_add_field", json!({ "doc": doc, "page": 1, "type": "text", "rect": [20, y, 180, y + 22], "name": name }));
+    }
+    let script = "event.value = getField(\"sub\").value / 10 + getField(\"row\" + 1).value;";
+    ok(&mut a, "form_set_props", json!({ "doc": doc, "field": "sub", "calculate": { "notation": "qty * pric" } }));
+    ok(&mut a, "form_set_script", json!({ "doc": doc, "field": "tax", "event": "calculate", "script": script }));
+    ok(&mut a, "form_set_props", json!({ "doc": doc, "field": "total", "calculate": { "op": "sum", "fields": ["sub", "tax"] } }));
+    let r = ok(&mut a, "form_calculation_order", json!({ "doc": doc }));
+    assert_eq!(r["calculation_order"], json!(["sub", "tax", "total"]));
+    let formulas: Vec<Value> = r["fields"].as_array().unwrap().iter().map(|f| f["formula"].clone()).collect();
+    assert_eq!(formulas, [json!({ "notation": "qty * pric" }), json!({ "script": script }), json!({ "op": "sum", "fields": ["sub", "tax"] })]);
+    assert_eq!(r["fields"][0]["issues"], json!([{ "issue": "missing_field", "field": "pric" }]));
+    assert_eq!(r["fields"][1]["reads"], json!(["sub"]));
+    assert_eq!(r["fields"][1]["issues"], json!([{ "issue": "built_names" }]));
+    assert_eq!(r["fields"][2]["issues"], json!([]));
+    assert_eq!(r["fixable"], false, "neither is an order to fix");
+    let fields = ok(&mut a, "form_fields", json!({ "doc": doc }));
+    let tax = fields["fields"].as_array().unwrap().iter().find(|f| f["name"] == "tax").unwrap();
+    assert_eq!(tax["calculate"], json!({ "script": script }));
+    // A script is set with form_set_script, and form_set_props says so.
+    let e = err(&mut a, "form_set_props", json!({ "doc": doc, "field": "tax", "calculate": { "script": script } }));
+    assert!(e.to_string().contains("form_set_script"), "{e}");
+}
+
 #[test]
 fn page_tab_orders_are_read_and_set_per_page_through_tools() {
     let dir = workdir("pagetabs");
diff --git a/crates/forms/README.md b/crates/forms/README.md
index 93b65bd14e..3b5e46eee9 100644
--- a/crates/forms/README.md
+++ b/crates/forms/README.md
@@ -90,7 +90,10 @@ let cells: Vec<table::Cell> = grid.cells_for(names)?;      // "Table1_1", "Table
   order `recalculate` runs them, with the fields each formula reads (`Calculate::reads`,
   `af::calculation_reads`; names built at run time aren't known) and what is wrong with the
   order: a field reading one that calculates later, a loop, a field `/CO` leaves out, and `/CO`
-  entries that calculate nothing. `CalculationOrder::fixed` is Fix order: a stable topological
+  entries that calculate nothing. Two issues are about the formula itself: it reads a field the
+  form doesn't have (`MissingField`; the field of that name, a field under it and a widget of one,
+  `price.0`, all count as there), or its script builds names at run time (`BuiltNames`,
+  `af::reads_built_names`), so its reads are incomplete. `CalculationOrder::fixed` is Fix order: a stable topological
   sort that keeps the current order wherever it can and leaves loops as they are.
   `set_calculation_order` writes `/CO` afresh. A field that gets a calculation joins the end of
   the order; one whose calculation changes keeps its place.
diff --git a/crates/forms/src/af.rs b/crates/forms/src/af.rs
index ee4aa18e3c..00cfc99d12 100644
--- a/crates/forms/src/af.rs
+++ b/crates/forms/src/af.rs
@@ -19,7 +19,7 @@ mod script;
 
 #[cfg(test)]
 use calc::{Notation, eval_notation, notation_name, notation_tokens, unique};
-pub use calc::{calculate, calculation_reads, notation_js, rename_in_calculation};
+pub use calc::{calculate, calculation_reads, notation_js, reads_built_names, rename_in_calculation};
 pub use format::{DATE_PRESETS, DateTime, TIME_PRESETS, format_date, format_value, js_number, keystroke, make_number, parse_date, validate};
 use script::{Arg, call};
 pub use script::{calculate_js, format_js, parse_calculate, parse_format, parse_validate, validate_js};
diff --git a/crates/forms/src/af/calc.rs b/crates/forms/src/af/calc.rs
index b3a1524a4f..958b5d4d04 100644
--- a/crates/forms/src/af/calc.rs
+++ b/crates/forms/src/af/calc.rs
@@ -206,6 +206,10 @@ enum Site {
     Commas(String),
     /// A name in the simplified field notation of a `BVCALC` comment.
     Notation(String),
+    /// A field read by a name built at run time: a `getField` whose argument is more than one
+    /// string literal (`getField("row" + i)`), or an `AFSimple_Calculate` list that isn't
+    /// written out. Which field it is isn't known.
+    Built,
 }
 
 impl Site {
@@ -213,6 +217,7 @@ impl Site {
         match self {
             Site::Literal(name) | Site::Notation(name) => vec![name.as_str()],
             Site::Commas(list) => list.split(',').map(str::trim).filter(|n| !n.is_empty()).collect(),
+            Site::Built => Vec::new(),
         }
     }
 
@@ -229,14 +234,16 @@ impl Site {
                     js_str(&parts.join(","))
                 })
             }
+            Site::Built => None,
         }
     }
 }
 
 /// Where a Calculate script names fields, in order: the simplified field notation in its comment
 /// (see [`notation_range`]; [`parse_calculate`] reads it there too), the field list of
-/// `AFSimple_Calculate`, and every `getField` whose whole argument is one string literal.
-/// A name built at run time (`getField("row" + i)`) is not a site.
+/// `AFSimple_Calculate`, and every `getField` whose whole argument is one string literal. A name
+/// built at run time (`getField("row" + i)`) is a [`Site::Built`], at its `getField` or
+/// `AFSimple_Calculate`.
 fn calculation_sites(js: &str) -> Vec<(Range<usize>, Site)> {
     let mut sites = Vec::new();
     let (tokens, comments) = js_tokens(js);
@@ -255,35 +262,45 @@ fn calculation_sites(js: &str) -> Vec<(Range<usize>, Site)> {
         Some((range, Js::Str(text))) => Some((range.clone(), text.clone())),
         _ => None,
     };
+    let built = |k: usize| tokens.get(k).map(|(range, _)| (range.clone(), Site::Built));
     for k in 0..tokens.len() {
-        if ident(k, "getField")
-            && punct(k + 1, '(')
-            && punct(k + 3, ')')
-            && let Some((range, name)) = string(k + 2)
-        {
-            sites.push((range, Site::Literal(name)));
+        if ident(k, "getField") && punct(k + 1, '(') {
+            match string(k + 2) {
+                Some((range, name)) if punct(k + 3, ')') => sites.push((range, Site::Literal(name))),
+                _ => sites.extend(built(k)),
+            }
         }
-        if !(ident(k, "AFSimple_Calculate") && punct(k + 1, '(') && string(k + 2).is_some() && punct(k + 3, ',')) {
+        if !(ident(k, "AFSimple_Calculate") && punct(k + 1, '(')) {
+            continue;
+        }
+        if !(string(k + 2).is_some() && punct(k + 3, ',')) {
+            sites.extend(built(k));
             continue;
         }
         if let Some((range, list)) = string(k + 4) {
             sites.push((range, Site::Commas(list)));
             continue;
         }
-        // `new Array("a", "b")` or `["a", "b"]`: its items, up to the first that isn't a string.
-        // Nothing else is read, so no token is read for two calls.
-        let first = if punct(k + 4, '[') {
-            k + 5
+        // `new Array("a", "b")` or `["a", "b"]`: its items, up to the first that isn't a string,
+        // which has to close the list for the list to be written out. Nothing else is read, so no
+        // token is read for two calls.
+        let (first, close) = if punct(k + 4, '[') {
+            (k + 5, ']')
         } else if ident(k + 4, "new") && ident(k + 5, "Array") && punct(k + 6, '(') {
-            k + 7
+            (k + 7, ')')
         } else {
+            sites.extend(built(k));
             continue;
         };
         for (range, token) in tokens.iter().skip(first) {
             match token {
                 Js::Str(name) => sites.push((range.clone(), Site::Literal(name.clone()))),
                 Js::Punct(',') => {}
-                _ => break,
+                Js::Punct(c) if *c == close => break,
+                _ => {
+                    sites.extend(built(k));
+                    break;
+                }
             }
         }
     }
@@ -315,6 +332,12 @@ pub fn calculation_reads(js: &str) -> Vec<String> {
     unique(sites.iter().flat_map(|(_, site)| site.names()).map(str::to_owned))
 }
 
+/// Whether a Calculate script also reads fields by names it builds at run time
+/// (`getField("row" + i)`), which [`calculation_reads`] can't list.
+pub fn reads_built_names(js: &str) -> bool {
+    calculation_sites(js).iter().any(|(_, site)| *site == Site::Built)
+}
+
 impl Calculate {
     /// The fields it reads, each once, in the order it first names them. A name also stands for
     /// the fields under it (`row` for `row.0` and `row.1`), as [`calculate`] reads them.
diff --git a/crates/forms/src/af/tests.rs b/crates/forms/src/af/tests.rs
index ff25e06968..5198fcc5ad 100644
--- a/crates/forms/src/af/tests.rs
+++ b/crates/forms/src/af/tests.rs
@@ -156,6 +156,37 @@ fn a_regex_after_a_condition_is_not_read_as_code() {
     assert_eq!(renamed(divides), Some(divides.replace("\"a\"", "\"qty\"")));
 }
 
+/// A `getField` whose argument is more than one string, or an `AFSimple_Calculate` list that
+/// isn't written out, reads a field whose name isn't known until the script runs.
+#[test]
+fn names_built_at_run_time_are_noticed() {
+    for js in [
+        "event.value = getField(\"row\" + i).value;",
+        "event.value = this.getField(name).value;",
+        "AFSimple_Calculate(\"SUM\", list);",
+        "AFSimple_Calculate(\"SUM\", new Array(\"a\", b));",
+        "AFSimple_Calculate(\"SUM\", [\"a\", prefix + \"b\"]);",
+        "AFSimple_Calculate(\"SUM\", new Array(\"a\", \"b\" + c));",
+        "AFSimple_Calculate(op, new Array(\"a\"));",
+    ] {
+        assert!(reads_built_names(js), "{js}");
+    }
+    for js in [
+        "event.value = getField(\"a\").value + getField('b').value;",
+        "AFSimple_Calculate(\"SUM\", new Array(\"a\", \"b\"));",
+        "AFSimple_Calculate(\"SUM\", [\"a\", \"b\",]);",
+        "AFSimple_Calculate(\"SUM\", \"a, b\");",
+        "// getField(\"row\" + i)\nvar s = 'getField(name)'; event.value = 1;",
+        "/** BVCALC a + b EVCALC **/ event.value = getField(\"a\").value + getField(\"b\").value;",
+    ] {
+        assert!(!reads_built_names(js), "{js}");
+    }
+    // The names it does know are still read and renamed.
+    let js = "event.value = getField(\"a\").value + getField(\"row\" + i).value + AFSimple_Calculate(\"SUM\", new Array(\"a\", b));";
+    assert_eq!(calculation_reads(js), ["a"]);
+    assert_eq!(rename_in_calculation(js, "a", "qty"), Some(js.replace("\"a\"", "\"qty\"")));
+}
+
 /// Scripts are read in one pass: a line of unfinished regular expressions, or calls nested in
 /// one another's field lists, don't make a rename read the rest of the script again for each.
 #[test]
diff --git a/crates/forms/src/calc_order.rs b/crates/forms/src/calc_order.rs
index 4e7f0309e9..c4a1b5bd37 100644
--- a/crates/forms/src/calc_order.rs
+++ b/crates/forms/src/calc_order.rs
@@ -26,9 +26,12 @@ pub struct CalculatedField {
     pub issues: Vec<CalculationIssue>,
 }
 
-/// Something wrong with a calculated field's place in the calculation order.
+/// Something wrong with a calculated field's formula or its place in the calculation order.
 #[derive(Clone, Debug, PartialEq)]
 pub enum CalculationIssue {
+    /// It reads `field`, which the form doesn't have (a field deleted, renamed outside PdfCraft,
+    /// or mistyped), so the formula gets no value there.
+    MissingField { field: String },
     /// It reads `field`, which calculates after it, so it uses that field's previous value.
     RunsTooEarly { field: String },
     /// Its formula reads its own result: it reads `fields`, which read it back (itself, when it
@@ -37,6 +40,9 @@ pub enum CalculationIssue {
     /// `/CO` leaves it out. PdfCraft calculates it after the listed fields, but other PDF viewers
     /// may not calculate it at all.
     NotInOrder,
+    /// Its script also reads fields by names it builds at run time (`getField("row" + i)`). Those
+    /// aren't in `reads`, so the order isn't checked against them.
+    BuiltNames,
 }
 
 /// A form's calculation order and what is wrong with it.
@@ -152,11 +158,14 @@ pub fn calculation_order(doc: &Document, fields: &[Field]) -> CalculationOrder {
         .collect();
     let links = links(calculated.iter().map(|(f, _)| f.name.as_str()), &reads);
     let component = components(&links);
+    let mut all: Vec<&str> = fields.iter().map(|f| f.name.as_str()).collect();
+    all.sort_unstable();
     let name = |k: usize| calculated.get(k).map(|(f, _)| f.name.clone()).unwrap_or_default();
     let mut out = Vec::with_capacity(calculated.len());
     for (k, ((f, listed), reads)) in calculated.iter().zip(reads).enumerate() {
         let own = component.get(k).copied();
-        let mut issues = Vec::new();
+        let mut issues: Vec<CalculationIssue> =
+            reads.iter().filter(|name| !found(&all, name)).map(|name| CalculationIssue::MissingField { field: name.clone() }).collect();
         let read = links.get(k).map(Vec::as_slice).unwrap_or_default();
         for &j in read {
             if j > k && component.get(j).copied() != own {
@@ -172,12 +181,25 @@ pub fn calculation_order(doc: &Document, fields: &[Field]) -> CalculationOrder {
         if !listed {
             issues.push(CalculationIssue::NotInOrder);
         }
+        if f.actions.scripts.calculate.as_deref().is_some_and(crate::af::reads_built_names) {
+            issues.push(CalculationIssue::BuiltNames);
+        }
         out.push(CalculatedField { name: f.name.clone(), reads, listed: *listed, issues });
     }
     let fixed = fixed_order(&links, &component);
     CalculationOrder { fields: out, extra, fixed }
 }
 
+/// Whether a formula's read `name` finds a field in `names` (sorted): the field of that name, a
+/// field under it (`row` for `row.1`), or a widget of one (`price.0`, as `getField` numbers them).
+fn found(names: &[&str], name: &str) -> bool {
+    let has = |n: &str| names.binary_search(&n).is_ok();
+    let prefix = format!("{name}.");
+    let under = names.partition_point(|n| *n < prefix.as_str());
+    let widget = name.rsplit_once('.').is_some_and(|(base, i)| !i.is_empty() && i.bytes().all(|b| b.is_ascii_digit()) && has(base));
+    has(name) || names.get(under).is_some_and(|n| n.starts_with(&prefix)) || widget
+}
+
 /// For each calculated field (by its place in `names`), the places of the calculated fields it
 /// reads, sorted. A read name finds the field of that name and the fields under it, as
 /// [`crate::recalculate`] looks values up.
@@ -383,6 +405,18 @@ mod tests {
         assert_eq!(links(names.into_iter(), &reads)[5], [0, 1, 2], "row, row.1 and row.10; not rows or row-1");
     }
 
+    #[test]
+    fn a_read_name_finds_a_field_a_group_or_a_widget() {
+        let mut names = vec!["price", "row.1", "row.2", "rows", "total"];
+        names.sort_unstable();
+        for name in ["price", "row", "row.1", "rows", "price.0", "price.12"] {
+            assert!(found(&names, name), "{name}");
+        }
+        for name in ["pric", "ro", "row.3", "price.", "price.x", "price.-1", "total.0.1", ""] {
+            assert!(!found(&names, name), "{name}");
+        }
+    }
+
     /// Two thousand formulas each reading a group of two thousand fields would be four million
     /// reads; the checks stop at their cap.
     #[test]
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index ac414af2ae..6f848f9628 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -1711,6 +1711,45 @@ fn the_calculation_order_is_checked_fixed_and_kept() {
     assert_eq!(order.fixed(), ["sub", "total", "tax", "grand"], "only tax moves, to just after total");
 }
 
+/// A formula that reads a field the form doesn't have is flagged, whichever kind of formula it
+/// is: a field deleted from under a sum, a typo in notation, a script's `getField`. So is a
+/// script that builds the names it reads. Neither is an order Fix order can fix.
+#[test]
+fn missing_fields_and_built_names_are_flagged() {
+    use crate::af::{CalcOp, Calculate};
+    use crate::calc_order::CalculationIssue::{BuiltNames, MissingField};
+    let mut doc = one_page();
+    let text = NewField::Text { multiline: false };
+    for (i, name) in ["qty", "gone", "sum", "notation", "script", "built"].into_iter().enumerate() {
+        let y = 700.0 - 40.0 * i as f64;
+        add_field(&mut doc, 0, [50.0, y, 250.0, y + 20.0], &text, Some(name)).unwrap();
+    }
+    let calculate = |c: Calculate| FieldProps { calculate: Some(c), ..FieldProps::default() };
+    set_props(&mut doc, "sum", &calculate(Calculate::Simple { op: CalcOp::Sum, fields: vec!["qty".into(), "gone".into()] })).unwrap();
+    set_props(&mut doc, "notation", &calculate(Calculate::Notation("qty * nope".into()))).unwrap();
+    set_field_script(&mut doc, "script", "calculate", Some("event.value = getField(\"qty\").value + getField(\"ghost\").value;")).unwrap();
+    set_field_script(&mut doc, "built", "calculate", Some("event.value = getField(\"qty\").value + getField(\"row\" + 1).value;")).unwrap();
+    let issues = |doc: &Document| {
+        let order = calculation_order(doc, &fields(doc));
+        assert!(!order.fixable(), "nothing Fix order can fix");
+        order.fields.into_iter().map(|f| (f.name, f.issues)).collect::<Vec<_>>()
+    };
+    let expected = |sum: Vec<_>| {
+        vec![
+            ("sum".to_owned(), sum),
+            ("notation".to_owned(), vec![MissingField { field: "nope".into() }]),
+            ("script".to_owned(), vec![MissingField { field: "ghost".into() }]),
+            ("built".to_owned(), vec![BuiltNames]),
+        ]
+    };
+    assert_eq!(issues(&doc), expected(vec![]));
+    delete_field(&mut doc, "gone").unwrap();
+    assert_eq!(issues(&doc), expected(vec![MissingField { field: "gone".into() }]), "a deleted field leaves the sum reading nothing");
+    assert_eq!(issues(&reopen(&doc)), expected(vec![MissingField { field: "gone".into() }]));
+    let order = calculation_order(&doc, &fields(&doc));
+    assert_eq!(order.fields[3].reads, ["qty"], "the names it does know are still read");
+}
+
 /// `/CO` as other tools leave it: a calculated field missing, a field without a calculation, an
 /// entry repeated, a reference to nothing and a number. The order reads around them, and setting
 /// the order writes `/CO` afresh.
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 3e6d735523..0d429f657c 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -541,6 +541,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	يقرأ {names} التي تقرؤه بدورها. لا يمكن لأي ترتيب إصلاح الحلقة: غيّر إحدى الصيغ.
 	Not in order	خارج الترتيب
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	غير موجود في ترتيب الحساب المحفوظ في ملف PDF: قد لا تحسبه برامج عرض PDF الأخرى.
+	Reads {name}, which the form doesn't have, so it gets no value there.	يقرأ {name}، وهو غير موجود في النموذج، لذا لا يحصل منه على أي قيمة.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	يقرأ سكربته أيضًا حقولًا يبني أسماءها أثناء التشغيل، لذا لا يمكن التحقق من هذه القراءات.
 	Back to Prepare a form	العودة إلى تجهيز نموذج
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	لا يحسب أي حقل في هذا النموذج قيمته بعد. امنح حقلًا عملية حساب في علامة التبويب «الحساب» ضمن خصائصه، وسيظهر هنا.
 	{names} and {last}	{names} و{last}
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index ec0339f18a..2ef342e51b 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -202,6 +202,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Чете {names}, които на свой ред го четат. Никой ред не може да поправи цикъл: променете една от формулите.
 	Not in order	Извън реда
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Липсва в реда на изчисляване, записан в PDF файла: други програми за PDF може да не го изчисляват.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Чете {name}, което го няма във формуляра, затова не получава стойност оттам.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Скриптът му чете и полета, чиито имена съставя по време на изпълнение, затова тези четения не могат да бъдат проверени.
 	Back to Prepare a form	Назад към „Подготви формуляр“
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Все още нито едно поле в този формуляр не изчислява стойността си. Задайте изчисление на поле в раздела „Изчисляване“ на свойствата му и то ще се покаже тук.
 	{names} and {last}	{names} и {last}
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 0cacae3c2c..dda1208dad 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -2720,6 +2720,8 @@ theme	Appearance	Aspecte
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.
 	Not in order	Not in order
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
 	Back to Prepare a form	Back to Prepare a form
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.
 	{names} and {last}	{names} and {last}
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index ed6d051b57..3c38493305 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -625,6 +625,8 @@ key	Space	Mezerník
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Čte {names}, která ho čtou zpět. Žádné pořadí smyčku neopraví: změňte jeden ze vzorců.
 	Not in order	Mimo pořadí
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Chybí v pořadí výpočtů uloženém v PDF: jiné prohlížeče PDF ho možná nepočítají.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Čte {name}, které formulář nemá, takže odtud nedostane žádnou hodnotu.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Jeho skript čte i pole, jejichž názvy sestavuje za běhu, takže tato čtení nelze zkontrolovat.
 	Back to Prepare a form	Zpět na Připravit formulář
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Žádné pole tohoto formuláře zatím nepočítá svou hodnotu. Zadejte poli výpočet na kartě Výpočet v jeho vlastnostech a zobrazí se zde.
 	{names} and {last}	{names} a {last}
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 8586a21d43..8d605a024b 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -514,6 +514,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Liest {names}, die es wieder lesen. Keine Reihenfolge kann eine Schleife beheben: Ändere eine der Formeln.
 	Not in order	Nicht in der Reihenfolge
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Fehlt in der im PDF gespeicherten Berechnungsreihenfolge: Andere PDF-Viewer berechnen es womöglich nicht.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Liest {name}, das es im Formular nicht gibt, und erhält dort deshalb keinen Wert.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Sein Skript liest auch Felder, deren Namen es erst beim Ausführen bildet. Diese Lesezugriffe lassen sich nicht prüfen.
 	Back to Prepare a form	Zurück zu „Formular vorbereiten“
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Noch berechnet kein Feld dieses Formulars seinen Wert. Gib einem Feld auf dem Tab „Berechnen“ seiner Eigenschaften eine Berechnung, dann erscheint es hier.
 	{names} and {last}	{names} und {last}
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index e3eac77caa..3efb631ae1 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -1852,6 +1852,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Διαβάζει τα {names}, που με τη σειρά τους το διαβάζουν. Καμία σειρά δεν διορθώνει έναν βρόχο: αλλάξτε έναν από τους τύπους.
 	Not in order	Εκτός σειράς
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Λείπει από τη σειρά υπολογισμού που είναι αποθηκευμένη στο PDF: άλλα προγράμματα προβολής PDF ίσως δεν το υπολογίζουν.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Διαβάζει το {name}, που δεν υπάρχει στη φόρμα, οπότε δεν παίρνει τιμή από εκεί.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Η δέσμη ενεργειών του διαβάζει επίσης πεδία των οποίων τα ονόματα σχηματίζει κατά την εκτέλεση, οπότε αυτές οι αναγνώσεις δεν μπορούν να ελεγχθούν.
 	Back to Prepare a form	Επιστροφή στην Προετοιμασία φόρμας
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Κανένα πεδίο αυτής της φόρμας δεν υπολογίζει ακόμη την τιμή του. Δώστε σε ένα πεδίο υπολογισμό στην καρτέλα Υπολογισμός των ιδιοτήτων του και θα εμφανιστεί εδώ.
 	{names} and {last}	{names} και {last}
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 0d4e505a70..fb17254189 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -537,6 +537,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Lee {names}, que a su vez lo leen. Ningún orden puede corregir un bucle: cambia una de las fórmulas.
 	Not in order	Fuera del orden
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Falta en el orden de cálculo guardado en el PDF: otros visores de PDF podrían no calcularlo.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Lee {name}, que no existe en el formulario, así que no obtiene ningún valor de ahí.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Su script también lee campos cuyos nombres construye mientras se ejecuta, así que esas lecturas no se pueden comprobar.
 	Back to Prepare a form	Volver a Preparar un formulario
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Ningún campo de este formulario calcula todavía su valor. Dale a un campo un cálculo en la pestaña Calcular de sus propiedades y aparecerá aquí.
 	{names} and {last}	{names} y {last}
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index a542ee9b91..f35cb08d5a 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -2783,6 +2783,9 @@ theme	Appearance	Teema
 	The signature's signed attributes have no message digest, so the signature does not cover the document.	Allekirjoituksen allekirjoitetuista määritteistä puuttuu viestitiiviste, joten allekirjoitus ei kata asiakirjaa.
 	The signature's signed attributes name a content type other than data, so it is not a signature of the document.	Allekirjoituksen allekirjoitetut määritteet nimeävät muun sisältötyypin kuin data, joten se ei ole asiakirjan allekirjoitus.
 	Remove {standard} identification	Poista {standard}-tunniste
+# Untranslated: English text until a translator fills these in.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
 
 # Prepare a form ▸ Text field table (AI-assisted, not separately native-reviewed)
 	Add text field table	Lisää tekstikenttätaulukko
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 61c8b5171d..e83249e394 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -514,6 +514,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Lit {names}, qui le lisent en retour. Aucun ordre ne peut corriger une boucle : modifiez l'une des formules.
 	Not in order	Hors de l'ordre
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Absent de l'ordre de calcul enregistré dans le PDF : d'autres lecteurs PDF risquent de ne pas le calculer.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Lit {name}, qui n'existe pas dans le formulaire : aucune valeur n'en provient.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Son script lit aussi des champs dont il construit les noms à l'exécution : ces lectures ne peuvent pas être vérifiées.
 	Back to Prepare a form	Retour à Préparer un formulaire
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Aucun champ de ce formulaire ne calcule encore sa valeur. Donnez un calcul à un champ dans l'onglet Calculer de ses propriétés, et il apparaîtra ici.
 	{names} and {last}	{names} et {last}
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index e9d627aca9..354b58ee89 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -2721,6 +2721,8 @@ theme	Appearance	स्वरूप
 	Links on page	Links on page
 	Loop	Loop
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
 	Move only what must move, so every field calculates after the fields it reads.	Move only what must move, so every field calculates after the fields it reads.
 	Moves only what must move	Moves only what must move
 	No field reads it	No field reads it
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 6b37b9169b..f64c76d51a 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -512,6 +512,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Ezeket olvassa: {names}, amelyek visszaolvassák. Hurkot semmilyen sorrend nem javít meg: módosítsd az egyik képletet.
 	Not in order	Nincs a sorrendben
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Hiányzik a PDF-ben mentett számítási sorrendből: más PDF-megjelenítők talán nem számítják ki.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Ezt olvassa: {name}, amely nincs az űrlapon, így onnan nem kap értéket.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	A szkriptje olyan mezőket is olvas, amelyek nevét futás közben állítja össze, így ezek az olvasások nem ellenőrizhetők.
 	Back to Prepare a form	Vissza az Űrlap előkészítéséhez
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Ennek az űrlapnak még egyik mezője sem számítja ki az értékét. Adj egy mezőnek számítást a tulajdonságai Számítás lapján, és itt megjelenik.
 	{names} and {last}	{names} és {last}
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 292b336e10..0f62baf71f 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -2722,6 +2722,8 @@ theme	Appearance	Tampilan
 	Links on page	Links on page
 	Loop	Loop
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
 	Move only what must move, so every field calculates after the fields it reads.	Move only what must move, so every field calculates after the fields it reads.
 	Moves only what must move	Moves only what must move
 	No field reads it	No field reads it
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 20729bae6a..8c8208e706 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -538,6 +538,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Legge {names}, che a loro volta lo leggono. Nessun ordine può correggere un ciclo: modifica una delle formule.
 	Not in order	Fuori ordine
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Manca nell'ordine di calcolo salvato nel PDF: altri visualizzatori PDF potrebbero non calcolarlo.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Legge {name}, che non esiste nel modulo, quindi da lì non riceve alcun valore.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Il suo script legge anche campi i cui nomi costruisce durante l'esecuzione, quindi queste letture non possono essere verificate.
 	Back to Prepare a form	Torna a Prepara un modulo
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Nessun campo di questo modulo calcola ancora il proprio valore. Assegna un calcolo a un campo nella scheda Calcolo delle sue proprietà e comparirà qui.
 	{names} and {last}	{names} e {last}
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 1ed4d43b6c..8a19ef110b 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -541,6 +541,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	{names} を読み取り、それらがこのフィールドを読み返します。循環はどの順序でも直せません。いずれかの数式を変更してください。
 	Not in order	順序にない
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	PDF に保存された計算順序にありません。ほかの PDF ビューアーでは計算されない可能性があります。
+	Reads {name}, which the form doesn't have, so it gets no value there.	フォームにない {name} を読み取るため、そこからは値を得られません。
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	スクリプトが実行中に名前を組み立てるフィールドも読み取るため、それらの読み取りは確認できません。
 	Back to Prepare a form	「フォームを作成」に戻る
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	このフォームには値を計算するフィールドがまだありません。フィールドのプロパティの［計算］タブで計算を設定すると、ここに表示されます。
 	{names} and {last}	{names}、{last}
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 9022c3591c..ff5bcd317b 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -501,6 +501,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	{names} өрістерін оқиды, олар оны қайта оқиды. Ешбір рет циклды түзете алмайды: формулалардың бірін өзгертіңіз.
 	Not in order	Ретте жоқ
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	PDF ішінде сақталған есептеу ретінде жоқ: басқа PDF қарау құралдары оны есептемеуі мүмкін.
+	Reads {name}, which the form doesn't have, so it gets no value there.	{name} өрісін оқиды, бірақ ол пішінде жоқ, сондықтан одан мән алмайды.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Оның скрипті атауларын орындалу кезінде құрастыратын өрістерді де оқиды, сондықтан бұл оқуларды тексеру мүмкін емес.
 	Back to Prepare a form	Форманы дайындауға оралу
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Бұл формада мәнін есептейтін өріс әлі жоқ. Өріс сипаттарының «Есептеу» қойындысында оған есептеу беріңіз, сонда ол осында көрсетіледі.
 	{names} and {last}	{names} және {last}
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 09b9cad9fa..139c016b5f 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -2721,6 +2721,8 @@ theme	Appearance	모양
 	Links on page	Links on page
 	Loop	Loop
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
 	Move only what must move, so every field calculates after the fields it reads.	Move only what must move, so every field calculates after the fields it reads.
 	Moves only what must move	Moves only what must move
 	No field reads it	No field reads it
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 43749f4ec8..e19abaf203 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -701,6 +701,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Skaito {names}, kurie savo ruožtu skaito jį. Jokia tvarka neištaisys ciklo: pakeiskite vieną iš formulių.
 	Not in order	Ne tvarkoje
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Trūksta PDF faile įrašytoje skaičiavimo tvarkoje: kitos PDF peržiūros programos gali jo neskaičiuoti.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Skaito {name}, kurio formoje nėra, todėl iš ten negauna jokios reikšmės.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Jo scenarijus taip pat skaito laukus, kurių pavadinimus sudaro vykdymo metu, todėl šių skaitymų patikrinti negalima.
 	Back to Prepare a form	Grįžti į „Rengti formą“
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Nė vienas šios formos laukas dar neskaičiuoja savo reikšmės. Nustatykite laukui skaičiavimą jo savybių kortelėje „Skaičiavimas“, ir jis bus rodomas čia.
 	{names} and {last}	{names} ir {last}
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 963d717584..aa3444289f 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -536,6 +536,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Odczytuje {names}, które z kolei odczytują je. Żadna kolejność nie naprawi pętli: zmień jedną z formuł.
 	Not in order	Poza kolejnością
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Brakuje go w kolejności obliczeń zapisanej w pliku PDF: inne przeglądarki PDF mogą go nie obliczać.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Odczytuje {name}, którego nie ma w formularzu, więc nie dostaje stamtąd żadnej wartości.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Jego skrypt odczytuje też pola, których nazwy tworzy w trakcie działania, więc tych odczytów nie da się sprawdzić.
 	Back to Prepare a form	Wróć do „Przygotuj formularz”
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Żadne pole tego formularza nie oblicza jeszcze swojej wartości. Nadaj polu obliczenie na karcie Obliczenia w jego właściwościach, a pojawi się tutaj.
 	{names} and {last}	{names} i {last}
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index c34ae83bc5..5ca0e2fb60 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -159,6 +159,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Lê {names}, que o leem de volta. Nenhuma ordem resolve um ciclo: altere uma das fórmulas.
 	Not in order	Fora da ordem
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Ausente da ordem de cálculo salva no PDF: outros leitores de PDF podem não calculá-lo.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Lê {name}, que não existe no formulário, então não recebe nenhum valor dali.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Seu script também lê campos cujos nomes monta durante a execução, então essas leituras não podem ser verificadas.
 	Back to Prepare a form	Voltar para Preparar um formulário
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Nenhum campo deste formulário calcula seu valor ainda. Dê um cálculo a um campo na aba Calcular das propriedades dele, e ele aparecerá aqui.
 	{names} and {last}	{names} e {last}
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index 78d2298b93..cf1c74ad4d 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -2723,6 +2723,8 @@ theme	Appearance	Aspect
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Citește {names}, care îl citesc la rândul lor. Nicio ordine nu poate rezolva o buclă: modificați una dintre formule.
 	Not in order	În afara ordinii
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Lipsește din ordinea de calcul salvată în PDF: alte aplicații de vizualizare PDF s-ar putea să nu-l calculeze.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Citește {name}, care nu există în formular, deci nu primește nicio valoare de acolo.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Scriptul său citește și câmpuri ale căror nume le construiește în timpul rulării, deci aceste citiri nu pot fi verificate.
 	Back to Prepare a form	Înapoi la Pregătire formular
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Niciun câmp din acest formular nu își calculează încă valoarea. Adăugați un calcul unui câmp în fila Calcul din proprietățile lui și va apărea aici.
 	{names} and {last}	{names} și {last}
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 274232d586..acfc72a2a0 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -534,6 +534,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Читает {names}, которые в свою очередь читают его. Никакой порядок не исправит цикл: измените одну из формул.
 	Not in order	Вне порядка
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Отсутствует в порядке вычислений, сохранённом в PDF: другие программы просмотра PDF могут его не вычислять.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Читает {name}, которого нет в форме, поэтому не получает оттуда значения.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Его скрипт также читает поля, имена которых составляет во время выполнения, поэтому эти чтения нельзя проверить.
 	Back to Prepare a form	Назад к «Подготовить форму»
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Ни одно поле этой формы пока не вычисляет своё значение. Задайте полю вычисление на вкладке «Вычислить» его свойств, и оно появится здесь.
 	{names} and {last}	{names} и {last}
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 420e6a5996..19ff9c059b 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -1027,6 +1027,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Bere {names}, ki ga berejo nazaj. Noben vrstni red ne popravi zanke: spremenite eno od formul.
 	Not in order	Ni v vrstnem redu
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Manjka v vrstnem redu izračunov, shranjenem v PDF-ju: drugi pregledovalniki PDF ga morda ne izračunajo.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Bere {name}, ki ga v obrazcu ni, zato od tam ne dobi vrednosti.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Njegov skript bere tudi polja, katerih imena sestavi med izvajanjem, zato teh branj ni mogoče preveriti.
 	Back to Prepare a form	Nazaj na Pripravi obrazec
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Nobeno polje tega obrazca še ne izračuna svoje vrednosti. Polju dodelite izračun na zavihku Izračunaj v njegovih lastnostih in prikazalo se bo tukaj.
 	{names} and {last}	{names} in {last}
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index ba7c9dc5b3..ed552c8005 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -2409,6 +2409,8 @@ animation effects	Off	Joaktiv
 	Mark as artifact	Mark as artifact
 	Merge image fragments	Merge image fragments
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
 	Mobile	Mobile
 	Move only what must move, so every field calculates after the fields it reads.	Move only what must move, so every field calculates after the fields it reads.
 	Moves only what must move	Moves only what must move
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 7f339989ee..e058226539 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -518,6 +518,8 @@ comment menu	Edit	సవరించు
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	{names}ను చదువుతుంది, అవి దీన్ని తిరిగి చదువుతాయి. ఏ క్రమమూ లూప్‌ను సరిచేయదు: సూత్రాలలో ఒకదాన్ని మార్చండి.
 	Not in order	క్రమంలో లేదు
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	PDFలో సేవ్ చేసిన గణన క్రమంలో లేదు: ఇతర PDF వీక్షకులు దీన్ని లెక్కించకపోవచ్చు.
+	Reads {name}, which the form doesn't have, so it gets no value there.	{name}ను చదువుతుంది, కానీ అది ఫారమ్‌లో లేదు, కాబట్టి దాని నుండి విలువ రాదు.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	దీని స్క్రిప్ట్ నడుస్తున్నప్పుడు పేర్లను కూర్చే ఫీల్డ్‌లను కూడా చదువుతుంది, కాబట్టి ఆ చదువులను తనిఖీ చేయలేము.
 	Back to Prepare a form	‘ఫారాన్ని సిద్ధం చేయి’కి తిరిగి వెళ్లు
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	ఈ ఫారంలో ఏ ఫీల్డ్ ఇంకా తన విలువను గణించదు. ఫీల్డ్ లక్షణాలలోని గణన ట్యాబ్‌లో దానికి గణన ఇవ్వండి, అది ఇక్కడ కనిపిస్తుంది.
 	{names} and {last}	{names} మరియు {last}
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index a2ecaea179..0be6a69520 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -499,6 +499,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	{names} alanlarını okur, onlar da bu alanı okur. Hiçbir sıra bir döngüyü düzeltemez: formüllerden birini değiştirin.
 	Not in order	Sırada değil
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	PDF'te kayıtlı hesaplama sırasında yok: diğer PDF görüntüleyicileri bunu hesaplamayabilir.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Formda olmayan {name} alanını okur, bu yüzden oradan değer alamaz.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Komut dosyası, adlarını çalışırken oluşturduğu alanları da okur; bu okumalar denetlenemez.
 	Back to Prepare a form	Form hazırla'ya geri dön
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Bu formdaki hiçbir alan henüz değerini hesaplamıyor. Bir alana özelliklerinin Hesapla sekmesinde bir hesaplama verin, burada görünür.
 	{names} and {last}	{names} ve {last}
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 9c76868839..5d45a3f4b6 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -539,6 +539,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Читає {names}, які своєю чергою читають його. Жоден порядок не виправить цикл: змініть одну з формул.
 	Not in order	Поза порядком
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Відсутнє в порядку обчислень, збереженому в PDF: інші переглядачі PDF можуть його не обчислювати.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Читає {name}, якого немає у формі, тому не отримує звідти значення.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Його сценарій також читає поля, імена яких складає під час виконання, тому ці читання неможливо перевірити.
 	Back to Prepare a form	Назад до «Підготувати форму»
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Жодне поле цієї форми поки не обчислює своє значення. Задайте полю обчислення на вкладці «Обчислення» його властивостей, і воно з’явиться тут.
 	{names} and {last}	{names} і {last}
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 973ba870ea..2b51f445a3 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -697,6 +697,8 @@ theme	Appearance	Giao diện
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Đọc {names}, các trường này lại đọc ngược nó. Không thứ tự nào sửa được vòng lặp: hãy đổi một trong các công thức.
 	Not in order	Không có trong thứ tự
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Không có trong thứ tự tính toán lưu trong PDF: các trình xem PDF khác có thể không tính trường này.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Đọc {name}, nhưng biểu mẫu không có trường này, nên không nhận được giá trị nào từ đó.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Tập lệnh của nó còn đọc các trường có tên được tạo ra khi chạy, nên không thể kiểm tra các lần đọc đó.
 	Back to Prepare a form	Quay lại Chuẩn bị biểu mẫu
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Chưa có trường nào trong biểu mẫu này tự tính giá trị. Hãy đặt phép tính cho một trường ở thẻ Tính toán trong thuộc tính của nó, trường đó sẽ hiện ở đây.
 	{names} and {last}	{names} và {last}
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index d77c8f6425..c4aae05c8a 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -208,6 +208,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	读取 {names}，而它们又读取此字段。任何顺序都无法修正循环：请修改其中一个公式。
 	Not in order	不在顺序中
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	PDF 中保存的计算顺序缺少此字段：其他 PDF 查看器可能不会计算它。
+	Reads {name}, which the form doesn't have, so it gets no value there.	读取表单中不存在的 {name}，因此从中得不到值。
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	其脚本还会读取运行时才拼出名称的字段，因此无法检查这些读取。
 	Back to Prepare a form	返回准备表单
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	此表单中还没有计算自身值的字段。在字段属性的“计算”选项卡中为字段设置计算后，它会显示在这里。
 	{names} and {last}	{names}和{last}
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index ce3b939f1d..82d6eb6a5d 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -164,6 +164,8 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	讀取 {names}，而它們又讀取此欄位。任何順序都無法修正迴圈：請修改其中一個公式。
 	Not in order	不在順序中
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	PDF 中儲存的計算順序缺少此欄位：其他 PDF 檢視器可能不會計算它。
+	Reads {name}, which the form doesn't have, so it gets no value there.	讀取表單中不存在的 {name}，因此從中得不到值。
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	其指令碼還會讀取執行時才組出名稱的欄位，因此無法檢查這些讀取。
 	Back to Prepare a form	返回準備表單
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	此表單中還沒有計算自身值的欄位。在欄位內容的「計算」索引標籤中為欄位設定計算後，它會顯示在這裡。
 	{names} and {last}	{names}和{last}
diff --git a/crates/ui-egui/src/tools/calc_order_ui.rs b/crates/ui-egui/src/tools/calc_order_ui.rs
index 2b7a0c5f94..e02983ac5d 100644
--- a/crates/ui-egui/src/tools/calc_order_ui.rs
+++ b/crates/ui-egui/src/tools/calc_order_ui.rs
@@ -475,6 +475,9 @@ fn explained(issues: &[CalculationIssue]) -> String {
     issues
         .iter()
         .map(|i| match i {
+            CalculationIssue::MissingField { field } => {
+                crate::i18n::fmt(tl!("Reads {name}, which the form doesn't have, so it gets no value there."), &[("name", field)])
+            }
             CalculationIssue::RunsTooEarly { field } => {
                 crate::i18n::fmt(tl!("Reads {name}, which calculates later, so it shows an old value."), &[("name", field)])
             }
@@ -485,6 +488,9 @@ fn explained(issues: &[CalculationIssue]) -> String {
             CalculationIssue::NotInOrder => {
                 tl!("Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.").to_owned()
             }
+            CalculationIssue::BuiltNames => {
+                tl!("Its script also reads fields whose names it builds as it runs, so those reads can't be checked.").to_owned()
+            }
         })
         .collect::<Vec<_>>()
         .join("\n")
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 25205e92c1..6e929825ba 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,6 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
+> **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M6: the calculation order flags a formula that reads a field the form doesn't have and a script that builds the names it reads; the tools show each formula; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
 
@@ -255,6 +256,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-23 | minor | M6: calculation checks: a formula reading a field the form doesn't have, and a script building the names it reads, are flagged by `form_calculation_order` and on the Calculation order page; `form_calculation_order` gives each formula and `form_fields` a custom Calculate script. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
 | 2026-10-23 | minor | M8, #3205 follow-up: phone-pattern redaction includes the +39 country code on labelled Italian geographic numbers with a slash; dates, protocol identifiers and whole-run guards remain. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 3b8dba920c..766c439703 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4679,8 +4679,8 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties", "form.calculation_order"]
 tools = ["form_set_props", "form_fill", "form_calculation_order"]
-evidence = ["crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/forms/src/tests.rs::the_calculation_order_is_checked_fixed_and_kept", "crates/forms/src/tests.rs::a_calculation_order_with_gaps_and_extra_entries", "crates/forms/src/tests.rs::two_fields_with_one_name_keep_their_places_in_the_order", "crates/engine/src/tests.rs::setting_the_calculation_order_recalculates_and_undoes", "crates/automation/tests/it/automation.rs::the_calculation_order_is_read_fixed_and_set", "crates/ui-egui/tests/it/prepare.rs::the_calculation_order_is_moved_dragged_and_fixed", "crates/engine/src/tests.rs::checkbox_and_rank_changes_recalculate_ordered_dependents", "crates/engine/src/tests.rs::dynamic_calculation_reads_and_side_effects_reach_later_fields"]
-notes = "/CO order, then other calculated fields; recalculated after every fill and Clear form. Order editing: Prepare a form ▸ Calculation order lists the calculated fields in order with their formulas and values, Up/Down arrows (as Acrobat's Set Field Calculation Order dialog), Alt+Up/Down and drag, says which fields read a field calculated later, which read each other in a loop and which /CO leaves out, and Fix order moves only what must move; on the page it numbers each calculated field's step and draws arrows from the fields the focused field reads and to the fields that read it; form_calculation_order reads, sets, moves and fixes it. A new calculation joins the end of /CO and an edited one keeps its place. Acrobat's dialog is known from Adobe's help summary only, not yet observed."
+evidence = ["crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/forms/src/tests.rs::the_calculation_order_is_checked_fixed_and_kept", "crates/forms/src/tests.rs::a_calculation_order_with_gaps_and_extra_entries", "crates/forms/src/tests.rs::two_fields_with_one_name_keep_their_places_in_the_order", "crates/engine/src/tests.rs::setting_the_calculation_order_recalculates_and_undoes", "crates/automation/tests/it/automation.rs::the_calculation_order_is_read_fixed_and_set", "crates/ui-egui/tests/it/prepare.rs::the_calculation_order_is_moved_dragged_and_fixed", "crates/engine/src/tests.rs::checkbox_and_rank_changes_recalculate_ordered_dependents", "crates/engine/src/tests.rs::dynamic_calculation_reads_and_side_effects_reach_later_fields", "crates/forms/src/tests.rs::missing_fields_and_built_names_are_flagged", "crates/forms/src/calc_order.rs::a_read_name_finds_a_field_a_group_or_a_widget", "crates/forms/src/af/tests.rs::names_built_at_run_time_are_noticed", "crates/automation/tests/it/automation.rs::the_calculation_order_shows_formulas_and_what_they_cannot_read"]
+notes = "/CO order, then other calculated fields; recalculated after every fill and Clear form. Order editing: Prepare a form ▸ Calculation order lists the calculated fields in order with their formulas and values, Up/Down arrows (as Acrobat's Set Field Calculation Order dialog), Alt+Up/Down and drag, says which fields read a field calculated later, which read each other in a loop and which /CO leaves out, and Fix order moves only what must move; on the page it numbers each calculated field's step and draws arrows from the fields the focused field reads and to the fields that read it; form_calculation_order reads, sets, moves and fixes it. Each formula is also checked against the form: a read of a field the form doesn't have (a field deleted from under a sum, a typo in notation, a script's getField) and a script that builds the names it reads at run time are flagged, in form_calculation_order (which also gives each formula) and in the page's row tooltips. A new calculation joins the end of /CO and an edited one keeps its place. Acrobat's dialog is known from Adobe's help summary only, not yet observed."
 
 [[feature]]
 id = "form.event-order"
@@ -5051,8 +5051,8 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties"]
 tools = ["form_set_props", "form_fill"]
-evidence = ["crates/ui-egui/tests/it/prepare.rs::format_validate_and_calculate_tabs", "crates/automation/tests/it/automation.rs::form_formats_and_calculations_through_tools", "crates/forms/src/tests.rs::renaming_a_field_renames_it_in_the_calculations_that_read_it", "crates/forms/src/tests.rs::a_rename_reaches_every_stored_form_of_a_calculation", "crates/automation/tests/it/automation.rs::renaming_a_field_keeps_the_formulas_that_read_it", "crates/ui-egui/tests/it/prepare.rs::renaming_a_field_says_how_many_calculations_now_use_the_new_name", "crates/forms/src/af/tests.rs::a_regex_after_a_condition_is_not_read_as_code", "crates/forms/src/af/tests.rs::a_line_comment_ends_at_any_line_terminator", "crates/forms/src/af/tests.rs::a_token_ends_at_a_line_separator"]
-notes = "sum/product/average/min/max of picked fields, simplified field notation; custom script pending. Renaming a field renames it in the calculations that read it (field lists, notation, and getField calls naming it in a string literal), in the rename's undo step; Field Properties says how many changed and form_set_props lists them. Not rewritten: names built at run time, other events' scripts, document-level scripts. A regular expression that starts a statement right after a `}` is still read as code, so a quote inside one can hide the getField calls after it from a rename and from the calculation order. Whether Acrobat does this is not observed."
+evidence = ["crates/ui-egui/tests/it/prepare.rs::format_validate_and_calculate_tabs", "crates/automation/tests/it/automation.rs::form_formats_and_calculations_through_tools", "crates/forms/src/tests.rs::renaming_a_field_renames_it_in_the_calculations_that_read_it", "crates/forms/src/tests.rs::a_rename_reaches_every_stored_form_of_a_calculation", "crates/automation/tests/it/automation.rs::renaming_a_field_keeps_the_formulas_that_read_it", "crates/ui-egui/tests/it/prepare.rs::renaming_a_field_says_how_many_calculations_now_use_the_new_name", "crates/forms/src/af/tests.rs::a_regex_after_a_condition_is_not_read_as_code", "crates/forms/src/af/tests.rs::a_line_comment_ends_at_any_line_terminator", "crates/forms/src/af/tests.rs::a_token_ends_at_a_line_separator", "crates/automation/tests/it/automation.rs::the_calculation_order_shows_formulas_and_what_they_cannot_read"]
+notes = "sum/product/average/min/max of picked fields, simplified field notation; custom script pending. form_fields shows a custom Calculate script as {script}. Renaming a field renames it in the calculations that read it (field lists, notation, and getField calls naming it in a string literal), in the rename's undo step; Field Properties says how many changed and form_set_props lists them. Not rewritten: names built at run time, other events' scripts, document-level scripts. A regular expression that starts a statement right after a `}` is still read as code, so a quote inside one can hide the getField calls after it from a rename and from the calculation order. Whether Acrobat does this is not observed."
 
 [[feature]]
 id = "form.props-selection-change"

From feefeb8c95fd90bf636a12f07a4ca0ee4c94a64e Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Fri, 23 Oct 2026 19:57:46 +0200
Subject: [PATCH 207/270] M6: Calculation order: a formula that reads a missing
 field is marked, not only explained on hover

The row gets a red step and a "Missing field" caption, as a loop does; a
red card names the formulas and links to the first, in place of the
all-clear; a script that builds names gets a grey "Unchecked reads"
caption and a note; the summary above the page lists a missing field
among the reads and says so, and says when a script names fields as it
runs. The name and formula lines of a row are sized by their own
right-hand text, so a wide caption no longer cuts the name.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 ROADMAP.md                                |   2 +-
 crates/ui-egui/src/i18n/ar.tsv            |   9 ++
 crates/ui-egui/src/i18n/bg.tsv            |   9 ++
 crates/ui-egui/src/i18n/ca.tsv            |   9 ++
 crates/ui-egui/src/i18n/cs.tsv            |   9 ++
 crates/ui-egui/src/i18n/de.tsv            |   9 ++
 crates/ui-egui/src/i18n/el.tsv            |   9 ++
 crates/ui-egui/src/i18n/es.tsv            |   9 ++
 crates/ui-egui/src/i18n/fi.tsv            |   9 ++
 crates/ui-egui/src/i18n/fr.tsv            |   9 ++
 crates/ui-egui/src/i18n/hi.tsv            |   4 +
 crates/ui-egui/src/i18n/hu.tsv            |   9 ++
 crates/ui-egui/src/i18n/id.tsv            |   4 +
 crates/ui-egui/src/i18n/it.tsv            |   9 ++
 crates/ui-egui/src/i18n/ja.tsv            |   9 ++
 crates/ui-egui/src/i18n/kk.tsv            |   9 ++
 crates/ui-egui/src/i18n/ko.tsv            |   4 +
 crates/ui-egui/src/i18n/lt.tsv            |   9 ++
 crates/ui-egui/src/i18n/pl.tsv            |   9 ++
 crates/ui-egui/src/i18n/pt-br.tsv         |   9 ++
 crates/ui-egui/src/i18n/ro.tsv            |   9 ++
 crates/ui-egui/src/i18n/ru.tsv            |   9 ++
 crates/ui-egui/src/i18n/sl.tsv            |   9 ++
 crates/ui-egui/src/i18n/sq.tsv            |   4 +
 crates/ui-egui/src/i18n/te.tsv            |   9 ++
 crates/ui-egui/src/i18n/tr.tsv            |   9 ++
 crates/ui-egui/src/i18n/uk.tsv            |   9 ++
 crates/ui-egui/src/i18n/vi.tsv            |   9 ++
 crates/ui-egui/src/i18n/zh-hans.tsv       |   9 ++
 crates/ui-egui/src/i18n/zh-hant.tsv       |   9 ++
 crates/ui-egui/src/tools/calc_order_ui.rs | 176 ++++++++++++++++++----
 crates/ui-egui/tests/it/prepare.rs        |  35 +++++
 docs/roadmap.md                           |   2 +-
 parity/acrobat-features.toml              |   4 +-
 34 files changed, 426 insertions(+), 34 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 2c86653a4d..795dff2921 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,7 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
-- **2026-10-23 (M6, calculation checks):** The calculation order now flags a formula that reads a field the form doesn't have (a field deleted from under a sum, a typo in notation, a script's `getField`) and a script that builds the names it reads at run time. `form_calculation_order` gives each field's formula, and `form_fields` shows a custom Calculate script.
+- **2026-10-23 (M6, calculation checks):** The calculation order now flags a formula that reads a field the form doesn't have (a field deleted from under a sum, a typo in notation, a script's `getField`) and a script that builds the names it reads at run time. Prepare a form ▸ Calculation order marks both on the row and in a card that names the broken formulas, in place of its all-clear. `form_calculation_order` gives each field's formula, and `form_fields` shows a custom Calculate script.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
 - **2026-10-23 (M7, #2636 partial):** A new `PasteContent` edit pastes an added text box or image copied in the same document or another, keeping its style, picture, turns, flips and crop, as one undo step; `content_copy` drives it headlessly. A paste lands beside earlier copies (18 pt steps) and stays on the page. A pasted image reuses its picture object in its own document and after the first paste into another; there a colour profile is dropped and CMYK colours stored losslessly are turned to RGB. The desktop keys and menus follow in separate PRs. Estimates unchanged.
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 0d429f657c..bc2091e029 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -543,6 +543,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	غير موجود في ترتيب الحساب المحفوظ في ملف PDF: قد لا تحسبه برامج عرض PDF الأخرى.
 	Reads {name}, which the form doesn't have, so it gets no value there.	يقرأ {name}، وهو غير موجود في النموذج، لذا لا يحصل منه على أي قيمة.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	يقرأ سكربته أيضًا حقولًا يبني أسماءها أثناء التشغيل، لذا لا يمكن التحقق من هذه القراءات.
+	Missing field	حقل مفقود
+	Unchecked reads	قراءات غير مفحوصة
+	{field} reads fields named as it runs	يقرأ {field} حقولًا تُسمّى أثناء التشغيل
+	Some names are built as it runs	تُبنى بعض الأسماء أثناء التشغيل
 	Back to Prepare a form	العودة إلى تجهيز نموذج
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	لا يحسب أي حقل في هذا النموذج قيمته بعد. امنح حقلًا عملية حساب في علامة التبويب «الحساب» ضمن خصائصه، وسيظهر هنا.
 	{names} and {last}	{names} و{last}
@@ -2428,6 +2432,11 @@ animation effects	Off	معطّلة
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} يُحسب قبل {fields}، التي يقرؤها.|{field} يُحسب قبل {fields}، الذي يقرؤه.|{field} يُحسب قبل {fields}، اللذين يقرؤهما.|{field} يُحسب قبل {fields}، التي يقرؤها.|{field} يُحسب قبل {fields}، التي يقرؤها.|{field} يُحسب قبل {fields}، التي يقرؤها.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	{n} من الحقول الأخرى تُحسب مبكرًا جدًا.|حقل آخر ({n}) يُحسب مبكرًا جدًا.|حقلان آخران ({n}) يُحسبان مبكرًا جدًا.|{n} حقول أخرى تُحسب مبكرًا جدًا.|{n} حقلًا آخر يُحسب مبكرًا جدًا.|{n} من الحقول الأخرى تُحسب مبكرًا جدًا.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} غير موجودة في الترتيب المحفوظ في PDF، لذا قد لا تحسبها عارضات PDF الأخرى.|{fields} غير موجود في الترتيب المحفوظ في PDF، لذا قد لا تحسبه عارضات PDF الأخرى.|{fields} غير موجودين في الترتيب المحفوظ في PDF، لذا قد لا تحسبهما عارضات PDF الأخرى.|{fields} غير موجودة في الترتيب المحفوظ في PDF، لذا قد لا تحسبها عارضات PDF الأخرى.|{fields} غير موجودة في الترتيب المحفوظ في PDF، لذا قد لا تحسبها عارضات PDF الأخرى.|{fields} غير موجودة في الترتيب المحفوظ في PDF، لذا قد لا تحسبها عارضات PDF الأخرى.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} من الصيغ تقرأ حقولًا غير موجودة في النموذج|صيغة واحدة ({n}) تقرأ حقلًا غير موجود في النموذج|صيغتان ({n}) تقرآن حقولًا غير موجودة في النموذج|{n} صيغ تقرأ حقولًا غير موجودة في النموذج|{n} صيغة تقرأ حقولًا غير موجودة في النموذج|{n} من الصيغ تقرأ حقولًا غير موجودة في النموذج
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	يقرأ {field} الحقول {fields}، وهي غير موجودة في النموذج.|يقرأ {field} الحقل {fields}، وهو غير موجود في النموذج.|يقرأ {field} الحقلين {fields}، وهما غير موجودين في النموذج.|يقرأ {field} الحقول {fields}، وهي غير موجودة في النموذج.|يقرأ {field} الحقول {fields}، وهي غير موجودة في النموذج.|يقرأ {field} الحقول {fields}، وهي غير موجودة في النموذج.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} من الصيغ الأخرى تقرأ حقولًا مفقودة.|صيغة أخرى ({n}) تقرأ حقلًا مفقودًا.|صيغتان أخريان ({n}) تقرآن حقولًا مفقودة.|{n} صيغ أخرى تقرأ حقولًا مفقودة.|{n} صيغة أخرى تقرأ حقولًا مفقودة.|{n} من الصيغ الأخرى تقرأ حقولًا مفقودة.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	يبني {fields} بعض أسماء الحقول أثناء التشغيل، لذا لا يتم التحقق من هذه القراءات.|يبني {fields} بعض أسماء الحقول أثناء التشغيل، لذا لا يتم التحقق من هذه القراءات.|يبني {fields} بعض أسماء الحقول أثناء التشغيل، لذا لا يتم التحقق من هذه القراءات.|يبني {fields} بعض أسماء الحقول أثناء التشغيل، لذا لا يتم التحقق من هذه القراءات.|يبني {fields} بعض أسماء الحقول أثناء التشغيل، لذا لا يتم التحقق من هذه القراءات.|يبني {fields} بعض أسماء الحقول أثناء التشغيل، لذا لا يتم التحقق من هذه القراءات.
+@plural	{fields} is missing|{fields} are missing	{fields} مفقودة|{fields} مفقود|{fields} مفقودان|{fields} مفقودة|{fields} مفقودة|{fields} مفقودة
 	Scan	مسح ضوئي
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	وقّع على ورقة بيضاء والتقط لها صورة في إضاءة ساطعة ومتساوية (استخدم الفلاش). اختر الصورة أو أفلتها هنا: يعثر PdfCraft على التوقيع ويزيل الورق.
 	Choose photo…	اختيار صورة…
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 2ef342e51b..a41f559a4f 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -204,6 +204,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Липсва в реда на изчисляване, записан в PDF файла: други програми за PDF може да не го изчисляват.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Чете {name}, което го няма във формуляра, затова не получава стойност оттам.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Скриптът му чете и полета, чиито имена съставя по време на изпълнение, затова тези четения не могат да бъдат проверени.
+	Missing field	Липсващо поле
+	Unchecked reads	Непроверени четения
+	{field} reads fields named as it runs	{field} чете полета, именувани по време на изпълнение
+	Some names are built as it runs	Някои имена се съставят по време на изпълнение
 	Back to Prepare a form	Назад към „Подготви формуляр“
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Все още нито едно поле в този формуляр не изчислява стойността си. Задайте изчисление на поле в раздела „Изчисляване“ на свойствата му и то ще се покаже тук.
 	{names} and {last}	{names} и {last}
@@ -2370,6 +2374,11 @@ animation effects	Off	Изключени
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} се изчислява преди {fields}, което чете.|{field} се изчислява преди {fields}, които чете.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	Още {n} поле се изчислява твърде рано.|Още {n} полета се изчисляват твърде рано.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} липсва в реда, запазен в PDF файла, затова други програми за PDF може да не го изчислят.|{fields} липсват в реда, запазен в PDF файла, затова други програми за PDF може да не ги изчислят.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} формула чете поле, което го няма във формуляра|{n} формули четат полета, които ги няма във формуляра
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} чете {fields}, което го няма във формуляра.|{field} чете {fields}, които ги няма във формуляра.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	Още {n} формула чете липсващо поле.|Още {n} формули четат липсващи полета.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} съставя някои имена на полета по време на изпълнение, затова тези четения не се проверяват.|{fields} съставят някои имена на полета по време на изпълнение, затова тези четения не се проверяват.
+@plural	{fields} is missing|{fields} are missing	{fields} липсва|{fields} липсват
 	Scan	Сканиране
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Подпишете се на лист бяла хартия и го снимайте на ярка, равномерна светлина (със светкавица). Изберете снимката или я пуснете тук: PdfCraft открива подписа и премахва хартията.
 	Choose photo…	Избор на снимка…
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index dda1208dad..2492fbdf96 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -2722,6 +2722,10 @@ theme	Appearance	Aspecte
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
+	Missing field	Missing field
+	Unchecked reads	Unchecked reads
+	{field} reads fields named as it runs	{field} reads fields named as it runs
+	Some names are built as it runs	Some names are built as it runs
 	Back to Prepare a form	Back to Prepare a form
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.
 	{names} and {last}	{names} and {last}
@@ -2750,6 +2754,11 @@ theme	Appearance	Aspecte
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	{n} more field calculates too early.|{n} more fields calculate too early.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} more formula reads a missing field.|{n} more formulas read missing fields.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.
+@plural	{fields} is missing|{fields} are missing	{fields} is missing|{fields} are missing
 	You are viewing the signed version of “{from}” (revision {rev}). It is a snapshot: changes here won't affect the original.	You are viewing the signed version of “{from}” (revision {rev}). It is a snapshot: changes here won't affect the original.
 	You are viewing revision {rev} of “{from}”. It is a snapshot: changes here won't affect the original.	You are viewing revision {rev} of “{from}”. It is a snapshot: changes here won't affect the original.
 	Bulleted list	Bulleted list
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 3c38493305..9bce9d152e 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -627,6 +627,10 @@ key	Space	Mezerník
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Chybí v pořadí výpočtů uloženém v PDF: jiné prohlížeče PDF ho možná nepočítají.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Čte {name}, které formulář nemá, takže odtud nedostane žádnou hodnotu.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Jeho skript čte i pole, jejichž názvy sestavuje za běhu, takže tato čtení nelze zkontrolovat.
+	Missing field	Chybí pole
+	Unchecked reads	Neověřená čtení
+	{field} reads fields named as it runs	{field} čte pole pojmenovaná za běhu
+	Some names are built as it runs	Některé názvy se sestavují za běhu
 	Back to Prepare a form	Zpět na Připravit formulář
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Žádné pole tohoto formuláře zatím nepočítá svou hodnotu. Zadejte poli výpočet na kartě Výpočet v jeho vlastnostech a zobrazí se zde.
 	{names} and {last}	{names} a {last}
@@ -2481,6 +2485,11 @@ animation effects	Off	Vypnuto
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} se počítá před {fields}, které čte.|{field} se počítá před {fields}, která čte.|{field} se počítá před {fields}, která čte.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	Ještě {n} pole se počítá příliš brzy.|Ještě {n} pole se počítají příliš brzy.|Ještě {n} polí se počítá příliš brzy.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} chybí v pořadí uloženém v PDF, takže ho jiné prohlížeče PDF nemusí vypočítat.|{fields} chybí v pořadí uloženém v PDF, takže je jiné prohlížeče PDF nemusí vypočítat.|{fields} chybí v pořadí uloženém v PDF, takže je jiné prohlížeče PDF nemusí vypočítat.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} vzorec čte pole, které formulář nemá|{n} vzorce čtou pole, která formulář nemá|{n} vzorců čte pole, která formulář nemá
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} čte {fields}, které formulář nemá.|{field} čte {fields}, která formulář nemá.|{field} čte {fields}, která formulář nemá.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	Ještě {n} vzorec čte chybějící pole.|Ještě {n} vzorce čtou chybějící pole.|Ještě {n} vzorců čte chybějící pole.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} sestavuje některé názvy polí za běhu, takže tato čtení nejsou ověřena.|{fields} sestavují některé názvy polí za běhu, takže tato čtení nejsou ověřena.|{fields} sestavují některé názvy polí za běhu, takže tato čtení nejsou ověřena.
+@plural	{fields} is missing|{fields} are missing	{fields} chybí|{fields} chybí|{fields} chybí
 	Scan	Skenovat
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Podepište se na bílý list papíru a vyfoťte ho při jasném, rovnoměrném světle (použijte blesk). Vyberte fotografii nebo ji sem přetáhněte: PdfCraft najde podpis a odstraní papír.
 	Choose photo…	Vybrat fotografii…
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 8d605a024b..b65e5870f7 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -516,6 +516,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Fehlt in der im PDF gespeicherten Berechnungsreihenfolge: Andere PDF-Viewer berechnen es womöglich nicht.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Liest {name}, das es im Formular nicht gibt, und erhält dort deshalb keinen Wert.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Sein Skript liest auch Felder, deren Namen es erst beim Ausführen bildet. Diese Lesezugriffe lassen sich nicht prüfen.
+	Missing field	Feld fehlt
+	Unchecked reads	Ungeprüfte Lesezugriffe
+	{field} reads fields named as it runs	{field} liest Felder, deren Namen erst beim Ausführen entstehen
+	Some names are built as it runs	Manche Namen entstehen erst beim Ausführen
 	Back to Prepare a form	Zurück zu „Formular vorbereiten“
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Noch berechnet kein Feld dieses Formulars seinen Wert. Gib einem Feld auf dem Tab „Berechnen“ seiner Eigenschaften eine Berechnung, dann erscheint es hier.
 	{names} and {last}	{names} und {last}
@@ -2408,6 +2412,11 @@ animation effects	Off	Aus
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} wird vor {fields} berechnet, das es liest.|{field} wird vor {fields} berechnet, die es liest.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	{n} weiteres Feld wird zu früh berechnet.|{n} weitere Felder werden zu früh berechnet.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} fehlt in der im PDF gespeicherten Reihenfolge, daher berechnen andere PDF-Viewer es womöglich nicht.|{fields} fehlen in der im PDF gespeicherten Reihenfolge, daher berechnen andere PDF-Viewer sie womöglich nicht.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} Formel liest ein Feld, das es im Formular nicht gibt|{n} Formeln lesen Felder, die es im Formular nicht gibt
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} liest {fields}, das es im Formular nicht gibt.|{field} liest {fields}, die es im Formular nicht gibt.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} weitere Formel liest ein fehlendes Feld.|{n} weitere Formeln lesen fehlende Felder.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} bildet manche Feldnamen erst beim Ausführen, daher werden diese Lesezugriffe nicht geprüft.|{fields} bilden manche Feldnamen erst beim Ausführen, daher werden diese Lesezugriffe nicht geprüft.
+@plural	{fields} is missing|{fields} are missing	{fields} fehlt|{fields} fehlen
 	Scan	Scannen
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Unterschreiben Sie auf einem weißen Blatt Papier und fotografieren Sie es bei hellem, gleichmäßigem Licht (mit Blitz). Wählen Sie das Foto aus oder ziehen Sie es hierher: PdfCraft findet die Unterschrift und entfernt das Papier.
 	Choose photo…	Foto auswählen…
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 3efb631ae1..b292363bf5 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -1854,6 +1854,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Λείπει από τη σειρά υπολογισμού που είναι αποθηκευμένη στο PDF: άλλα προγράμματα προβολής PDF ίσως δεν το υπολογίζουν.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Διαβάζει το {name}, που δεν υπάρχει στη φόρμα, οπότε δεν παίρνει τιμή από εκεί.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Η δέσμη ενεργειών του διαβάζει επίσης πεδία των οποίων τα ονόματα σχηματίζει κατά την εκτέλεση, οπότε αυτές οι αναγνώσεις δεν μπορούν να ελεγχθούν.
+	Missing field	Λείπει πεδίο
+	Unchecked reads	Μη ελεγμένες αναγνώσεις
+	{field} reads fields named as it runs	Το {field} διαβάζει πεδία που ονομάζονται κατά την εκτέλεση
+	Some names are built as it runs	Ορισμένα ονόματα σχηματίζονται κατά την εκτέλεση
 	Back to Prepare a form	Επιστροφή στην Προετοιμασία φόρμας
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Κανένα πεδίο αυτής της φόρμας δεν υπολογίζει ακόμη την τιμή του. Δώστε σε ένα πεδίο υπολογισμό στην καρτέλα Υπολογισμός των ιδιοτήτων του και θα εμφανιστεί εδώ.
 	{names} and {last}	{names} και {last}
@@ -2404,6 +2408,11 @@ animation effects	Off	Ανενεργά
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} υπολογίζεται πριν από {fields}, που διαβάζει.|{field} υπολογίζεται πριν από {fields}, που διαβάζει.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	Ακόμη {n} πεδίο υπολογίζεται πολύ νωρίς.|Ακόμη {n} πεδία υπολογίζονται πολύ νωρίς.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} λείπει από τη σειρά που είναι αποθηκευμένη στο PDF, οπότε άλλα προγράμματα PDF ίσως δεν το υπολογίσουν.|{fields} λείπουν από τη σειρά που είναι αποθηκευμένη στο PDF, οπότε άλλα προγράμματα PDF ίσως δεν τα υπολογίσουν.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} τύπος διαβάζει πεδίο που δεν υπάρχει στη φόρμα|{n} τύποι διαβάζουν πεδία που δεν υπάρχουν στη φόρμα
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	Το {field} διαβάζει το {fields}, που δεν υπάρχει στη φόρμα.|Το {field} διαβάζει τα {fields}, που δεν υπάρχουν στη φόρμα.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	Ακόμη {n} τύπος διαβάζει πεδίο που λείπει.|Ακόμη {n} τύποι διαβάζουν πεδία που λείπουν.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	Το {fields} σχηματίζει ορισμένα ονόματα πεδίων κατά την εκτέλεση, οπότε αυτές οι αναγνώσεις δεν ελέγχονται.|Τα {fields} σχηματίζουν ορισμένα ονόματα πεδίων κατά την εκτέλεση, οπότε αυτές οι αναγνώσεις δεν ελέγχονται.
+@plural	{fields} is missing|{fields} are missing	Το {fields} λείπει|Τα {fields} λείπουν
 @plural	{n} field name collides with earlier files and will be renamed: {list}|{n} field names collide with earlier files and will be renamed: {list}	{n} όνομα πεδίου συγκρούεται με προηγούμενα αρχεία και θα μετονομαστεί: {list}|{n} ονόματα πεδίων συγκρούονται με προηγούμενα αρχεία και θα μετονομαστούν: {list}
 	Scan	Σάρωση
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Υπογράψτε σε ένα λευκό φύλλο χαρτιού και φωτογραφίστε το σε έντονο, ομοιόμορφο φως (χρησιμοποιήστε το φλας). Επιλέξτε τη φωτογραφία ή αφήστε την εδώ: το PdfCraft βρίσκει την υπογραφή και αφαιρεί το χαρτί.
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index fb17254189..a39fe15a18 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -539,6 +539,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Falta en el orden de cálculo guardado en el PDF: otros visores de PDF podrían no calcularlo.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Lee {name}, que no existe en el formulario, así que no obtiene ningún valor de ahí.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Su script también lee campos cuyos nombres construye mientras se ejecuta, así que esas lecturas no se pueden comprobar.
+	Missing field	Falta un campo
+	Unchecked reads	Lecturas sin comprobar
+	{field} reads fields named as it runs	{field} lee campos nombrados mientras se ejecuta
+	Some names are built as it runs	Algunos nombres se construyen al ejecutarse
 	Back to Prepare a form	Volver a Preparar un formulario
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Ningún campo de este formulario calcula todavía su valor. Dale a un campo un cálculo en la pestaña Calcular de sus propiedades y aparecerá aquí.
 	{names} and {last}	{names} y {last}
@@ -2543,6 +2547,11 @@ animation effects	Off	Desactivados
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} se calcula antes que {fields}, que lee.|{field} se calcula antes que {fields}, que lee.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	{n} campo más se calcula demasiado pronto.|{n} campos más se calculan demasiado pronto.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} falta en el orden guardado en el PDF, así que otros visores de PDF podrían no calcularlo.|{fields} faltan en el orden guardado en el PDF, así que otros visores de PDF podrían no calcularlos.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} fórmula lee un campo que no existe en el formulario|{n} fórmulas leen campos que no existen en el formulario
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} lee {fields}, que no existe en el formulario.|{field} lee {fields}, que no existen en el formulario.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} fórmula más lee un campo que falta.|{n} fórmulas más leen campos que faltan.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} construye algunos nombres de campo al ejecutarse, así que esas lecturas no se comprueban.|{fields} construyen algunos nombres de campo al ejecutarse, así que esas lecturas no se comprueban.
+@plural	{fields} is missing|{fields} are missing	Falta {fields}|Faltan {fields}
 	Scan	Escanear
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Firma en una hoja de papel blanco y hazle una foto con luz intensa y uniforme (usa el flash). Elige la foto o suéltala aquí: PdfCraft encuentra la firma y elimina el papel.
 	Choose photo…	Elegir foto…
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index f35cb08d5a..1d4e6c7d79 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -2786,6 +2786,15 @@ theme	Appearance	Teema
 # Untranslated: English text until a translator fills these in.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
+	Missing field	Missing field
+	Unchecked reads	Unchecked reads
+	{field} reads fields named as it runs	{field} reads fields named as it runs
+	Some names are built as it runs	Some names are built as it runs
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} more formula reads a missing field.|{n} more formulas read missing fields.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.
+@plural	{fields} is missing|{fields} are missing	{fields} is missing|{fields} are missing
 
 # Prepare a form ▸ Text field table (AI-assisted, not separately native-reviewed)
 	Add text field table	Lisää tekstikenttätaulukko
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index e83249e394..34c8ce8d2a 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -516,6 +516,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Absent de l'ordre de calcul enregistré dans le PDF : d'autres lecteurs PDF risquent de ne pas le calculer.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Lit {name}, qui n'existe pas dans le formulaire : aucune valeur n'en provient.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Son script lit aussi des champs dont il construit les noms à l'exécution : ces lectures ne peuvent pas être vérifiées.
+	Missing field	Champ manquant
+	Unchecked reads	Lectures non vérifiées
+	{field} reads fields named as it runs	{field} lit des champs nommés à l'exécution
+	Some names are built as it runs	Certains noms sont construits à l'exécution
 	Back to Prepare a form	Retour à Préparer un formulaire
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Aucun champ de ce formulaire ne calcule encore sa valeur. Donnez un calcul à un champ dans l'onglet Calculer de ses propriétés, et il apparaîtra ici.
 	{names} and {last}	{names} et {last}
@@ -2407,6 +2411,11 @@ animation effects	Off	Désactivés
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} est calculé avant {fields}, qu'il lit.|{field} est calculé avant {fields}, qu'il lit.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	{n} autre champ est calculé trop tôt.|{n} autres champs sont calculés trop tôt.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} manque dans l'ordre enregistré dans le PDF, donc d'autres lecteurs PDF risquent de ne pas le calculer.|{fields} manquent dans l'ordre enregistré dans le PDF, donc d'autres lecteurs PDF risquent de ne pas les calculer.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} formule lit un champ absent du formulaire|{n} formules lisent des champs absents du formulaire
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} lit {fields}, absent du formulaire.|{field} lit {fields}, absents du formulaire.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} autre formule lit un champ manquant.|{n} autres formules lisent des champs manquants.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} construit certains noms de champs à l'exécution : ces lectures ne sont pas vérifiées.|{fields} construisent certains noms de champs à l'exécution : ces lectures ne sont pas vérifiées.
+@plural	{fields} is missing|{fields} are missing	{fields} est absent|{fields} sont absents
 	Scan	Numériser
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Signez une feuille de papier blanc et prenez-la en photo sous une lumière vive et uniforme (utilisez le flash). Choisissez la photo ou déposez-la ici : PdfCraft trouve la signature et retire le papier.
 	Choose photo…	Choisir une photo…
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index 354b58ee89..d11767a516 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -2723,6 +2723,10 @@ theme	Appearance	स्वरूप
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
+	Missing field	Missing field
+	Unchecked reads	Unchecked reads
+	{field} reads fields named as it runs	{field} reads fields named as it runs
+	Some names are built as it runs	Some names are built as it runs
 	Move only what must move, so every field calculates after the fields it reads.	Move only what must move, so every field calculates after the fields it reads.
 	Moves only what must move	Moves only what must move
 	No field reads it	No field reads it
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index f64c76d51a..dc08ffae08 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -514,6 +514,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Hiányzik a PDF-ben mentett számítási sorrendből: más PDF-megjelenítők talán nem számítják ki.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Ezt olvassa: {name}, amely nincs az űrlapon, így onnan nem kap értéket.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	A szkriptje olyan mezőket is olvas, amelyek nevét futás közben állítja össze, így ezek az olvasások nem ellenőrizhetők.
+	Missing field	Hiányzó mező
+	Unchecked reads	Ellenőrizetlen olvasások
+	{field} reads fields named as it runs	{field} futás közben elnevezett mezőket olvas
+	Some names are built as it runs	Néhány név futás közben áll össze
 	Back to Prepare a form	Vissza az Űrlap előkészítéséhez
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Ennek az űrlapnak még egyik mezője sem számítja ki az értékét. Adj egy mezőnek számítást a tulajdonságai Számítás lapján, és itt megjelenik.
 	{names} and {last}	{names} és {last}
@@ -2406,6 +2410,11 @@ animation effects	Off	Ki
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} előbb számítódik, mint {fields}, amelyet olvas.|{field} előbb számítódik, mint {fields}, amelyeket olvas.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	További {n} mező túl korán számítódik.|További {n} mező túl korán számítódik.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} hiányzik a PDF-ben mentett sorrendből, ezért más PDF-megjelenítők esetleg nem számítják ki.|{fields} hiányoznak a PDF-ben mentett sorrendből, ezért más PDF-megjelenítők esetleg nem számítják ki őket.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} képlet olyan mezőt olvas, amely nincs az űrlapon|{n} képlet olyan mezőket olvas, amelyek nincsenek az űrlapon
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} ezt olvassa: {fields}, amely nincs az űrlapon.|{field} ezeket olvassa: {fields}, amelyek nincsenek az űrlapon.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	További {n} képlet hiányzó mezőt olvas.|További {n} képlet hiányzó mezőket olvas.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} futás közben állít össze néhány mezőnevet, így ezek az olvasások nincsenek ellenőrizve.|{fields} futás közben állítanak össze néhány mezőnevet, így ezek az olvasások nincsenek ellenőrizve.
+@plural	{fields} is missing|{fields} are missing	{fields} hiányzik|{fields} hiányoznak
 	Scan	Beolvasás
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Írja alá a nevét egy fehér papírlapon, és fényképezze le erős, egyenletes fényben (vakuval). Válassza ki a fényképet, vagy húzza ide: a PdfCraft megkeresi az aláírást, és eltávolítja a papírt.
 	Choose photo…	Fénykép kiválasztása…
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 0f62baf71f..568450aaa4 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -2724,6 +2724,10 @@ theme	Appearance	Tampilan
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
+	Missing field	Missing field
+	Unchecked reads	Unchecked reads
+	{field} reads fields named as it runs	{field} reads fields named as it runs
+	Some names are built as it runs	Some names are built as it runs
 	Move only what must move, so every field calculates after the fields it reads.	Move only what must move, so every field calculates after the fields it reads.
 	Moves only what must move	Moves only what must move
 	No field reads it	No field reads it
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 8c8208e706..cc6651c482 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -540,6 +540,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Manca nell'ordine di calcolo salvato nel PDF: altri visualizzatori PDF potrebbero non calcolarlo.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Legge {name}, che non esiste nel modulo, quindi da lì non riceve alcun valore.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Il suo script legge anche campi i cui nomi costruisce durante l'esecuzione, quindi queste letture non possono essere verificate.
+	Missing field	Campo mancante
+	Unchecked reads	Letture non verificate
+	{field} reads fields named as it runs	{field} legge campi nominati durante l'esecuzione
+	Some names are built as it runs	Alcuni nomi vengono costruiti durante l'esecuzione
 	Back to Prepare a form	Torna a Prepara un modulo
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Nessun campo di questo modulo calcola ancora il proprio valore. Assegna un calcolo a un campo nella scheda Calcolo delle sue proprietà e comparirà qui.
 	{names} and {last}	{names} e {last}
@@ -2416,6 +2420,11 @@ animation effects	Off	Disattivati
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} viene calcolato prima di {fields}, che legge.|{field} viene calcolato prima di {fields}, che legge.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	Ancora {n} campo viene calcolato troppo presto.|Altri {n} campi vengono calcolati troppo presto.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} manca nell'ordine salvato nel PDF, quindi altri visualizzatori PDF potrebbero non calcolarlo.|{fields} mancano nell'ordine salvato nel PDF, quindi altri visualizzatori PDF potrebbero non calcolarli.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} formula legge un campo che non esiste nel modulo|{n} formule leggono campi che non esistono nel modulo
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} legge {fields}, che non esiste nel modulo.|{field} legge {fields}, che non esistono nel modulo.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	Ancora {n} formula legge un campo mancante.|Altre {n} formule leggono campi mancanti.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} costruisce alcuni nomi di campo durante l'esecuzione, quindi queste letture non vengono verificate.|{fields} costruiscono alcuni nomi di campo durante l'esecuzione, quindi queste letture non vengono verificate.
+@plural	{fields} is missing|{fields} are missing	{fields} manca|{fields} mancano
 	Scan	Scansiona
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Firma un foglio di carta bianca e fotografalo con una luce intensa e uniforme (usa il flash). Scegli la foto o trascinala qui: PdfCraft trova la firma e rimuove la carta.
 	Choose photo…	Scegli foto…
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 8a19ef110b..e135e5e1d2 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -543,6 +543,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	PDF に保存された計算順序にありません。ほかの PDF ビューアーでは計算されない可能性があります。
 	Reads {name}, which the form doesn't have, so it gets no value there.	フォームにない {name} を読み取るため、そこからは値を得られません。
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	スクリプトが実行中に名前を組み立てるフィールドも読み取るため、それらの読み取りは確認できません。
+	Missing field	フィールドがない
+	Unchecked reads	未確認の読み取り
+	{field} reads fields named as it runs	{field} は実行中に名前が決まるフィールドを読み取ります
+	Some names are built as it runs	一部の名前は実行中に組み立てられます
 	Back to Prepare a form	「フォームを作成」に戻る
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	このフォームには値を計算するフィールドがまだありません。フィールドのプロパティの［計算］タブで計算を設定すると、ここに表示されます。
 	{names} and {last}	{names}、{last}
@@ -2407,6 +2411,11 @@ animation effects	Off	オフ
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} は、読み取る {fields} より先に計算されます。
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	さらに {n} 個のフィールドが早すぎます。
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} は PDF に保存された順序にないため、他の PDF ビューアーでは計算されない場合があります。
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} 個の数式がフォームにないフィールドを読み取ります
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} はフォームにない {fields} を読み取ります。
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	ほかに {n} 個の数式が存在しないフィールドを読み取ります。
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} は一部のフィールド名を実行中に組み立てるため、それらの読み取りは確認されません。
+@plural	{fields} is missing|{fields} are missing	{fields} がありません
 	Scan	スキャン
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	白い紙に署名し、明るく均一な光の下で写真を撮ってください（フラッシュを使用）。写真を選択するか、ここにドロップしてください。PdfCraft が署名を見つけ、紙の部分を取り除きます。
 	Choose photo…	写真を選択…
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index ff5bcd317b..6fd9157694 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -503,6 +503,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	PDF ішінде сақталған есептеу ретінде жоқ: басқа PDF қарау құралдары оны есептемеуі мүмкін.
 	Reads {name}, which the form doesn't have, so it gets no value there.	{name} өрісін оқиды, бірақ ол пішінде жоқ, сондықтан одан мән алмайды.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Оның скрипті атауларын орындалу кезінде құрастыратын өрістерді де оқиды, сондықтан бұл оқуларды тексеру мүмкін емес.
+	Missing field	Өріс жоқ
+	Unchecked reads	Тексерілмеген оқулар
+	{field} reads fields named as it runs	{field} орындалу кезінде аталатын өрістерді оқиды
+	Some names are built as it runs	Кейбір атаулар орындалу кезінде құрастырылады
 	Back to Prepare a form	Форманы дайындауға оралу
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Бұл формада мәнін есептейтін өріс әлі жоқ. Өріс сипаттарының «Есептеу» қойындысында оған есептеу беріңіз, сонда ол осында көрсетіледі.
 	{names} and {last}	{names} және {last}
@@ -2394,6 +2398,11 @@ animation effects	Off	Өшірулі
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} өзі оқитын {fields} өрісінен бұрын есептеледі.|{field} өзі оқитын {fields} өрістерінен бұрын есептеледі.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	Тағы {n} өріс тым ерте есептеледі.|Тағы {n} өріс тым ерте есептеледі.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} PDF-те сақталған ретте жоқ, сондықтан басқа PDF қаралымдары оны есептемеуі мүмкін.|{fields} PDF-те сақталған ретте жоқ, сондықтан басқа PDF қаралымдары оларды есептемеуі мүмкін.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} формула пішінде жоқ өрісті оқиды|{n} формула пішінде жоқ өрістерді оқиды
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} пішінде жоқ {fields} өрісін оқиды.|{field} пішінде жоқ {fields} өрістерін оқиды.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	Тағы {n} формула жоқ өрісті оқиды.|Тағы {n} формула жоқ өрістерді оқиды.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} кейбір өріс атауларын орындалу кезінде құрастырады, сондықтан бұл оқулар тексерілмейді.|{fields} кейбір өріс атауларын орындалу кезінде құрастырады, сондықтан бұл оқулар тексерілмейді.
+@plural	{fields} is missing|{fields} are missing	{fields} жоқ|{fields} жоқ
 @plural	{n} field name collides with earlier files and will be renamed: {list}|{n} field names collide with earlier files and will be renamed: {list}	{n} өріс атауы алдыңғы файлдармен қайшы келеді және қайта аталады: {list}|{n} өріс атауы алдыңғы файлдармен қайшы келеді және қайта аталады: {list}
 	Scan	Сканерлеу
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Ақ қағаз парағына қол қойып, оны жарық әрі біркелкі жарықта суретке түсіріңіз (жарқылды қосыңыз). Суретті таңдаңыз немесе осында тастаңыз: PdfCraft қолтаңбаны тауып, қағазды алып тастайды.
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 139c016b5f..742cf4b3cf 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -2723,6 +2723,10 @@ theme	Appearance	모양
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
+	Missing field	Missing field
+	Unchecked reads	Unchecked reads
+	{field} reads fields named as it runs	{field} reads fields named as it runs
+	Some names are built as it runs	Some names are built as it runs
 	Move only what must move, so every field calculates after the fields it reads.	Move only what must move, so every field calculates after the fields it reads.
 	Moves only what must move	Moves only what must move
 	No field reads it	No field reads it
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index e19abaf203..57a83db826 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -703,6 +703,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Trūksta PDF faile įrašytoje skaičiavimo tvarkoje: kitos PDF peržiūros programos gali jo neskaičiuoti.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Skaito {name}, kurio formoje nėra, todėl iš ten negauna jokios reikšmės.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Jo scenarijus taip pat skaito laukus, kurių pavadinimus sudaro vykdymo metu, todėl šių skaitymų patikrinti negalima.
+	Missing field	Trūksta lauko
+	Unchecked reads	Nepatikrinti skaitymai
+	{field} reads fields named as it runs	{field} skaito laukus, pavadinamus vykdymo metu
+	Some names are built as it runs	Kai kurie pavadinimai sudaromi vykdymo metu
 	Back to Prepare a form	Grįžti į „Rengti formą“
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Nė vienas šios formos laukas dar neskaičiuoja savo reikšmės. Nustatykite laukui skaičiavimą jo savybių kortelėje „Skaičiavimas“, ir jis bus rodomas čia.
 	{names} and {last}	{names} ir {last}
@@ -2670,6 +2674,11 @@ certificate	SHA-256 digest	SHA-256 santrauka
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} apskaičiuojamas anksčiau už {fields}, kurį skaito.|{field} apskaičiuojamas anksčiau už {fields}, kuriuos skaito.|{field} apskaičiuojamas anksčiau už {fields}, kuriuos skaito.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	Dar {n} laukas apskaičiuojamas per anksti.|Dar {n} laukai apskaičiuojami per anksti.|Dar {n} laukų apskaičiuojama per anksti.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} nėra PDF faile įrašytoje tvarkoje, todėl kitos PDF peržiūros programos gali jo neapskaičiuoti.|{fields} nėra PDF faile įrašytoje tvarkoje, todėl kitos PDF peržiūros programos gali jų neapskaičiuoti.|{fields} nėra PDF faile įrašytoje tvarkoje, todėl kitos PDF peržiūros programos gali jų neapskaičiuoti.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} formulė skaito lauką, kurio formoje nėra|{n} formulės skaito laukus, kurių formoje nėra|{n} formulių skaito laukus, kurių formoje nėra
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} skaito {fields}, kurio formoje nėra.|{field} skaito {fields}, kurių formoje nėra.|{field} skaito {fields}, kurių formoje nėra.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	Dar {n} formulė skaito trūkstamą lauką.|Dar {n} formulės skaito trūkstamus laukus.|Dar {n} formulių skaito trūkstamus laukus.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} kai kuriuos laukų pavadinimus sudaro vykdymo metu, todėl šie skaitymai netikrinami.|{fields} kai kuriuos laukų pavadinimus sudaro vykdymo metu, todėl šie skaitymai netikrinami.|{fields} kai kuriuos laukų pavadinimus sudaro vykdymo metu, todėl šie skaitymai netikrinami.
+@plural	{fields} is missing|{fields} are missing	Trūksta {fields}|Trūksta {fields}|Trūksta {fields}
 key	Ctrl	Ctrl
 key	Shift	Shift
 key	Delete	Delete
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index aa3444289f..fa5c1b550c 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -538,6 +538,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Brakuje go w kolejności obliczeń zapisanej w pliku PDF: inne przeglądarki PDF mogą go nie obliczać.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Odczytuje {name}, którego nie ma w formularzu, więc nie dostaje stamtąd żadnej wartości.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Jego skrypt odczytuje też pola, których nazwy tworzy w trakcie działania, więc tych odczytów nie da się sprawdzić.
+	Missing field	Brak pola
+	Unchecked reads	Niesprawdzone odczyty
+	{field} reads fields named as it runs	{field} odczytuje pola nazywane w trakcie działania
+	Some names are built as it runs	Niektóre nazwy powstają w trakcie działania
 	Back to Prepare a form	Wróć do „Przygotuj formularz”
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Żadne pole tego formularza nie oblicza jeszcze swojej wartości. Nadaj polu obliczenie na karcie Obliczenia w jego właściwościach, a pojawi się tutaj.
 	{names} and {last}	{names} i {last}
@@ -2375,6 +2379,11 @@ animation effects	Off	Wyłączone
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} jest obliczane przed {fields}, które odczytuje.|{field} jest obliczane przed {fields}, które odczytuje.|{field} jest obliczane przed {fields}, które odczytuje.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	Jeszcze {n} pole jest obliczane za wcześnie.|Jeszcze {n} pola są obliczane za wcześnie.|Jeszcze {n} pól jest obliczanych za wcześnie.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	W kolejności zapisanej w pliku PDF brakuje {fields}, więc inne przeglądarki PDF mogą go nie obliczać.|W kolejności zapisanej w pliku PDF brakuje {fields}, więc inne przeglądarki PDF mogą ich nie obliczać.|W kolejności zapisanej w pliku PDF brakuje {fields}, więc inne przeglądarki PDF mogą ich nie obliczać.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} formuła odczytuje pole, którego nie ma w formularzu|{n} formuły odczytują pola, których nie ma w formularzu|{n} formuł odczytuje pola, których nie ma w formularzu
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} odczytuje {fields}, którego nie ma w formularzu.|{field} odczytuje {fields}, których nie ma w formularzu.|{field} odczytuje {fields}, których nie ma w formularzu.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	Jeszcze {n} formuła odczytuje brakujące pole.|Jeszcze {n} formuły odczytują brakujące pola.|Jeszcze {n} formuł odczytuje brakujące pola.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} tworzy część nazw pól w trakcie działania, więc te odczyty nie są sprawdzane.|{fields} tworzą część nazw pól w trakcie działania, więc te odczyty nie są sprawdzane.|{fields} tworzą część nazw pól w trakcie działania, więc te odczyty nie są sprawdzane.
+@plural	{fields} is missing|{fields} are missing	Brak {fields}|Brak {fields}|Brak {fields}
 	Scan	Skanuj
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Podpisz się na białej kartce i zrób jej zdjęcie przy jasnym, równomiernym świetle (użyj lampy błyskowej). Wybierz zdjęcie lub upuść je tutaj: PdfCraft znajdzie podpis i usunie papier.
 	Choose photo…	Wybierz zdjęcie…
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 5ca0e2fb60..dfe0496f90 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -161,6 +161,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Ausente da ordem de cálculo salva no PDF: outros leitores de PDF podem não calculá-lo.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Lê {name}, que não existe no formulário, então não recebe nenhum valor dali.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Seu script também lê campos cujos nomes monta durante a execução, então essas leituras não podem ser verificadas.
+	Missing field	Campo ausente
+	Unchecked reads	Leituras não verificadas
+	{field} reads fields named as it runs	{field} lê campos nomeados durante a execução
+	Some names are built as it runs	Alguns nomes são montados durante a execução
 	Back to Prepare a form	Voltar para Preparar um formulário
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Nenhum campo deste formulário calcula seu valor ainda. Dê um cálculo a um campo na aba Calcular das propriedades dele, e ele aparecerá aqui.
 	{names} and {last}	{names} e {last}
@@ -2421,6 +2425,11 @@ animation effects	Off	Desativados
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} é calculado antes de {fields}, que ele lê.|{field} é calculado antes de {fields}, que ele lê.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	Mais {n} campo é calculado cedo demais.|Mais {n} campos são calculados cedo demais.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} não está na ordem salva no PDF, então outros visualizadores de PDF podem não calculá-lo.|{fields} não estão na ordem salva no PDF, então outros visualizadores de PDF podem não calculá-los.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} fórmula lê um campo que não existe no formulário|{n} fórmulas leem campos que não existem no formulário
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} lê {fields}, que não existe no formulário.|{field} lê {fields}, que não existem no formulário.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	Mais {n} fórmula lê um campo ausente.|Mais {n} fórmulas leem campos ausentes.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} monta alguns nomes de campo durante a execução, então essas leituras não são verificadas.|{fields} montam alguns nomes de campo durante a execução, então essas leituras não são verificadas.
+@plural	{fields} is missing|{fields} are missing	{fields} não existe|{fields} não existem
 	Scan	Digitalizar
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Assine uma folha de papel branco e tire uma foto dela com luz forte e uniforme (use o flash). Escolha a foto ou solte-a aqui: o PdfCraft encontra a assinatura e remove o papel.
 	Choose photo…	Escolher foto…
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index cf1c74ad4d..413bd022dc 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -2725,6 +2725,10 @@ theme	Appearance	Aspect
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Lipsește din ordinea de calcul salvată în PDF: alte aplicații de vizualizare PDF s-ar putea să nu-l calculeze.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Citește {name}, care nu există în formular, deci nu primește nicio valoare de acolo.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Scriptul său citește și câmpuri ale căror nume le construiește în timpul rulării, deci aceste citiri nu pot fi verificate.
+	Missing field	Câmp lipsă
+	Unchecked reads	Citiri neverificate
+	{field} reads fields named as it runs	{field} citește câmpuri numite în timpul rulării
+	Some names are built as it runs	Unele nume sunt construite în timpul rulării
 	Back to Prepare a form	Înapoi la Pregătire formular
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Niciun câmp din acest formular nu își calculează încă valoarea. Adăugați un calcul unui câmp în fila Calcul din proprietățile lui și va apărea aici.
 	{names} and {last}	{names} și {last}
@@ -2752,6 +2756,11 @@ theme	Appearance	Aspect
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} se calculează înaintea câmpului {fields}, pe care îl citește.|{field} se calculează înaintea câmpurilor {fields}, pe care le citește.|{field} se calculează înaintea câmpurilor {fields}, pe care le citește.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	Încă {n} câmp se calculează prea devreme.|Încă {n} câmpuri se calculează prea devreme.|Încă {n} de câmpuri se calculează prea devreme.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} lipsește din ordinea salvată în PDF, deci alte aplicații de vizualizare PDF s-ar putea să nu-l calculeze.|{fields} lipsesc din ordinea salvată în PDF, deci alte aplicații de vizualizare PDF s-ar putea să nu le calculeze.|{fields} lipsesc din ordinea salvată în PDF, deci alte aplicații de vizualizare PDF s-ar putea să nu le calculeze.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} formulă citește un câmp care nu există în formular|{n} formule citesc câmpuri care nu există în formular|{n} de formule citesc câmpuri care nu există în formular
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} citește {fields}, care nu există în formular.|{field} citește {fields}, care nu există în formular.|{field} citește {fields}, care nu există în formular.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	Încă {n} formulă citește un câmp lipsă.|Încă {n} formule citesc câmpuri lipsă.|Încă {n} de formule citesc câmpuri lipsă.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} construiește unele nume de câmpuri în timpul rulării, deci aceste citiri nu sunt verificate.|{fields} construiesc unele nume de câmpuri în timpul rulării, deci aceste citiri nu sunt verificate.|{fields} construiesc unele nume de câmpuri în timpul rulării, deci aceste citiri nu sunt verificate.
+@plural	{fields} is missing|{fields} are missing	{fields} lipsește|{fields} lipsesc|{fields} lipsesc
 	Bulleted list	Listă cu marcatori
 	Numbered list	Listă numerotată
 	Alignment	Aliniere
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index acfc72a2a0..be3625bc6c 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -536,6 +536,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Отсутствует в порядке вычислений, сохранённом в PDF: другие программы просмотра PDF могут его не вычислять.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Читает {name}, которого нет в форме, поэтому не получает оттуда значения.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Его скрипт также читает поля, имена которых составляет во время выполнения, поэтому эти чтения нельзя проверить.
+	Missing field	Нет поля
+	Unchecked reads	Непроверенные чтения
+	{field} reads fields named as it runs	{field} читает поля, имена которых задаются при выполнении
+	Some names are built as it runs	Некоторые имена составляются при выполнении
 	Back to Prepare a form	Назад к «Подготовить форму»
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Ни одно поле этой формы пока не вычисляет своё значение. Задайте полю вычисление на вкладке «Вычислить» его свойств, и оно появится здесь.
 	{names} and {last}	{names} и {last}
@@ -2320,6 +2324,11 @@ animation effects	Off	Выкл
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} вычисляется раньше {fields}, которое оно читает.|{field} вычисляется раньше {fields}, которые оно читает.|{field} вычисляется раньше {fields}, которые оно читает.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	Ещё {n} поле вычисляется слишком рано.|Ещё {n} поля вычисляются слишком рано.|Ещё {n} полей вычисляются слишком рано.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} нет в порядке, сохранённом в PDF, поэтому другие программы просмотра PDF могут его не вычислить.|{fields} нет в порядке, сохранённом в PDF, поэтому другие программы просмотра PDF могут их не вычислить.|{fields} нет в порядке, сохранённом в PDF, поэтому другие программы просмотра PDF могут их не вычислить.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} формула читает поле, которого нет в форме|{n} формулы читают поля, которых нет в форме|{n} формул читают поля, которых нет в форме
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} читает {fields}, которого нет в форме.|{field} читает {fields}, которых нет в форме.|{field} читает {fields}, которых нет в форме.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	Ещё {n} формула читает отсутствующее поле.|Ещё {n} формулы читают отсутствующие поля.|Ещё {n} формул читают отсутствующие поля.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} составляет некоторые имена полей при выполнении, поэтому эти чтения не проверяются.|{fields} составляют некоторые имена полей при выполнении, поэтому эти чтения не проверяются.|{fields} составляют некоторые имена полей при выполнении, поэтому эти чтения не проверяются.
+@plural	{fields} is missing|{fields} are missing	{fields} отсутствует|{fields} отсутствуют|{fields} отсутствуют
 	Scan	Сканировать
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Распишитесь на листе белой бумаги и сфотографируйте его при ярком равномерном освещении (со вспышкой). Выберите фото или перетащите его сюда: PdfCraft найдёт подпись и уберёт бумагу.
 	Choose photo…	Выбрать фото…
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 19ff9c059b..94d7f91b14 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -1029,6 +1029,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Manjka v vrstnem redu izračunov, shranjenem v PDF-ju: drugi pregledovalniki PDF ga morda ne izračunajo.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Bere {name}, ki ga v obrazcu ni, zato od tam ne dobi vrednosti.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Njegov skript bere tudi polja, katerih imena sestavi med izvajanjem, zato teh branj ni mogoče preveriti.
+	Missing field	Manjka polje
+	Unchecked reads	Nepreverjena branja
+	{field} reads fields named as it runs	{field} bere polja, poimenovana med izvajanjem
+	Some names are built as it runs	Nekatera imena se sestavijo med izvajanjem
 	Back to Prepare a form	Nazaj na Pripravi obrazec
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Nobeno polje tega obrazca še ne izračuna svoje vrednosti. Polju dodelite izračun na zavihku Izračunaj v njegovih lastnostih in prikazalo se bo tukaj.
 	{names} and {last}	{names} in {last}
@@ -2411,6 +2415,11 @@ animation effects	Off	Izklopljeni
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} se izračuna pred {fields}, ki ga bere.|{field} se izračuna pred {fields}, ki ju bere.|{field} se izračuna pred {fields}, ki jih bere.|{field} se izračuna pred {fields}, ki jih bere.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	Še {n} polje se izračuna prezgodaj.|Še {n} polji se izračunata prezgodaj.|Še {n} polja se izračunajo prezgodaj.|Še {n} polj se izračuna prezgodaj.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} manjka v vrstnem redu, shranjenem v PDF-ju, zato ga drugi pregledovalniki PDF morda ne bodo izračunali.|{fields} manjkata v vrstnem redu, shranjenem v PDF-ju, zato ju drugi pregledovalniki PDF morda ne bodo izračunali.|{fields} manjkajo v vrstnem redu, shranjenem v PDF-ju, zato jih drugi pregledovalniki PDF morda ne bodo izračunali.|{fields} manjkajo v vrstnem redu, shranjenem v PDF-ju, zato jih drugi pregledovalniki PDF morda ne bodo izračunali.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} formula bere polje, ki ga v obrazcu ni|{n} formuli bereta polja, ki ju v obrazcu ni|{n} formule berejo polja, ki jih v obrazcu ni|{n} formul bere polja, ki jih v obrazcu ni
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} bere {fields}, ki ga v obrazcu ni.|{field} bere {fields}, ki ju v obrazcu ni.|{field} bere {fields}, ki jih v obrazcu ni.|{field} bere {fields}, ki jih v obrazcu ni.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	Še {n} formula bere manjkajoče polje.|Še {n} formuli bereta manjkajoča polja.|Še {n} formule berejo manjkajoča polja.|Še {n} formul bere manjkajoča polja.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} nekatera imena polj sestavi med izvajanjem, zato ta branja niso preverjena.|{fields} nekatera imena polj sestavita med izvajanjem, zato ta branja niso preverjena.|{fields} nekatera imena polj sestavijo med izvajanjem, zato ta branja niso preverjena.|{fields} nekatera imena polj sestavijo med izvajanjem, zato ta branja niso preverjena.
+@plural	{fields} is missing|{fields} are missing	{fields} manjka|{fields} manjkata|{fields} manjkajo|{fields} manjka
 @plural	{n} field name collides with earlier files and will be renamed: {list}|{n} field names collide with earlier files and will be renamed: {list}	{n} ime polja se ujema z imeni iz prejšnjih datotek in bo preimenovano: {list}|{n} imeni polj se ujemata z imeni iz prejšnjih datotek in bosta preimenovani: {list}|{n} imena polj se ujemajo z imeni iz prejšnjih datotek in bodo preimenovana: {list}|{n} imen polj se ujema z imeni iz prejšnjih datotek in bo preimenovanih: {list}
 	Scan	Skeniraj
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Podpišite se na list belega papirja in ga fotografirajte v močni, enakomerni svetlobi (uporabite bliskavico). Izberite fotografijo ali jo spustite sem: PdfCraft poišče podpis in odstrani papir.
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index ed552c8005..b6fb44e607 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -2411,6 +2411,10 @@ animation effects	Off	Joaktiv
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
+	Missing field	Missing field
+	Unchecked reads	Unchecked reads
+	{field} reads fields named as it runs	{field} reads fields named as it runs
+	Some names are built as it runs	Some names are built as it runs
 	Mobile	Mobile
 	Move only what must move, so every field calculates after the fields it reads.	Move only what must move, so every field calculates after the fields it reads.
 	Moves only what must move	Moves only what must move
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index e058226539..4c4106fac4 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -520,6 +520,10 @@ comment menu	Edit	సవరించు
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	PDFలో సేవ్ చేసిన గణన క్రమంలో లేదు: ఇతర PDF వీక్షకులు దీన్ని లెక్కించకపోవచ్చు.
 	Reads {name}, which the form doesn't have, so it gets no value there.	{name}ను చదువుతుంది, కానీ అది ఫారమ్‌లో లేదు, కాబట్టి దాని నుండి విలువ రాదు.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	దీని స్క్రిప్ట్ నడుస్తున్నప్పుడు పేర్లను కూర్చే ఫీల్డ్‌లను కూడా చదువుతుంది, కాబట్టి ఆ చదువులను తనిఖీ చేయలేము.
+	Missing field	ఫీల్డ్ లేదు
+	Unchecked reads	తనిఖీ చేయని చదువులు
+	{field} reads fields named as it runs	{field} నడుస్తున్నప్పుడు పేరు పెట్టే ఫీల్డ్‌లను చదువుతుంది
+	Some names are built as it runs	కొన్ని పేర్లు నడుస్తున్నప్పుడు కూర్చబడతాయి
 	Back to Prepare a form	‘ఫారాన్ని సిద్ధం చేయి’కి తిరిగి వెళ్లు
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	ఈ ఫారంలో ఏ ఫీల్డ్ ఇంకా తన విలువను గణించదు. ఫీల్డ్ లక్షణాలలోని గణన ట్యాబ్‌లో దానికి గణన ఇవ్వండి, అది ఇక్కడ కనిపిస్తుంది.
 	{names} and {last}	{names} మరియు {last}
@@ -2308,6 +2312,11 @@ animation effects	Off	ఆఫ్
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} తాను చదివే {fields} కంటే ముందు గణించబడుతుంది.|{field} తాను చదివే {fields} కంటే ముందు గణించబడుతుంది.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	మరో {n} ఫీల్డ్ చాలా ముందుగా గణించబడుతుంది.|మరో {n} ఫీల్డ్‌లు చాలా ముందుగా గణించబడతాయి.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} PDFలో సేవ్ చేసిన క్రమంలో లేదు, కాబట్టి ఇతర PDF వ్యూయర్‌లు దాన్ని గణించకపోవచ్చు.|{fields} PDFలో సేవ్ చేసిన క్రమంలో లేవు, కాబట్టి ఇతర PDF వ్యూయర్‌లు వాటిని గణించకపోవచ్చు.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} సూత్రం ఫారమ్‌లో లేని ఫీల్డ్‌ను చదువుతుంది|{n} సూత్రాలు ఫారమ్‌లో లేని ఫీల్డ్‌లను చదువుతాయి
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} ఫారమ్‌లో లేని {fields}‌ను చదువుతుంది.|{field} ఫారమ్‌లో లేని {fields}‌ను చదువుతుంది.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	మరో {n} సూత్రం లేని ఫీల్డ్‌ను చదువుతుంది.|మరో {n} సూత్రాలు లేని ఫీల్డ్‌లను చదువుతాయి.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} నడుస్తున్నప్పుడు కొన్ని ఫీల్డ్ పేర్లను కూర్చుతుంది, కాబట్టి ఆ చదువులు తనిఖీ చేయబడవు.|{fields} నడుస్తున్నప్పుడు కొన్ని ఫీల్డ్ పేర్లను కూర్చుతాయి, కాబట్టి ఆ చదువులు తనిఖీ చేయబడవు.
+@plural	{fields} is missing|{fields} are missing	{fields} లేదు|{fields} లేవు
 	Scan	స్కాన్
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	తెల్ల కాగితంపై సంతకం చేసి, ప్రకాశవంతమైన, సమానమైన వెలుతురులో దాని ఫోటో తీయండి (ఫ్లాష్ ఉపయోగించండి). ఫోటోను ఎంచుకోండి లేదా ఇక్కడ వదలండి: PdfCraft సంతకాన్ని కనుగొని కాగితాన్ని తొలగిస్తుంది.
 	Choose photo…	ఫోటో ఎంచుకోండి…
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index 0be6a69520..1c6f21f1eb 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -501,6 +501,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	PDF'te kayıtlı hesaplama sırasında yok: diğer PDF görüntüleyicileri bunu hesaplamayabilir.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Formda olmayan {name} alanını okur, bu yüzden oradan değer alamaz.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Komut dosyası, adlarını çalışırken oluşturduğu alanları da okur; bu okumalar denetlenemez.
+	Missing field	Eksik alan
+	Unchecked reads	Denetlenmeyen okumalar
+	{field} reads fields named as it runs	{field}, çalışırken adlandırılan alanları okuyor
+	Some names are built as it runs	Bazı adlar çalışırken oluşturuluyor
 	Back to Prepare a form	Form hazırla'ya geri dön
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Bu formdaki hiçbir alan henüz değerini hesaplamıyor. Bir alana özelliklerinin Hesapla sekmesinde bir hesaplama verin, burada görünür.
 	{names} and {last}	{names} ve {last}
@@ -2392,6 +2396,11 @@ animation effects	Off	Kapalı
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} önce hesaplanıyor; okuduğu {fields} daha sonra hesaplanıyor.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	{n} alan daha çok erken hesaplanıyor.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields}, PDF'te kayıtlı sırada yok; bu yüzden diğer PDF görüntüleyicileri hesaplamayabilir.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} formül formda olmayan alanları okuyor
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field}, formda olmayan {fields} alanını okuyor.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} formül daha eksik alanları okuyor.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields}, bazı alan adlarını çalışırken oluşturuyor; bu okumalar denetlenmiyor.
+@plural	{fields} is missing|{fields} are missing	{fields} eksik
 @plural	{n} field name collides with earlier files and will be renamed: {list}|{n} field names collide with earlier files and will be renamed: {list}	{n} alan adı önceki dosyalarla çakışıyor ve yeniden adlandırılacak: {list}
 	Scan	Tara
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Beyaz bir kâğıda imzanızı atın ve parlak, eşit ışıkta fotoğrafını çekin (flaş kullanın). Fotoğrafı seçin veya buraya bırakın: PdfCraft imzayı bulur ve kâğıdı kaldırır.
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 5d45a3f4b6..c1b08a7fc5 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -541,6 +541,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Відсутнє в порядку обчислень, збереженому в PDF: інші переглядачі PDF можуть його не обчислювати.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Читає {name}, якого немає у формі, тому не отримує звідти значення.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Його сценарій також читає поля, імена яких складає під час виконання, тому ці читання неможливо перевірити.
+	Missing field	Немає поля
+	Unchecked reads	Неперевірені читання
+	{field} reads fields named as it runs	{field} читає поля, імена яких задаються під час виконання
+	Some names are built as it runs	Деякі імена складаються під час виконання
 	Back to Prepare a form	Назад до «Підготувати форму»
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Жодне поле цієї форми поки не обчислює своє значення. Задайте полю обчислення на вкладці «Обчислення» його властивостей, і воно з’явиться тут.
 	{names} and {last}	{names} і {last}
@@ -2429,6 +2433,11 @@ animation effects	Off	Вимкнено
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} обчислюється раніше за {fields}, яке воно читає.|{field} обчислюється раніше за {fields}, які воно читає.|{field} обчислюється раніше за {fields}, які воно читає.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	Ще {n} поле обчислюється зарано.|Ще {n} поля обчислюються зарано.|Ще {n} полів обчислюються зарано.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} немає в порядку, збереженому в PDF, тож інші переглядачі PDF можуть його не обчислити.|{fields} немає в порядку, збереженому в PDF, тож інші переглядачі PDF можуть їх не обчислити.|{fields} немає в порядку, збереженому в PDF, тож інші переглядачі PDF можуть їх не обчислити.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} формула читає поле, якого немає у формі|{n} формули читають поля, яких немає у формі|{n} формул читають поля, яких немає у формі
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} читає {fields}, якого немає у формі.|{field} читає {fields}, яких немає у формі.|{field} читає {fields}, яких немає у формі.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	Ще {n} формула читає відсутнє поле.|Ще {n} формули читають відсутні поля.|Ще {n} формул читають відсутні поля.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} складає деякі імена полів під час виконання, тому ці читання не перевіряються.|{fields} складають деякі імена полів під час виконання, тому ці читання не перевіряються.|{fields} складають деякі імена полів під час виконання, тому ці читання не перевіряються.
+@plural	{fields} is missing|{fields} are missing	Немає {fields}|Немає {fields}|Немає {fields}
 	Scan	Сканувати
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	Розпишіться на аркуші білого паперу та сфотографуйте його за яскравого рівномірного освітлення (зі спалахом). Виберіть фото або перетягніть його сюди: PdfCraft знайде підпис і прибере папір.
 	Choose photo…	Вибрати фото…
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 2b51f445a3..ea218959dc 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -699,6 +699,10 @@ theme	Appearance	Giao diện
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Không có trong thứ tự tính toán lưu trong PDF: các trình xem PDF khác có thể không tính trường này.
 	Reads {name}, which the form doesn't have, so it gets no value there.	Đọc {name}, nhưng biểu mẫu không có trường này, nên không nhận được giá trị nào từ đó.
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Tập lệnh của nó còn đọc các trường có tên được tạo ra khi chạy, nên không thể kiểm tra các lần đọc đó.
+	Missing field	Thiếu trường
+	Unchecked reads	Lần đọc chưa kiểm tra
+	{field} reads fields named as it runs	{field} đọc các trường được đặt tên khi chạy
+	Some names are built as it runs	Một số tên được tạo ra khi chạy
 	Back to Prepare a form	Quay lại Chuẩn bị biểu mẫu
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Chưa có trường nào trong biểu mẫu này tự tính giá trị. Hãy đặt phép tính cho một trường ở thẻ Tính toán trong thuộc tính của nó, trường đó sẽ hiện ở đây.
 	{names} and {last}	{names} và {last}
@@ -2658,6 +2662,11 @@ certificate	SHA-256 digest	Giá trị băm SHA-256
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} được tính trước {fields} mà nó đọc.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	Còn {n} trường khác được tính quá sớm.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} không có trong thứ tự lưu trong PDF, nên các trình xem PDF khác có thể không tính.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} công thức đọc trường không có trong biểu mẫu
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} đọc {fields}, nhưng biểu mẫu không có.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	Còn {n} công thức khác đọc trường bị thiếu.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} tạo một số tên trường khi chạy, nên các lần đọc đó không được kiểm tra.
+@plural	{fields} is missing|{fields} are missing	Thiếu {fields}
 key	Ctrl	Ctrl
 key	Shift	Shift
 key	Delete	Delete
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index c4aae05c8a..7eaf75315e 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -210,6 +210,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	PDF 中保存的计算顺序缺少此字段：其他 PDF 查看器可能不会计算它。
 	Reads {name}, which the form doesn't have, so it gets no value there.	读取表单中不存在的 {name}，因此从中得不到值。
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	其脚本还会读取运行时才拼出名称的字段，因此无法检查这些读取。
+	Missing field	缺少字段
+	Unchecked reads	未检查的读取
+	{field} reads fields named as it runs	{field} 读取运行时才确定名称的字段
+	Some names are built as it runs	部分名称在运行时才拼出
 	Back to Prepare a form	返回准备表单
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	此表单中还没有计算自身值的字段。在字段属性的“计算”选项卡中为字段设置计算后，它会显示在这里。
 	{names} and {last}	{names}和{last}
@@ -2371,6 +2375,11 @@ animation effects	Off	关
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} 在它读取的 {fields} 之前计算。
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	另有 {n} 个字段计算过早。
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} 不在 PDF 中保存的顺序里，其他 PDF 查看器可能不会计算。
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} 个公式读取了表单中不存在的字段
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} 读取表单中不存在的 {fields}。
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	另有 {n} 个公式读取了缺失的字段。
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} 在运行时才拼出部分字段名称，因此这些读取不会被检查。
+@plural	{fields} is missing|{fields} are missing	缺少 {fields}
 	Scan	扫描
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	在白纸上签名，并在明亮、均匀的光线下拍照（使用闪光灯）。选择照片或将其拖放到此处：PdfCraft 会找到签名并去除纸张背景。
 	Choose photo…	选择照片…
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 82d6eb6a5d..d977c12950 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -166,6 +166,10 @@
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	PDF 中儲存的計算順序缺少此欄位：其他 PDF 檢視器可能不會計算它。
 	Reads {name}, which the form doesn't have, so it gets no value there.	讀取表單中不存在的 {name}，因此從中得不到值。
 	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	其指令碼還會讀取執行時才組出名稱的欄位，因此無法檢查這些讀取。
+	Missing field	缺少欄位
+	Unchecked reads	未檢查的讀取
+	{field} reads fields named as it runs	{field} 讀取執行時才確定名稱的欄位
+	Some names are built as it runs	部分名稱在執行時才組出
 	Back to Prepare a form	返回準備表單
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	此表單中還沒有計算自身值的欄位。在欄位內容的「計算」索引標籤中為欄位設定計算後，它會顯示在這裡。
 	{names} and {last}	{names}和{last}
@@ -2270,6 +2274,11 @@ animation effects	Off	關
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} 在它讀取的 {fields} 之前計算。
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	另有 {n} 個欄位計算過早。
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} 不在 PDF 中儲存的順序裡，其他 PDF 檢視器可能不會計算。
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} 個公式讀取了表單中不存在的欄位
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} 讀取表單中不存在的 {fields}。
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	另有 {n} 個公式讀取了缺少的欄位。
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} 在執行時才組出部分欄位名稱，因此這些讀取不會被檢查。
+@plural	{fields} is missing|{fields} are missing	缺少 {fields}
 	Scan	掃描
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	在白紙上簽名，並在明亮、均勻的光線下拍照（使用閃光燈）。選擇相片或將其拖放到此處：PdfCraft 會找到簽名並去除紙張背景。
 	Choose photo…	選擇相片…
diff --git a/crates/ui-egui/src/tools/calc_order_ui.rs b/crates/ui-egui/src/tools/calc_order_ui.rs
index e02983ac5d..bc80983021 100644
--- a/crates/ui-egui/src/tools/calc_order_ui.rs
+++ b/crates/ui-egui/src/tools/calc_order_ui.rs
@@ -1,8 +1,9 @@
 //! Prepare a form ▸ Calculation order, a page of the left panel, and what it shows on the page.
 //!
 //! The panel: a card that says whether the order is right and what Fix order does, a card for
-//! each loop, and the calculated fields in the order they calculate, each with its formula, the
-//! value it shows and what is wrong with its place. A field moves by dragging, with the arrows of
+//! each loop, a card for the formulas that read fields the form doesn't have, and the calculated
+//! fields in the order they calculate, each with its formula, the value it shows and what is wrong
+//! with it. A field moves by dragging, with the arrows of
 //! the selected field (Acrobat's Set Field Calculation Order has Up and Down), or with Alt+↑/↓.
 //! Every change is one undoable edit.
 //!
@@ -32,13 +33,15 @@ const MAX_LINKS: usize = 20_000;
 const MAX_NAMES: usize = 6;
 /// Loop cards shown at most.
 const MAX_LOOPS: usize = 5;
-/// Fields too early that the card names one by one.
-const MAX_LATE: usize = 3;
+/// Fields a card names one by one: too early, or reading fields the form doesn't have.
+const MAX_LISTED: usize = 3;
 
-/// How a field's place in the order, or a link between two fields, stands.
+/// How a field's formula and place in the order, or a link between two fields, stand.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 enum Tone {
     Ok,
+    /// Its formula reads a field the form doesn't have.
+    Missing,
     /// It calculates before a field it reads, so it uses that field's old value.
     Late,
     /// Its formula reads its own result through other formulas.
@@ -120,7 +123,9 @@ impl CalcOrderView {
 }
 
 fn tone(issues: &[CalculationIssue]) -> Tone {
-    if issues.iter().any(|i| matches!(i, CalculationIssue::Cycle { .. })) {
+    if issues.iter().any(|i| matches!(i, CalculationIssue::MissingField { .. })) {
+        Tone::Missing
+    } else if issues.iter().any(|i| matches!(i, CalculationIssue::Cycle { .. })) {
         Tone::Loop
     } else if issues.iter().any(|i| matches!(i, CalculationIssue::RunsTooEarly { .. })) {
         Tone::Late
@@ -232,7 +237,7 @@ fn loops(calculated: &[CalculatedField]) -> Vec<Vec<&str>> {
         }
     }
     let mut groups: Vec<(usize, Vec<&str>)> = Vec::new();
-    for (k, f) in calculated.iter().enumerate().filter(|(_, f)| tone(&f.issues) == Tone::Loop) {
+    for (k, f) in calculated.iter().enumerate().filter(|(_, f)| f.issues.iter().any(|i| matches!(i, CalculationIssue::Cycle { .. }))) {
         let r = root(&first, k);
         match groups.iter_mut().find(|(g, _)| *g == r) {
             Some((_, names)) => names.push(&f.name),
@@ -253,7 +258,10 @@ fn names(list: &[&str]) -> String {
 }
 
 /// What the focused field reads and what reads it: "total reads sub and tax · No field reads it".
-fn trace(links: &[Link], focus: &str) -> String {
+/// `calculated` is the focus in the order, if it calculates: the fields it reads that the form
+/// doesn't have, and names its script builds as it runs, are said too.
+fn trace(links: &[Link], focus: &str, calculated: Option<&CalculatedField>) -> String {
+    let lang = crate::i18n::current();
     let mut reads: Vec<&str> = Vec::new();
     let mut read_by: Vec<&str> = Vec::new();
     for l in links {
@@ -264,18 +272,32 @@ fn trace(links: &[Link], focus: &str) -> String {
             read_by.push(&l.to);
         }
     }
-    let reads = if reads.is_empty() {
-        crate::i18n::fmt(tl!("{field} reads no other field"), &[("field", focus)])
-    } else {
+    let issues = calculated.map(|c| c.issues.as_slice()).unwrap_or_default();
+    let missing: Vec<&str> =
+        issues.iter().filter_map(|i| if let CalculationIssue::MissingField { field } = i { Some(field.as_str()) } else { None }).collect();
+    let built = issues.contains(&CalculationIssue::BuiltNames);
+    reads.extend(&missing);
+    let mut parts = vec![if !reads.is_empty() {
         crate::i18n::fmt(tl!("{field} reads {fields}"), &[("field", focus), ("fields", &names(&reads))])
-    };
-    let read_by = if read_by.is_empty() {
+    } else if built {
+        crate::i18n::fmt(tl!("{field} reads fields named as it runs"), &[("field", focus)])
+    } else {
+        crate::i18n::fmt(tl!("{field} reads no other field"), &[("field", focus)])
+    }];
+    if !missing.is_empty() {
+        let template = crate::i18n::trn(lang, missing.len() as u64, "{fields} is missing", "{fields} are missing");
+        parts.push(crate::i18n::fmt(&template, &[("fields", &names(&missing))]));
+    }
+    if built && !reads.is_empty() {
+        parts.push(tl!("Some names are built as it runs").to_owned());
+    }
+    parts.push(if read_by.is_empty() {
         tl!("No field reads it").to_owned()
     } else {
-        let template = crate::i18n::trn(crate::i18n::current(), read_by.len() as u64, "{fields} reads it", "{fields} read it");
+        let template = crate::i18n::trn(lang, read_by.len() as u64, "{fields} reads it", "{fields} read it");
         crate::i18n::fmt(&template, &[("fields", &names(&read_by))])
-    };
-    format!("{reads} · {read_by}")
+    });
+    parts.join(" · ")
 }
 
 /// The colours of the cards and the steps in the list, for the theme.
@@ -318,7 +340,7 @@ impl Palette {
         match tone {
             Tone::Ok => self.step_ok,
             Tone::Late => self.step_late,
-            Tone::Loop => self.step_loop,
+            Tone::Loop | Tone::Missing => self.step_loop,
         }
     }
 }
@@ -386,6 +408,52 @@ fn cards(ui: &mut egui::Ui, t: &Tokens, pal: &Palette, order: &CalculationOrder,
         .collect();
     let unlisted: Vec<&str> = order.fields.iter().filter(|f| !f.listed).map(|f| f.name.as_str()).collect();
     let loops = loops(&order.fields);
+    // Each formula that reads fields the form doesn't have, with those fields.
+    let missing: Vec<(&str, Vec<&str>)> = order
+        .fields
+        .iter()
+        .map(|f| {
+            let gone = f.issues.iter().filter_map(|i| if let CalculationIssue::MissingField { field } = i { Some(field.as_str()) } else { None });
+            (f.name.as_str(), gone.collect::<Vec<_>>())
+        })
+        .filter(|(_, gone)| !gone.is_empty())
+        .collect();
+    if !missing.is_empty() {
+        let (fill, edge, title, text) = pal.looped;
+        card(ui, fill, edge, |ui| {
+            let heading = crate::i18n::trn(
+                lang,
+                missing.len() as u64,
+                "{n} formula reads a field the form doesn't have",
+                "{n} formulas read fields the form doesn't have",
+            );
+            card_title(ui, "triangle-alert", &heading, title);
+            for (field, gone) in missing.iter().take(MAX_LISTED) {
+                let template = crate::i18n::trn(
+                    lang,
+                    gone.len() as u64,
+                    "{field} reads {fields}, which the form doesn't have.",
+                    "{field} reads {fields}, which the form doesn't have.",
+                );
+                card_text(ui, &crate::i18n::fmt(&template, &[("field", field), ("fields", &names(gone))]), text);
+            }
+            if missing.len() > MAX_LISTED {
+                let more = (missing.len() - MAX_LISTED) as u64;
+                card_text(
+                    ui,
+                    &crate::i18n::trn(lang, more, "{n} more formula reads a missing field.", "{n} more formulas read missing fields."),
+                    text,
+                );
+            }
+            if editable
+                && let Some((first, _)) = missing.first()
+                && text_button(ui, &crate::i18n::fmt(tl!("Edit {field}'s formula"), &[("field", first)]), t)
+            {
+                act = Some(Act::EditFormula((*first).to_owned()));
+            }
+        });
+        ui.add_space(6.0);
+    }
     if order.fixable() {
         let (fill, edge, title, text) = pal.warn;
         card(ui, fill, edge, |ui| {
@@ -395,7 +463,7 @@ fn cards(ui: &mut egui::Ui, t: &Tokens, pal: &Palette, order: &CalculationOrder,
                 crate::i18n::trn(lang, late.len() as u64, "{n} field shows an old value", "{n} fields show old values")
             };
             card_title(ui, "triangle-alert", &heading, title);
-            for (field, later) in late.iter().take(MAX_LATE) {
+            for (field, later) in late.iter().take(MAX_LISTED) {
                 let template = crate::i18n::trn(
                     lang,
                     later.len() as u64,
@@ -404,8 +472,8 @@ fn cards(ui: &mut egui::Ui, t: &Tokens, pal: &Palette, order: &CalculationOrder,
                 );
                 card_text(ui, &crate::i18n::fmt(&template, &[("field", field), ("fields", &names(later))]), text);
             }
-            if late.len() > MAX_LATE {
-                let more = (late.len() - MAX_LATE) as u64;
+            if late.len() > MAX_LISTED {
+                let more = (late.len() - MAX_LISTED) as u64;
                 card_text(ui, &crate::i18n::trn(lang, more, "{n} more field calculates too early.", "{n} more fields calculate too early."), text);
             }
             if !unlisted.is_empty() {
@@ -435,7 +503,7 @@ fn cards(ui: &mut egui::Ui, t: &Tokens, pal: &Palette, order: &CalculationOrder,
                 ui.add(egui::Label::new(egui::RichText::new(tl!("Moves only what must move")).font(theme::regular(11.5)).color(t.text_muted)).wrap());
             });
         });
-    } else {
+    } else if missing.is_empty() || undo {
         let (fill, edge, colour) = pal.good;
         card(ui, fill, edge, |ui| {
             let said = if loops.is_empty() {
@@ -467,6 +535,19 @@ fn cards(ui: &mut egui::Ui, t: &Tokens, pal: &Palette, order: &CalculationOrder,
             }
         });
     }
+    let built: Vec<&str> = order.fields.iter().filter(|f| f.issues.contains(&CalculationIssue::BuiltNames)).map(|f| f.name.as_str()).collect();
+    if !built.is_empty() {
+        ui.add_space(6.0);
+        card(ui, t.card, t.border, |ui| {
+            let template = crate::i18n::trn(
+                lang,
+                built.len() as u64,
+                "{fields} builds some field names as it runs, so those reads aren't checked.",
+                "{fields} build some field names as they run, so those reads aren't checked.",
+            );
+            card_text(ui, &crate::i18n::fmt(&template, &[("fields", &names(&built))]), t.text_muted);
+        });
+    }
     act
 }
 
@@ -598,9 +679,11 @@ pub(crate) fn panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
                 let text_x = body.left() + 38.0;
                 let value_end = arrows_x - 4.0;
                 let caption = match row.tone {
+                    Tone::Missing => Some((tl!("Missing field"), pal.step_loop.1)),
                     Tone::Loop => Some((tl!("Loop"), pal.step_loop.1)),
                     Tone::Late => Some((tl!("Too early"), pal.step_late.1)),
                     Tone::Ok if !f.listed => Some((tl!("Not in order"), pal.step_late.1)),
+                    Tone::Ok if f.issues.contains(&CalculationIssue::BuiltNames) => Some((tl!("Unchecked reads"), t.text_muted)),
                     Tone::Ok => None,
                 };
                 let value_font = theme::medium(13.0);
@@ -614,7 +697,10 @@ pub(crate) fn panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
                     ui.painter().text(pos2(value_end, bottom), Align2::RIGHT_CENTER, c, font, colour);
                     w
                 });
-                let room = (value_end - text_x - value_w.max(caption_w) - 10.0).max(0.0);
+                // The name shares the top line with the value, the formula the bottom one with the
+                // caption.
+                let room = (value_end - text_x - value_w - 10.0).max(0.0);
+                let formula_room = (value_end - text_x - caption_w - 10.0).max(0.0);
                 let name_font = theme::medium(13.0);
                 let tag = row.script.then(|| (tl!("Script"), widgets::text_width(ui, tl!("Script"), &theme::semibold(9.5)) + 8.0));
                 let name_room = (room - tag.map_or(0.0, |(_, w)| w + 6.0)).max(0.0);
@@ -625,7 +711,7 @@ pub(crate) fn panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
                     ui.painter().rect_stroke(chip, CornerRadius::same(4), Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
                     ui.painter().text(chip.center(), Align2::CENTER_CENTER, label, theme::semibold(9.5), t.text_muted);
                 }
-                widgets::paint_left(ui, pos2(text_x, bottom), &row.formula, egui::FontId::monospace(11.0), t.text_muted, room);
+                widgets::paint_left(ui, pos2(text_x, bottom), &row.formula, egui::FontId::monospace(11.0), t.text_muted, formula_room);
             }
             // The selected field's arrows, or the one under the pointer.
             if editable && (is_selected || pointed) {
@@ -786,7 +872,7 @@ pub(crate) fn paint_page(
         let fill = match row.tone {
             Tone::Ok => STEP,
             Tone::Late => LINK_LATE,
-            Tone::Loop => LINK_LOOP,
+            Tone::Loop | Tone::Missing => LINK_LOOP,
         };
         // No bigger than the field, so a small one keeps its contents in view.
         let radius = (8.0 * zoom).clamp(6.5, 10.0).min((r.height() * 0.6).max(5.0));
@@ -813,7 +899,7 @@ fn arrow(painter: &egui::Painter, a: Rect, b: Rect, tone: Tone, zoom: f32) {
     let colour = match tone {
         Tone::Ok => LINK_OK,
         Tone::Late => LINK_LATE,
-        Tone::Loop => LINK_LOOP,
+        Tone::Loop | Tone::Missing => LINK_LOOP,
     };
     let stroke = Stroke::new(1.75, colour);
     let head = 9.0;
@@ -859,7 +945,7 @@ pub(crate) fn paint_trace(ui: &egui::Ui, painter: &egui::Painter, viewport: Rect
     }
     let (Some(listed), Some(focus)) = (view.current(generation), view.focus(selected)) else { return };
     let t = Tokens::get(ui.ctx());
-    let text = trace(&listed.links, &focus);
+    let text = trace(&listed.links, &focus, listed.order.fields.iter().find(|f| f.name == focus));
     let font = theme::regular(12.0);
     // Clear of the floating tool strip at the view's left.
     let room = (viewport.width() - 220.0).max(0.0);
@@ -938,10 +1024,40 @@ mod tests {
     fn the_summary_says_what_a_field_reads_and_what_reads_it() {
         crate::i18n::set_current(crate::i18n::Lang::EN);
         let links = [link("sub", "total", Tone::Late), link("tax", "total", Tone::Ok), link("qty", "sub", Tone::Ok), link("sub", "tax", Tone::Ok)];
-        assert_eq!(trace(&links, "total"), "total reads sub and tax · No field reads it");
-        assert_eq!(trace(&links, "sub"), "sub reads qty · total and tax read it");
-        assert_eq!(trace(&links, "tax"), "tax reads sub · total reads it");
-        assert_eq!(trace(&links, "qty"), "qty reads no other field · sub reads it");
+        assert_eq!(trace(&links, "total", None), "total reads sub and tax · No field reads it");
+        assert_eq!(trace(&links, "sub", None), "sub reads qty · total and tax read it");
+        assert_eq!(trace(&links, "tax", None), "tax reads sub · total reads it");
+        assert_eq!(trace(&links, "qty", None), "qty reads no other field · sub reads it");
+    }
+
+    /// A field the form doesn't have is read too, and said to be missing; a script's names built
+    /// as it runs are said instead of "no other field".
+    #[test]
+    fn the_summary_says_what_is_missing_and_what_is_built() {
+        crate::i18n::set_current(crate::i18n::Lang::EN);
+        let missing = |names: &[&str]| names.iter().map(|n| CalculationIssue::MissingField { field: (*n).into() }).collect::<Vec<_>>();
+        let links = [link("qty", "sub", Tone::Ok), link("sub", "total", Tone::Ok), link("tax", "total", Tone::Ok)];
+        let sub = field("sub", &["qty", "discount"], missing(&["discount"]));
+        assert_eq!(trace(&links, "sub", Some(&sub)), "sub reads qty and discount · discount is missing · total reads it");
+        let tax = field("tax", &["subtotl", "rate"], missing(&["subtotl", "rate"]));
+        assert_eq!(trace(&links, "tax", Some(&tax)), "tax reads subtotl and rate · subtotl and rate are missing · total reads it");
+        let rows = field("rows", &[], vec![CalculationIssue::BuiltNames]);
+        assert_eq!(trace(&links, "rows", Some(&rows)), "rows reads fields named as it runs · No field reads it");
+        let both = field("total", &["sub", "tax"], vec![CalculationIssue::BuiltNames]);
+        assert_eq!(trace(&links, "total", Some(&both)), "total reads sub and tax · Some names are built as it runs · No field reads it");
+    }
+
+    /// A missing field outranks a loop on the row, but the field is still in its loop.
+    #[test]
+    fn a_missing_field_marks_the_row_and_keeps_its_loop() {
+        let gone = CalculationIssue::MissingField { field: "gone".into() };
+        assert_eq!(tone(&[gone.clone(), CalculationIssue::Cycle { fields: vec!["b".into()] }]), Tone::Missing);
+        assert_eq!(tone(&[CalculationIssue::BuiltNames]), Tone::Ok, "built names are a note, not a fault");
+        let calculated = [
+            field("a", &["b", "gone"], vec![gone, CalculationIssue::Cycle { fields: vec!["b".into()] }]),
+            field("b", &["a"], vec![CalculationIssue::Cycle { fields: vec!["a".into()] }]),
+        ];
+        assert_eq!(loops(&calculated), vec![vec!["a", "b"]]);
     }
 
     #[test]
diff --git a/crates/ui-egui/tests/it/prepare.rs b/crates/ui-egui/tests/it/prepare.rs
index 6ce727a716..d7bde224b4 100644
--- a/crates/ui-egui/tests/it/prepare.rs
+++ b/crates/ui-egui/tests/it/prepare.rs
@@ -1353,3 +1353,38 @@ fn deleting_two_radio_buttons_of_a_group_at_once() {
     h.run_steps(3);
     assert!(!names(&h).iter().any(|n| n == "shirt"));
 }
+
+/// A formula that reads a field the form doesn't have gets a card of its own, in place of "every
+/// field calculates after the fields it reads", and its link opens that formula. A script that
+/// builds the names it reads gets a note.
+#[test]
+fn a_formula_reading_a_missing_field_has_its_own_card() {
+    use pdfcraft_engine::form_scripts::Calculate;
+    use pdfcraft_engine::{Edit, FieldProps, NewField};
+    use pdfcraft_ui_egui::prepare::FieldTab;
+    let mut h = harness();
+    for (i, name) in ["qty", "discount", "sub", "rows"].into_iter().enumerate() {
+        let y = 200.0 + 30.0 * i as f64;
+        let kind = NewField::Text { multiline: false };
+        h.state_mut().apply_edit(Edit::AddField { page: 0, rect: [20.0, y, 120.0, y + 20.0], kind, name: Some(name.into()) });
+    }
+    let props = Box::new(FieldProps { calculate: Some(Calculate::Notation("qty - discount".into())), ..Default::default() });
+    h.state_mut().apply_edit(Edit::SetFieldProps { name: "sub".into(), props });
+    let script = Some("event.value = getField(\"row\" + 1).value;".to_owned());
+    h.state_mut().apply_edit(Edit::SetFieldScript { name: "rows".into(), event: "calculate".into(), script });
+    h.state_mut().execute("form.prepare");
+    h.run_steps(3);
+    h.get_by_label("Calculation order").click();
+    h.run_steps(3);
+    assert!(h.query_by_label("Every field calculates after the fields it reads.").is_some(), "nothing is missing yet");
+    assert!(h.query_by_label("rows builds some field names as it runs, so those reads aren't checked.").is_some());
+    h.state_mut().apply_edit(Edit::DeleteField { name: "discount".into() });
+    h.run_steps(3);
+    assert!(h.query_by_label("1 formula reads a field the form doesn't have").is_some());
+    assert!(h.query_by_label("sub reads discount, which the form doesn't have.").is_some());
+    assert!(h.query_by_label("Every field calculates after the fields it reads.").is_none(), "no all-clear while a formula is broken");
+    h.get_by_label("Edit sub's formula").click();
+    h.run_steps(3);
+    let draft = h.state().field_props.as_ref().map(|d| (d.field.clone(), d.tab));
+    assert_eq!(draft, Some(("sub".to_owned(), FieldTab::Calculate)));
+}
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 6e929825ba..8d922f707f 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -256,7 +256,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-10-23 | minor | M6: calculation checks: a formula reading a field the form doesn't have, and a script building the names it reads, are flagged by `form_calculation_order` and on the Calculation order page; `form_calculation_order` gives each formula and `form_fields` a custom Calculate script. Estimates unchanged. |
+| 2026-10-23 | minor | M6: calculation checks: a formula reading a field the form doesn't have, and a script building the names it reads, are flagged by `form_calculation_order` and on the Calculation order page (a red mark, a card naming the broken formulas, a note for built names); `form_calculation_order` gives each formula and `form_fields` a custom Calculate script. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
 | 2026-10-23 | minor | M8, #3205 follow-up: phone-pattern redaction includes the +39 country code on labelled Italian geographic numbers with a slash; dates, protocol identifiers and whole-run guards remain. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 766c439703..952b70445c 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4679,8 +4679,8 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties", "form.calculation_order"]
 tools = ["form_set_props", "form_fill", "form_calculation_order"]
-evidence = ["crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/forms/src/tests.rs::the_calculation_order_is_checked_fixed_and_kept", "crates/forms/src/tests.rs::a_calculation_order_with_gaps_and_extra_entries", "crates/forms/src/tests.rs::two_fields_with_one_name_keep_their_places_in_the_order", "crates/engine/src/tests.rs::setting_the_calculation_order_recalculates_and_undoes", "crates/automation/tests/it/automation.rs::the_calculation_order_is_read_fixed_and_set", "crates/ui-egui/tests/it/prepare.rs::the_calculation_order_is_moved_dragged_and_fixed", "crates/engine/src/tests.rs::checkbox_and_rank_changes_recalculate_ordered_dependents", "crates/engine/src/tests.rs::dynamic_calculation_reads_and_side_effects_reach_later_fields", "crates/forms/src/tests.rs::missing_fields_and_built_names_are_flagged", "crates/forms/src/calc_order.rs::a_read_name_finds_a_field_a_group_or_a_widget", "crates/forms/src/af/tests.rs::names_built_at_run_time_are_noticed", "crates/automation/tests/it/automation.rs::the_calculation_order_shows_formulas_and_what_they_cannot_read"]
-notes = "/CO order, then other calculated fields; recalculated after every fill and Clear form. Order editing: Prepare a form ▸ Calculation order lists the calculated fields in order with their formulas and values, Up/Down arrows (as Acrobat's Set Field Calculation Order dialog), Alt+Up/Down and drag, says which fields read a field calculated later, which read each other in a loop and which /CO leaves out, and Fix order moves only what must move; on the page it numbers each calculated field's step and draws arrows from the fields the focused field reads and to the fields that read it; form_calculation_order reads, sets, moves and fixes it. Each formula is also checked against the form: a read of a field the form doesn't have (a field deleted from under a sum, a typo in notation, a script's getField) and a script that builds the names it reads at run time are flagged, in form_calculation_order (which also gives each formula) and in the page's row tooltips. A new calculation joins the end of /CO and an edited one keeps its place. Acrobat's dialog is known from Adobe's help summary only, not yet observed."
+evidence = ["crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/forms/src/tests.rs::the_calculation_order_is_checked_fixed_and_kept", "crates/forms/src/tests.rs::a_calculation_order_with_gaps_and_extra_entries", "crates/forms/src/tests.rs::two_fields_with_one_name_keep_their_places_in_the_order", "crates/engine/src/tests.rs::setting_the_calculation_order_recalculates_and_undoes", "crates/automation/tests/it/automation.rs::the_calculation_order_is_read_fixed_and_set", "crates/ui-egui/tests/it/prepare.rs::the_calculation_order_is_moved_dragged_and_fixed", "crates/engine/src/tests.rs::checkbox_and_rank_changes_recalculate_ordered_dependents", "crates/engine/src/tests.rs::dynamic_calculation_reads_and_side_effects_reach_later_fields", "crates/forms/src/tests.rs::missing_fields_and_built_names_are_flagged", "crates/forms/src/calc_order.rs::a_read_name_finds_a_field_a_group_or_a_widget", "crates/forms/src/af/tests.rs::names_built_at_run_time_are_noticed", "crates/automation/tests/it/automation.rs::the_calculation_order_shows_formulas_and_what_they_cannot_read", "crates/ui-egui/tests/it/prepare.rs::a_formula_reading_a_missing_field_has_its_own_card"]
+notes = "/CO order, then other calculated fields; recalculated after every fill and Clear form. Order editing: Prepare a form ▸ Calculation order lists the calculated fields in order with their formulas and values, Up/Down arrows (as Acrobat's Set Field Calculation Order dialog), Alt+Up/Down and drag, says which fields read a field calculated later, which read each other in a loop and which /CO leaves out, and Fix order moves only what must move; on the page it numbers each calculated field's step and draws arrows from the fields the focused field reads and to the fields that read it; form_calculation_order reads, sets, moves and fixes it. Each formula is also checked against the form: a read of a field the form doesn't have (a field deleted from under a sum, a typo in notation, a script's getField) and a script that builds the names it reads at run time are flagged, in form_calculation_order (which also gives each formula) and on the page: a red Missing field mark on the row and a card naming those formulas with a link to edit the first (no all-clear while one is broken), a grey note for built names, and both in the summary above the page. A new calculation joins the end of /CO and an edited one keeps its place. Acrobat's dialog is known from Adobe's help summary only, not yet observed."
 
 [[feature]]
 id = "form.event-order"

From 6a5020760e55728df0c31a46ce97d9d1829b3ca5 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Fri, 23 Oct 2026 23:59:08 +0200
Subject: [PATCH 208/270] M6: calculation checks: formulas by field object,
 whole AFSimple lists only, no all-clear beside a broken formula

- CalculatedField carries the field object: form_calculation_order and
  the Calculation order page find each row's formula and value by it,
  so two calculated fields sharing a name (a malformed form) each show
  their own.
- An AFSimple_Calculate list counts as written out only when it ends
  the call: "row" + suffix and [...].concat(more) are names built at
  run time, and an array item counts only when it ends at a comma or
  the list's end, so ["row" + i] no longer reads, or renames, "row".
- After a reorder, Undo is offered on the missing-field card instead of
  bringing back the all-clear beside it.

From CodeRabbit's review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/automation/src/forms.rs            |  8 ++-
 crates/automation/tests/it/automation.rs  | 37 ++++++++++++++
 crates/forms/README.md                    |  3 +-
 crates/forms/src/af/calc.rs               | 32 +++++++++---
 crates/forms/src/af/tests.rs              | 14 ++++++
 crates/forms/src/calc_order.rs            |  5 +-
 crates/forms/src/tests.rs                 |  6 +++
 crates/ui-egui/src/tools/calc_order_ui.rs | 20 +++++---
 crates/ui-egui/tests/it/prepare.rs        | 61 +++++++++++++++++++++++
 9 files changed, 163 insertions(+), 23 deletions(-)

diff --git a/crates/automation/src/forms.rs b/crates/automation/src/forms.rs
index 1dec77bf03..d13f059a3f 100644
--- a/crates/automation/src/forms.rs
+++ b/crates/automation/src/forms.rs
@@ -667,11 +667,9 @@ impl Automation {
             CalculationIssue::NotInOrder => json!({ "issue": "not_in_order" }),
             CalculationIssue::BuiltNames => json!({ "issue": "built_names" }),
         };
+        // By field object, not name: two calculated fields can share a name in a malformed form.
         let doc = self.doc(a)?;
-        let mut by_name: std::collections::HashMap<&str, &FormField> = std::collections::HashMap::with_capacity(doc.form.len());
-        for f in doc.form.iter() {
-            by_name.entry(f.name.as_str()).or_insert(f);
-        }
+        let by_obj: std::collections::HashMap<_, &FormField> = doc.form.iter().map(|f| (f.obj, f)).collect();
         out["calculation_order"] = json!(order.fields.iter().map(|f| f.name.as_str()).collect::<Vec<_>>());
         out["fields"] = order
             .fields
@@ -679,7 +677,7 @@ impl Automation {
             .map(|f| {
                 json!({
                     "name": f.name,
-                    "formula": by_name.get(f.name.as_str()).and_then(|x| calculate_json(x)),
+                    "formula": by_obj.get(&f.obj).and_then(|x| calculate_json(x)),
                     "reads": f.reads,
                     "listed": f.listed,
                     "issues": f.issues.iter().map(issue).collect::<Vec<_>>(),
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 22b5cd17e2..fd29cdce18 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -5058,6 +5058,43 @@ fn the_calculation_order_is_read_fixed_and_set() {
     assert_eq!((value(&mut a, "total"), value(&mut a, "tax")), (json!("0"), json!("0")), "undone with the values it recalculated");
 }
 
+/// A malformed form with two calculated fields named `dup`, one summing `src`, the other `x`.
+fn two_calculations_with_one_name() -> Vec<u8> {
+    let widget = |name: &str, y: u32, reads: &str| {
+        format!(
+            "<< /Type /Annot /Subtype /Widget /FT /Tx /T ({name}) /Rect [50 {y} 250 {}] /P 3 0 R /AA << /C << /S /JavaScript /JS (AFSimple_Calculate\\(\"SUM\", \"{reads}\"\\);) >> >> >>",
+            y + 20
+        )
+    };
+    pdf_of(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>",
+        "<< /Type /Page /Parent 2 0 R /Annots [5 0 R 6 0 R 7 0 R 8 0 R] >>",
+        "<< /Fields [5 0 R 6 0 R 7 0 R 8 0 R] /DA (/Helv 0 Tf 0 g) /CO [6 0 R 7 0 R 5 0 R] >>",
+        &widget("dup", 700, "x"),
+        &widget("dup", 660, "src"),
+        &widget("src", 620, "x"),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (x) /Rect [50 580 250 600] /P 3 0 R /V (3) >>",
+    ])
+}
+
+/// Each row of the calculation order gets its own field's formula, even where two fields share a
+/// name (a malformed form): the first dup sums src, the second x.
+#[test]
+fn the_calculation_order_gives_each_field_its_own_formula() {
+    let dir = workdir("calcdup");
+    std::fs::write(dir.join("dup.pdf"), two_calculations_with_one_name()).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "dup.pdf" }))["doc"].as_u64().unwrap();
+    let r = ok(&mut a, "form_calculation_order", json!({ "doc": doc }));
+    assert_eq!(r["calculation_order"], json!(["dup", "src", "dup"]));
+    let formulas: Vec<Value> = r["fields"].as_array().unwrap().iter().map(|f| f["formula"].clone()).collect();
+    assert_eq!(
+        formulas,
+        [json!({ "op": "sum", "fields": ["src"] }), json!({ "op": "sum", "fields": ["x"] }), json!({ "op": "sum", "fields": ["x"] })]
+    );
+}
+
 /// The calculation order through the tool shows each formula, in form_set_props's shape or as a
 /// script, and flags a read of a field the form doesn't have and a script that builds the names
 /// it reads; form_fields shows a custom script too.
diff --git a/crates/forms/README.md b/crates/forms/README.md
index 3b5e46eee9..6d576bb7ee 100644
--- a/crates/forms/README.md
+++ b/crates/forms/README.md
@@ -87,7 +87,8 @@ let cells: Vec<table::Cell> = grid.cells_for(names)?;      // "Table1_1", "Table
   left alone. `calculations_changed` compares two readings of a form to say which formulas an
   edit rewrote.
 - The calculation order (`/CO`, §12.7.3): `calculation_order` lists the calculated fields in the
-  order `recalculate` runs them, with the fields each formula reads (`Calculate::reads`,
+  order `recalculate` runs them, each with its field object (two can share a name in a malformed
+  form), with the fields each formula reads (`Calculate::reads`,
   `af::calculation_reads`; names built at run time aren't known) and what is wrong with the
   order: a field reading one that calculates later, a loop, a field `/CO` leaves out, and `/CO`
   entries that calculate nothing. Two issues are about the formula itself: it reads a field the
diff --git a/crates/forms/src/af/calc.rs b/crates/forms/src/af/calc.rs
index 958b5d4d04..c6556476a6 100644
--- a/crates/forms/src/af/calc.rs
+++ b/crates/forms/src/af/calc.rs
@@ -277,12 +277,18 @@ fn calculation_sites(js: &str) -> Vec<(Range<usize>, Site)> {
             sites.extend(built(k));
             continue;
         }
+        // One string of comma-separated names, when it is the whole list (not `"row" + suffix`).
         if let Some((range, list)) = string(k + 4) {
-            sites.push((range, Site::Commas(list)));
+            if punct(k + 5, ')') {
+                sites.push((range, Site::Commas(list)));
+            } else {
+                sites.extend(built(k));
+            }
             continue;
         }
-        // `new Array("a", "b")` or `["a", "b"]`: its items, up to the first that isn't a string,
-        // which has to close the list for the list to be written out. Nothing else is read, so no
+        // `new Array("a", "b")` or `["a", "b"]`: each item that is one string, and the list has
+        // to end the call. An item that is more than a string (`"row" + i`), or anything after
+        // the list (`.concat(more)`), is a name built at run time. Nothing else is read, so no
         // token is read for two calls.
         let (first, close) = if punct(k + 4, '[') {
             (k + 5, ']')
@@ -292,11 +298,21 @@ fn calculation_sites(js: &str) -> Vec<(Range<usize>, Site)> {
             sites.extend(built(k));
             continue;
         };
-        for (range, token) in tokens.iter().skip(first) {
-            match token {
-                Js::Str(name) => sites.push((range.clone(), Site::Literal(name.clone()))),
-                Js::Punct(',') => {}
-                Js::Punct(c) if *c == close => break,
+        let mut j = first;
+        loop {
+            match tokens.get(j) {
+                // An item ends at a comma or the list's end, or where a script cut short ends.
+                Some((range, Js::Str(name))) if punct(j + 1, ',') || punct(j + 1, close) || tokens.get(j + 1).is_none() => {
+                    sites.push((range.clone(), Site::Literal(name.clone())));
+                    j += 1;
+                }
+                Some((_, Js::Punct(','))) => j += 1,
+                Some((_, Js::Punct(c))) if *c == close => {
+                    if !punct(j + 1, ')') {
+                        sites.extend(built(k));
+                    }
+                    break;
+                }
                 _ => {
                     sites.extend(built(k));
                     break;
diff --git a/crates/forms/src/af/tests.rs b/crates/forms/src/af/tests.rs
index 5198fcc5ad..50b3029ada 100644
--- a/crates/forms/src/af/tests.rs
+++ b/crates/forms/src/af/tests.rs
@@ -168,9 +168,23 @@ fn names_built_at_run_time_are_noticed() {
         "AFSimple_Calculate(\"SUM\", [\"a\", prefix + \"b\"]);",
         "AFSimple_Calculate(\"SUM\", new Array(\"a\", \"b\" + c));",
         "AFSimple_Calculate(op, new Array(\"a\"));",
+        "AFSimple_Calculate(\"SUM\", \"row\" + suffix);",
+        "AFSimple_Calculate(\"SUM\", [\"a\"].concat(more));",
+        "AFSimple_Calculate(\"SUM\", [\"row\" + i]);",
     ] {
         assert!(reads_built_names(js), "{js}");
     }
+    // A string that is only the start of a name or a list isn't read, or renamed, as one.
+    for (js, reads) in [
+        ("AFSimple_Calculate(\"SUM\", \"row\" + suffix);", vec![]),
+        ("AFSimple_Calculate(\"SUM\", [\"row\" + i]);", vec![]),
+        ("AFSimple_Calculate(\"SUM\", [\"a\", \"row\" + i]);", vec!["a"]),
+        ("AFSimple_Calculate(\"SUM\", [\"a\", \"b\"].concat(more));", vec!["a", "b"]),
+    ] {
+        assert_eq!(parse_calculate(js), None, "{js} is a script");
+        assert_eq!(calculation_reads(js), reads, "{js}");
+        assert_eq!(rename_in_calculation(js, "row", "line"), None, "{js}");
+    }
     for js in [
         "event.value = getField(\"a\").value + getField('b').value;",
         "AFSimple_Calculate(\"SUM\", new Array(\"a\", \"b\"));",
diff --git a/crates/forms/src/calc_order.rs b/crates/forms/src/calc_order.rs
index c4a1b5bd37..ed69ac7c1b 100644
--- a/crates/forms/src/calc_order.rs
+++ b/crates/forms/src/calc_order.rs
@@ -17,6 +17,9 @@ const MAX_LINKS: usize = 1 << 20;
 pub struct CalculatedField {
     /// The field's full name.
     pub name: String,
+    /// The field object. Two calculated fields can share a name in a malformed form; this tells
+    /// them apart.
+    pub obj: ObjRef,
     /// The fields its formula reads, each once, as the formula names them: a name also stands for
     /// the fields under it. A script's names built at run time (`getField("row" + i)`) aren't here.
     pub reads: Vec<String>,
@@ -184,7 +187,7 @@ pub fn calculation_order(doc: &Document, fields: &[Field]) -> CalculationOrder {
         if f.actions.scripts.calculate.as_deref().is_some_and(crate::af::reads_built_names) {
             issues.push(CalculationIssue::BuiltNames);
         }
-        out.push(CalculatedField { name: f.name.clone(), reads, listed: *listed, issues });
+        out.push(CalculatedField { name: f.name.clone(), obj: f.obj, reads, listed: *listed, issues });
     }
     let fixed = fixed_order(&links, &component);
     CalculationOrder { fields: out, extra, fixed }
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 6f848f9628..c9c01c0e13 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -1814,6 +1814,12 @@ fn two_fields_with_one_name_keep_their_places_in_the_order() {
     };
     let row = |name: &str, reads: &str, ok: bool| (name.to_owned(), vec![reads.to_owned()], ok);
     assert_eq!(rows(&doc), [row("dup", "src", false), row("src", "x", true), row("dup", "x", true)]);
+    // Each row is its own field object, so a caller can find the right formula for each dup.
+    let all = fields(&doc);
+    for c in calculation_order(&doc, &all).fields {
+        let f = all.iter().find(|f| f.obj == c.obj).unwrap();
+        assert_eq!((&f.name, f.actions.calculate.reads()), (&c.name, c.reads.clone()));
+    }
     let current: Vec<String> = ["dup", "src", "dup"].map(String::from).into();
     set_calculation_order(&mut doc, &current).unwrap();
     assert_eq!(rows(&doc), [row("dup", "src", false), row("src", "x", true), row("dup", "x", true)], "the current order sets back unchanged");
diff --git a/crates/ui-egui/src/tools/calc_order_ui.rs b/crates/ui-egui/src/tools/calc_order_ui.rs
index bc80983021..d2b952df3e 100644
--- a/crates/ui-egui/src/tools/calc_order_ui.rs
+++ b/crates/ui-egui/src/tools/calc_order_ui.rs
@@ -139,16 +139,14 @@ fn one_line(text: &str) -> String {
     text.split_whitespace().collect::<Vec<_>>().join(" ").chars().take(200).collect()
 }
 
-/// Each calculated field's value, formula and standing, in the order's order.
+/// Each calculated field's value, formula and standing, in the order's order. Fields are found by
+/// their object, not their name: two calculated fields can share a name in a malformed form.
 fn rows(calculated: &[CalculatedField], form: &[FormField]) -> Vec<Row> {
-    let mut by_name: HashMap<&str, &FormField> = HashMap::with_capacity(form.len());
-    for f in form {
-        by_name.entry(f.name.as_str()).or_insert(f);
-    }
+    let by_obj: HashMap<_, &FormField> = form.iter().map(|f| (f.obj, f)).collect();
     calculated
         .iter()
         .map(|c| {
-            let field = by_name.get(c.name.as_str());
+            let field = by_obj.get(&c.obj);
             let value = match field {
                 Some(f) if f.kind == FormFieldKind::Text => f.value.first().map(|v| format_value(&f.actions.format, v)).unwrap_or_default(),
                 Some(f) => f.display_value(),
@@ -451,6 +449,11 @@ fn cards(ui: &mut egui::Ui, t: &Tokens, pal: &Palette, order: &CalculationOrder,
             {
                 act = Some(Act::EditFormula((*first).to_owned()));
             }
+            // The all-clear, which carries Undo after a reorder, stays hidden while a formula is
+            // broken, so Undo is offered here.
+            if undo && text_button(ui, tl!("Undo"), t) {
+                act = Some(Act::Undo);
+            }
         });
         ui.add_space(6.0);
     }
@@ -503,7 +506,7 @@ fn cards(ui: &mut egui::Ui, t: &Tokens, pal: &Palette, order: &CalculationOrder,
                 ui.add(egui::Label::new(egui::RichText::new(tl!("Moves only what must move")).font(theme::regular(11.5)).color(t.text_muted)).wrap());
             });
         });
-    } else if missing.is_empty() || undo {
+    } else if missing.is_empty() {
         let (fill, edge, colour) = pal.good;
         card(ui, fill, edge, |ui| {
             let said = if loops.is_empty() {
@@ -965,7 +968,8 @@ mod tests {
     use super::*;
 
     fn field(name: &str, reads: &[&str], issues: Vec<CalculationIssue>) -> CalculatedField {
-        CalculatedField { name: name.into(), reads: reads.iter().map(|r| (*r).to_owned()).collect(), listed: true, issues }
+        let obj = pdfcraft_cos::ObjRef { num: 0, generation: 0 };
+        CalculatedField { name: name.into(), obj, reads: reads.iter().map(|r| (*r).to_owned()).collect(), listed: true, issues }
     }
 
     #[test]
diff --git a/crates/ui-egui/tests/it/prepare.rs b/crates/ui-egui/tests/it/prepare.rs
index d7bde224b4..3fad521e68 100644
--- a/crates/ui-egui/tests/it/prepare.rs
+++ b/crates/ui-egui/tests/it/prepare.rs
@@ -1354,6 +1354,56 @@ fn deleting_two_radio_buttons_of_a_group_at_once() {
     assert!(!names(&h).iter().any(|n| n == "shirt"));
 }
 
+/// Two calculated fields that share a name (a malformed form) each show their own formula: the
+/// first dup sums src, the second x.
+#[test]
+fn fields_sharing_a_name_each_show_their_own_formula() {
+    let widget = |name: &str, y: u32, reads: &str| {
+        format!(
+            "<< /Type /Annot /Subtype /Widget /FT /Tx /T ({name}) /Rect [50 {y} 250 {}] /P 3 0 R /AA << /C << /S /JavaScript /JS (AFSimple_Calculate\\(\"SUM\", \"{reads}\"\\);) >> >> >>",
+            y + 20
+        )
+    };
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [5 0 R 6 0 R 7 0 R 8 0 R] >>".into(),
+        "<< /Fields [5 0 R 6 0 R 7 0 R 8 0 R] /DA (/Helv 0 Tf 0 g) /CO [6 0 R 7 0 R 5 0 R] >>".into(),
+        widget("dup", 700, "x"),
+        widget("dup", 660, "src"),
+        widget("src", 620, "x"),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (x) /Rect [50 580 250 600] /P 3 0 R /V (3) >>".into(),
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        bytes.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("dup.pdf", None, bytes.clone()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    h.state_mut().execute("form.prepare");
+    h.run_steps(3);
+    h.get_by_label("Calculation order").click();
+    h.run_steps(3);
+    for (row, formula) in [("1. dup", "= sum(src)"), ("3. dup", "= sum(x)")] {
+        h.get_by_label_contains(row).hover();
+        h.run_steps(30);
+        assert!(h.query_by_label_contains(formula).is_some(), "{row} shows {formula}");
+    }
+}
+
 /// A formula that reads a field the form doesn't have gets a card of its own, in place of "every
 /// field calculates after the fields it reads", and its link opens that formula. A script that
 /// builds the names it reads gets a note.
@@ -1383,6 +1433,17 @@ fn a_formula_reading_a_missing_field_has_its_own_card() {
     assert!(h.query_by_label("1 formula reads a field the form doesn't have").is_some());
     assert!(h.query_by_label("sub reads discount, which the form doesn't have.").is_some());
     assert!(h.query_by_label("Every field calculates after the fields it reads.").is_none(), "no all-clear while a formula is broken");
+    // Reordered, the order can be undone from the missing-field card; the all-clear still stays away.
+    h.state_mut().apply_edit(Edit::SetCalculationOrder { names: vec!["rows".into(), "sub".into()] });
+    h.run_steps(3);
+    assert!(h.query_by_label("Every field calculates after the fields it reads.").is_none(), "still no all-clear");
+    h.get_by_label("Undo").click();
+    h.run_steps(3);
+    let order: Vec<String> = {
+        let s = h.state();
+        s.session.get(s.views[0].id).unwrap().calculation_order().fields.into_iter().map(|f| f.name).collect()
+    };
+    assert_eq!(order, ["sub", "rows"], "Undo put the order back");
     h.get_by_label("Edit sub's formula").click();
     h.run_steps(3);
     let draft = h.state().field_props.as_ref().map(|d| (d.field.clone(), d.tab));

From 64c26761a4065e9ffe6184a581dd6601f8efc3b3 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 00:39:33 +0200
Subject: [PATCH 209/270] M6: form_set_props refuses a calculate script given
 beside a notation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

calculate_arg read the notation first, so {"notation": …, "script": …}
set the notation and dropped the script unnoticed; the script check now
comes first (from CodeRabbit's review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/automation/src/forms.rs           | 7 ++++---
 crates/automation/tests/it/automation.rs | 9 ++++++---
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/crates/automation/src/forms.rs b/crates/automation/src/forms.rs
index d13f059a3f..3399505ecc 100644
--- a/crates/automation/src/forms.rs
+++ b/crates/automation/src/forms.rs
@@ -113,12 +113,13 @@ fn calculate_arg(v: &Value) -> Result<Calculate> {
         return Ok(Calculate::None);
     }
     let o = v.as_object().ok_or_else(|| bad("calculate must be {\"op\": …, \"fields\": […]}, {\"notation\": …} or \"none\""))?;
-    if let Some(n) = o.get("notation").and_then(Value::as_str) {
-        return Ok(Calculate::Notation(n.to_string()));
-    }
+    // Before anything else is read, so a script given beside a notation isn't dropped unnoticed.
     if o.contains_key("script") {
         return Err(bad("a custom calculate script is set with form_set_script (event: calculate)"));
     }
+    if let Some(n) = o.get("notation").and_then(Value::as_str) {
+        return Ok(Calculate::Notation(n.to_string()));
+    }
     let op = match o.get("op").and_then(Value::as_str).unwrap_or("") {
         "sum" => CalcOp::Sum,
         "product" => CalcOp::Product,
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index fd29cdce18..f46187d3e7 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -5123,9 +5123,12 @@ fn the_calculation_order_shows_formulas_and_what_they_cannot_read() {
     let fields = ok(&mut a, "form_fields", json!({ "doc": doc }));
     let tax = fields["fields"].as_array().unwrap().iter().find(|f| f["name"] == "tax").unwrap();
     assert_eq!(tax["calculate"], json!({ "script": script }));
-    // A script is set with form_set_script, and form_set_props says so.
-    let e = err(&mut a, "form_set_props", json!({ "doc": doc, "field": "tax", "calculate": { "script": script } }));
-    assert!(e.to_string().contains("form_set_script"), "{e}");
+    // A script is set with form_set_script, and form_set_props says so, also when a notation
+    // comes with it.
+    for calculate in [json!({ "script": script }), json!({ "notation": "qty * 2", "script": script })] {
+        let e = err(&mut a, "form_set_props", json!({ "doc": doc, "field": "tax", "calculate": calculate }));
+        assert!(e.to_string().contains("form_set_script"), "{calculate}: {e}");
+    }
 }
 
 #[test]

From 36e16de470056cfa48096dde1390e179f858a5c3 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 00:30:57 +0200
Subject: [PATCH 210/270] M6: form_fields and form_calculation_order name
 product and average as form_set_props takes them

calculate_json wrote the lowercased AFSimple code, so a product or an
average came back as {"op": "prd"} or {"op": "avg"}, which
form_set_props refused as an unknown op. One name per operation now
serves both: calculate_arg looks names up in it (still taking minimum
and maximum), and the listings write it (from CodeRabbit's review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/src/forms.rs           | 24 +++++++++++++++++-------
 crates/automation/tests/it/automation.rs | 22 ++++++++++++++++++++++
 2 files changed, 39 insertions(+), 7 deletions(-)

diff --git a/crates/automation/src/forms.rs b/crates/automation/src/forms.rs
index 3399505ecc..649366de55 100644
--- a/crates/automation/src/forms.rs
+++ b/crates/automation/src/forms.rs
@@ -121,12 +121,11 @@ fn calculate_arg(v: &Value) -> Result<Calculate> {
         return Ok(Calculate::Notation(n.to_string()));
     }
     let op = match o.get("op").and_then(Value::as_str).unwrap_or("") {
-        "sum" => CalcOp::Sum,
-        "product" => CalcOp::Product,
-        "average" => CalcOp::Average,
-        "min" | "minimum" => CalcOp::Minimum,
-        "max" | "maximum" => CalcOp::Maximum,
-        x => return Err(bad(format!("unknown op {x:?} (sum, product, average, min, max)"))),
+        "minimum" => CalcOp::Minimum,
+        "maximum" => CalcOp::Maximum,
+        x => {
+            CalcOp::ALL.into_iter().find(|&op| op_name(op) == x).ok_or_else(|| bad(format!("unknown op {x:?} (sum, product, average, min, max)")))?
+        }
     };
     let fields: Vec<String> =
         o.get("fields").and_then(Value::as_array).map(|a| a.iter().filter_map(|x| x.as_str().map(str::to_owned)).collect()).unwrap_or_default();
@@ -136,11 +135,22 @@ fn calculate_arg(v: &Value) -> Result<Calculate> {
     Ok(Calculate::Simple { op, fields })
 }
 
+/// An operation's name in `calculate`, as `form_set_props` takes it and the listings show it.
+fn op_name(op: CalcOp) -> &'static str {
+    match op {
+        CalcOp::Sum => "sum",
+        CalcOp::Product => "product",
+        CalcOp::Average => "average",
+        CalcOp::Minimum => "min",
+        CalcOp::Maximum => "max",
+    }
+}
+
 /// A field's calculation as `form_fields` and `form_calculation_order` show it, in
 /// `form_set_props`'s shape, or `{"script": …}` for a custom Calculate script; `None` without one.
 fn calculate_json(f: &FormField) -> Option<Value> {
     match (&f.actions.calculate, &f.actions.scripts.calculate) {
-        (Calculate::Simple { op, fields }, _) => Some(json!({ "op": op.code().to_lowercase(), "fields": fields })),
+        (Calculate::Simple { op, fields }, _) => Some(json!({ "op": op_name(*op), "fields": fields })),
         (Calculate::Notation(n), _) => Some(json!({ "notation": n })),
         (Calculate::None, Some(js)) => Some(json!({ "script": js })),
         (Calculate::None, None) => None,
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index f46187d3e7..7778108cb8 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -5131,6 +5131,28 @@ fn the_calculation_order_shows_formulas_and_what_they_cannot_read() {
     }
 }
 
+/// Every operation comes back from form_fields and form_calculation_order as form_set_props takes
+/// it, so a formula can be read and given back: product and average came back as prd and avg,
+/// which it refused.
+#[test]
+fn every_calculation_op_can_be_read_and_given_back() {
+    let dir = workdir("calcops");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    for (name, y) in [("a", 20), ("b", 60), ("total", 100)] {
+        ok(&mut a, "form_add_field", json!({ "doc": doc, "page": 1, "type": "text", "rect": [20, y, 180, y + 22], "name": name }));
+    }
+    for op in ["sum", "product", "average", "min", "max"] {
+        let calculate = json!({ "op": op, "fields": ["a", "b"] });
+        ok(&mut a, "form_set_props", json!({ "doc": doc, "field": "total", "calculate": calculate }));
+        let fields = ok(&mut a, "form_fields", json!({ "doc": doc }));
+        let shown = fields["fields"].as_array().unwrap().iter().find(|f| f["name"] == "total").unwrap()["calculate"].clone();
+        let order = ok(&mut a, "form_calculation_order", json!({ "doc": doc }));
+        assert_eq!((&shown, &order["fields"][0]["formula"]), (&calculate, &calculate), "{op}");
+        ok(&mut a, "form_set_props", json!({ "doc": doc, "field": "total", "calculate": shown }));
+    }
+}
+
 #[test]
 fn page_tab_orders_are_read_and_set_per_page_through_tools() {
     let dir = workdir("pagetabs");

From 91a4db27be3df9df2246d7977c78204f9d6a2a03 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 00:30:57 +0200
Subject: [PATCH 211/270] M6: calculation checks: a widget number past a
 field's last widget is a missing field

A read like price.12 counted as found whenever price existed. A widget
number now finds something only below the field's widget count; a
field with one widget, or none, still answers to .0 (from CodeRabbit's
review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/forms/src/calc_order.rs | 38 +++++++++++++++++++++-------------
 crates/forms/src/tests.rs      |  6 ++++--
 2 files changed, 28 insertions(+), 16 deletions(-)

diff --git a/crates/forms/src/calc_order.rs b/crates/forms/src/calc_order.rs
index ed69ac7c1b..3b4a684824 100644
--- a/crates/forms/src/calc_order.rs
+++ b/crates/forms/src/calc_order.rs
@@ -161,7 +161,7 @@ pub fn calculation_order(doc: &Document, fields: &[Field]) -> CalculationOrder {
         .collect();
     let links = links(calculated.iter().map(|(f, _)| f.name.as_str()), &reads);
     let component = components(&links);
-    let mut all: Vec<&str> = fields.iter().map(|f| f.name.as_str()).collect();
+    let mut all: Vec<(&str, usize)> = fields.iter().map(|f| (f.name.as_str(), f.widgets.len())).collect();
     all.sort_unstable();
     let name = |k: usize| calculated.get(k).map(|(f, _)| f.name.clone()).unwrap_or_default();
     let mut out = Vec::with_capacity(calculated.len());
@@ -193,14 +193,22 @@ pub fn calculation_order(doc: &Document, fields: &[Field]) -> CalculationOrder {
     CalculationOrder { fields: out, extra, fixed }
 }
 
-/// Whether a formula's read `name` finds a field in `names` (sorted): the field of that name, a
-/// field under it (`row` for `row.1`), or a widget of one (`price.0`, as `getField` numbers them).
-fn found(names: &[&str], name: &str) -> bool {
-    let has = |n: &str| names.binary_search(&n).is_ok();
+/// Whether a formula's read `name` finds a field in `fields` (names with their widget counts,
+/// sorted): the field of that name, a field under it (`row` for `row.1`), or one of a field's
+/// widgets (`price.0`, as Acrobat's `getField` numbers them, up to its last widget).
+fn found(fields: &[(&str, usize)], name: &str) -> bool {
+    // The most widgets a field called `n` has (a malformed form can have two such fields).
+    let widgets = |n: &str| {
+        let at = fields.partition_point(|(f, _)| *f < n);
+        fields.get(at..).unwrap_or_default().iter().take_while(|(f, _)| *f == n).map(|&(_, w)| w).max()
+    };
     let prefix = format!("{name}.");
-    let under = names.partition_point(|n| *n < prefix.as_str());
-    let widget = name.rsplit_once('.').is_some_and(|(base, i)| !i.is_empty() && i.bytes().all(|b| b.is_ascii_digit()) && has(base));
-    has(name) || names.get(under).is_some_and(|n| n.starts_with(&prefix)) || widget
+    let under = fields.partition_point(|(f, _)| *f < prefix.as_str());
+    // A field with one widget, or none, is still `.0` (digits only: `parse` would take `+0`).
+    let widget = name.rsplit_once('.').is_some_and(|(base, i)| {
+        i.bytes().all(|b| b.is_ascii_digit()) && i.parse::<usize>().is_ok_and(|i| widgets(base).is_some_and(|w| i < w.max(1)))
+    });
+    widgets(name).is_some() || fields.get(under).is_some_and(|(f, _)| f.starts_with(&prefix)) || widget
 }
 
 /// For each calculated field (by its place in `names`), the places of the calculated fields it
@@ -410,14 +418,16 @@ mod tests {
 
     #[test]
     fn a_read_name_finds_a_field_a_group_or_a_widget() {
-        let mut names = vec!["price", "row.1", "row.2", "rows", "total"];
-        names.sort_unstable();
-        for name in ["price", "row", "row.1", "rows", "price.0", "price.12"] {
-            assert!(found(&names, name), "{name}");
+        let mut fields = vec![("price", 1), ("qty", 3), ("row.1", 1), ("row.2", 1), ("rows", 1), ("total", 1), ("bare", 0)];
+        fields.sort_unstable();
+        for name in ["price", "row", "row.1", "rows", "price.0", "qty.0", "qty.2", "bare", "bare.0"] {
+            assert!(found(&fields, name), "{name}");
         }
-        for name in ["pric", "ro", "row.3", "price.", "price.x", "price.-1", "total.0.1", ""] {
-            assert!(!found(&names, name), "{name}");
+        // Past a field's last widget there is no widget to find.
+        for name in ["pric", "ro", "row.3", "price.", "price.x", "price.-1", "price.+0", "price.1", "price.12", "qty.3", "bare.1", "total.0.1", ""] {
+            assert!(!found(&fields, name), "{name}");
         }
+        assert!(!found(&fields, "qty.99999999999999999999999"), "a number too big for usize is no widget");
     }
 
     /// Two thousand formulas each reading a group of two thousand fields would be four million
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index c9c01c0e13..ae73da1a7d 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -1727,7 +1727,9 @@ fn missing_fields_and_built_names_are_flagged() {
     let calculate = |c: Calculate| FieldProps { calculate: Some(c), ..FieldProps::default() };
     set_props(&mut doc, "sum", &calculate(Calculate::Simple { op: CalcOp::Sum, fields: vec!["qty".into(), "gone".into()] })).unwrap();
     set_props(&mut doc, "notation", &calculate(Calculate::Notation("qty * nope".into()))).unwrap();
-    set_field_script(&mut doc, "script", "calculate", Some("event.value = getField(\"qty\").value + getField(\"ghost\").value;")).unwrap();
+    // qty has one widget: qty.0 is it, and there is no qty.1.
+    let script = "event.value = getField(\"qty\").value + getField(\"ghost\").value + getField(\"qty.0\").value + getField(\"qty.1\").value;";
+    set_field_script(&mut doc, "script", "calculate", Some(script)).unwrap();
     set_field_script(&mut doc, "built", "calculate", Some("event.value = getField(\"qty\").value + getField(\"row\" + 1).value;")).unwrap();
     let issues = |doc: &Document| {
         let order = calculation_order(doc, &fields(doc));
@@ -1738,7 +1740,7 @@ fn missing_fields_and_built_names_are_flagged() {
         vec![
             ("sum".to_owned(), sum),
             ("notation".to_owned(), vec![MissingField { field: "nope".into() }]),
-            ("script".to_owned(), vec![MissingField { field: "ghost".into() }]),
+            ("script".to_owned(), vec![MissingField { field: "ghost".into() }, MissingField { field: "qty.1".into() }]),
             ("built".to_owned(), vec![BuiltNames]),
         ]
     };

From 2b40413dc300884aaee6e5d71d44233dbe2be930 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 10:16:10 +0100
Subject: [PATCH 212/270] M6: calculation checks: an Acrobat widget name is a
 missing field, as nothing here resolves it

found accepted price.0 (up to the field's last widget), but links,
recalculate and the scripts' getField all take a name as the field or
the fields under it, so a formula reading price.0 got no value and no
order check while the page said nothing was wrong. found now looks
names up the same way; a widget name is flagged as missing until all of
them resolve it (from CodeRabbit's review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/forms/README.md         |  5 +++--
 crates/forms/src/calc_order.rs | 41 +++++++++++++---------------------
 crates/forms/src/tests.rs      |  8 +++++--
 parity/acrobat-features.toml   |  2 +-
 4 files changed, 26 insertions(+), 30 deletions(-)

diff --git a/crates/forms/README.md b/crates/forms/README.md
index 6d576bb7ee..e3c5f7824b 100644
--- a/crates/forms/README.md
+++ b/crates/forms/README.md
@@ -92,8 +92,9 @@ let cells: Vec<table::Cell> = grid.cells_for(names)?;      // "Table1_1", "Table
   `af::calculation_reads`; names built at run time aren't known) and what is wrong with the
   order: a field reading one that calculates later, a loop, a field `/CO` leaves out, and `/CO`
   entries that calculate nothing. Two issues are about the formula itself: it reads a field the
-  form doesn't have (`MissingField`; the field of that name, a field under it and a widget of one,
-  `price.0`, all count as there), or its script builds names at run time (`BuiltNames`,
+  form doesn't have (`MissingField`; the field of that name and a field under it count as there,
+  as recalculation and `getField` find them, but not an Acrobat widget name such as `price.0`,
+  which neither resolves), or its script builds names at run time (`BuiltNames`,
   `af::reads_built_names`), so its reads are incomplete. `CalculationOrder::fixed` is Fix order: a stable topological
   sort that keeps the current order wherever it can and leaves loops as they are.
   `set_calculation_order` writes `/CO` afresh. A field that gets a calculation joins the end of
diff --git a/crates/forms/src/calc_order.rs b/crates/forms/src/calc_order.rs
index 3b4a684824..cbafd296e2 100644
--- a/crates/forms/src/calc_order.rs
+++ b/crates/forms/src/calc_order.rs
@@ -161,7 +161,7 @@ pub fn calculation_order(doc: &Document, fields: &[Field]) -> CalculationOrder {
         .collect();
     let links = links(calculated.iter().map(|(f, _)| f.name.as_str()), &reads);
     let component = components(&links);
-    let mut all: Vec<(&str, usize)> = fields.iter().map(|f| (f.name.as_str(), f.widgets.len())).collect();
+    let mut all: Vec<&str> = fields.iter().map(|f| f.name.as_str()).collect();
     all.sort_unstable();
     let name = |k: usize| calculated.get(k).map(|(f, _)| f.name.clone()).unwrap_or_default();
     let mut out = Vec::with_capacity(calculated.len());
@@ -193,22 +193,14 @@ pub fn calculation_order(doc: &Document, fields: &[Field]) -> CalculationOrder {
     CalculationOrder { fields: out, extra, fixed }
 }
 
-/// Whether a formula's read `name` finds a field in `fields` (names with their widget counts,
-/// sorted): the field of that name, a field under it (`row` for `row.1`), or one of a field's
-/// widgets (`price.0`, as Acrobat's `getField` numbers them, up to its last widget).
-fn found(fields: &[(&str, usize)], name: &str) -> bool {
-    // The most widgets a field called `n` has (a malformed form can have two such fields).
-    let widgets = |n: &str| {
-        let at = fields.partition_point(|(f, _)| *f < n);
-        fields.get(at..).unwrap_or_default().iter().take_while(|(f, _)| *f == n).map(|&(_, w)| w).max()
-    };
+/// Whether a formula's read `name` finds a field in `names` (sorted): the field of that name or a
+/// field under it (`row` for `row.1`), as [`links`], [`crate::recalculate`] and the scripts'
+/// `getField` look names up. Acrobat's widget names (`price.0`) aren't fields to any of them, so
+/// a read of one gets no value and is missing too.
+fn found(names: &[&str], name: &str) -> bool {
     let prefix = format!("{name}.");
-    let under = fields.partition_point(|(f, _)| *f < prefix.as_str());
-    // A field with one widget, or none, is still `.0` (digits only: `parse` would take `+0`).
-    let widget = name.rsplit_once('.').is_some_and(|(base, i)| {
-        i.bytes().all(|b| b.is_ascii_digit()) && i.parse::<usize>().is_ok_and(|i| widgets(base).is_some_and(|w| i < w.max(1)))
-    });
-    widgets(name).is_some() || fields.get(under).is_some_and(|(f, _)| f.starts_with(&prefix)) || widget
+    let under = names.partition_point(|n| *n < prefix.as_str());
+    names.binary_search(&name).is_ok() || names.get(under).is_some_and(|n| n.starts_with(&prefix))
 }
 
 /// For each calculated field (by its place in `names`), the places of the calculated fields it
@@ -417,17 +409,16 @@ mod tests {
     }
 
     #[test]
-    fn a_read_name_finds_a_field_a_group_or_a_widget() {
-        let mut fields = vec![("price", 1), ("qty", 3), ("row.1", 1), ("row.2", 1), ("rows", 1), ("total", 1), ("bare", 0)];
-        fields.sort_unstable();
-        for name in ["price", "row", "row.1", "rows", "price.0", "qty.0", "qty.2", "bare", "bare.0"] {
-            assert!(found(&fields, name), "{name}");
+    fn a_read_name_finds_a_field_or_a_group() {
+        let mut names = vec!["price", "row.1", "row.2", "rows", "total"];
+        names.sort_unstable();
+        for name in ["price", "row", "row.1", "rows"] {
+            assert!(found(&names, name), "{name}");
         }
-        // Past a field's last widget there is no widget to find.
-        for name in ["pric", "ro", "row.3", "price.", "price.x", "price.-1", "price.+0", "price.1", "price.12", "qty.3", "bare.1", "total.0.1", ""] {
-            assert!(!found(&fields, name), "{name}");
+        // A widget name finds nothing: recalculation and getField don't resolve it either.
+        for name in ["pric", "ro", "row.3", "price.", "price.0", "price.12", "total.0.1", ""] {
+            assert!(!found(&names, name), "{name}");
         }
-        assert!(!found(&fields, "qty.99999999999999999999999"), "a number too big for usize is no widget");
     }
 
     /// Two thousand formulas each reading a group of two thousand fields would be four million
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index ae73da1a7d..0909132a0f 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -1727,7 +1727,8 @@ fn missing_fields_and_built_names_are_flagged() {
     let calculate = |c: Calculate| FieldProps { calculate: Some(c), ..FieldProps::default() };
     set_props(&mut doc, "sum", &calculate(Calculate::Simple { op: CalcOp::Sum, fields: vec!["qty".into(), "gone".into()] })).unwrap();
     set_props(&mut doc, "notation", &calculate(Calculate::Notation("qty * nope".into()))).unwrap();
-    // qty has one widget: qty.0 is it, and there is no qty.1.
+    // qty has one widget, but a widget name is no field: recalculation and getField give qty.0
+    // nothing, so it is as missing as qty.1.
     let script = "event.value = getField(\"qty\").value + getField(\"ghost\").value + getField(\"qty.0\").value + getField(\"qty.1\").value;";
     set_field_script(&mut doc, "script", "calculate", Some(script)).unwrap();
     set_field_script(&mut doc, "built", "calculate", Some("event.value = getField(\"qty\").value + getField(\"row\" + 1).value;")).unwrap();
@@ -1740,7 +1741,10 @@ fn missing_fields_and_built_names_are_flagged() {
         vec![
             ("sum".to_owned(), sum),
             ("notation".to_owned(), vec![MissingField { field: "nope".into() }]),
-            ("script".to_owned(), vec![MissingField { field: "ghost".into() }, MissingField { field: "qty.1".into() }]),
+            (
+                "script".to_owned(),
+                vec![MissingField { field: "ghost".into() }, MissingField { field: "qty.0".into() }, MissingField { field: "qty.1".into() }],
+            ),
             ("built".to_owned(), vec![BuiltNames]),
         ]
     };
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 952b70445c..3b7713a3da 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4679,7 +4679,7 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties", "form.calculation_order"]
 tools = ["form_set_props", "form_fill", "form_calculation_order"]
-evidence = ["crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/forms/src/tests.rs::the_calculation_order_is_checked_fixed_and_kept", "crates/forms/src/tests.rs::a_calculation_order_with_gaps_and_extra_entries", "crates/forms/src/tests.rs::two_fields_with_one_name_keep_their_places_in_the_order", "crates/engine/src/tests.rs::setting_the_calculation_order_recalculates_and_undoes", "crates/automation/tests/it/automation.rs::the_calculation_order_is_read_fixed_and_set", "crates/ui-egui/tests/it/prepare.rs::the_calculation_order_is_moved_dragged_and_fixed", "crates/engine/src/tests.rs::checkbox_and_rank_changes_recalculate_ordered_dependents", "crates/engine/src/tests.rs::dynamic_calculation_reads_and_side_effects_reach_later_fields", "crates/forms/src/tests.rs::missing_fields_and_built_names_are_flagged", "crates/forms/src/calc_order.rs::a_read_name_finds_a_field_a_group_or_a_widget", "crates/forms/src/af/tests.rs::names_built_at_run_time_are_noticed", "crates/automation/tests/it/automation.rs::the_calculation_order_shows_formulas_and_what_they_cannot_read", "crates/ui-egui/tests/it/prepare.rs::a_formula_reading_a_missing_field_has_its_own_card"]
+evidence = ["crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/forms/src/tests.rs::the_calculation_order_is_checked_fixed_and_kept", "crates/forms/src/tests.rs::a_calculation_order_with_gaps_and_extra_entries", "crates/forms/src/tests.rs::two_fields_with_one_name_keep_their_places_in_the_order", "crates/engine/src/tests.rs::setting_the_calculation_order_recalculates_and_undoes", "crates/automation/tests/it/automation.rs::the_calculation_order_is_read_fixed_and_set", "crates/ui-egui/tests/it/prepare.rs::the_calculation_order_is_moved_dragged_and_fixed", "crates/engine/src/tests.rs::checkbox_and_rank_changes_recalculate_ordered_dependents", "crates/engine/src/tests.rs::dynamic_calculation_reads_and_side_effects_reach_later_fields", "crates/forms/src/tests.rs::missing_fields_and_built_names_are_flagged", "crates/forms/src/calc_order.rs::a_read_name_finds_a_field_or_a_group", "crates/forms/src/af/tests.rs::names_built_at_run_time_are_noticed", "crates/automation/tests/it/automation.rs::the_calculation_order_shows_formulas_and_what_they_cannot_read", "crates/ui-egui/tests/it/prepare.rs::a_formula_reading_a_missing_field_has_its_own_card"]
 notes = "/CO order, then other calculated fields; recalculated after every fill and Clear form. Order editing: Prepare a form ▸ Calculation order lists the calculated fields in order with their formulas and values, Up/Down arrows (as Acrobat's Set Field Calculation Order dialog), Alt+Up/Down and drag, says which fields read a field calculated later, which read each other in a loop and which /CO leaves out, and Fix order moves only what must move; on the page it numbers each calculated field's step and draws arrows from the fields the focused field reads and to the fields that read it; form_calculation_order reads, sets, moves and fixes it. Each formula is also checked against the form: a read of a field the form doesn't have (a field deleted from under a sum, a typo in notation, a script's getField) and a script that builds the names it reads at run time are flagged, in form_calculation_order (which also gives each formula) and on the page: a red Missing field mark on the row and a card naming those formulas with a link to edit the first (no all-clear while one is broken), a grey note for built names, and both in the summary above the page. A new calculation joins the end of /CO and an edited one keeps its place. Acrobat's dialog is known from Adobe's help summary only, not yet observed."
 
 [[feature]]

From 49d5c40356f3bd77fa8005d2aa0f7736908f193a Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 16:40:04 +0100
Subject: [PATCH 213/270] M6: calculation checks: a row or widget in focus is
 its own field, not the first of its name

The page's focus was a name, so with two fields called total (a
malformed form) hovering the second one's row showed the first one's
missing fields in the pill, and outlined and numbered both on the page.
A row and a widget under the pointer now carry their field object: the
pill says that field's reads and issues, and the page outlines it, its
step and the formulas that read it by object. The Prepare selection is
still only a name, so it stands for every field of that name and the
pill says all of their issues (from FredApps's review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/ui-egui/src/canvas.rs              |   6 +-
 crates/ui-egui/src/tools/calc_order_ui.rs | 207 +++++++++++++++++-----
 2 files changed, 164 insertions(+), 49 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 91d2c41367..6de219e893 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -914,7 +914,7 @@ struct PageFrame<'a> {
     current_overlap: f32,
     current_height: f32,
     pressed_page: Option<usize>,
-    calc_hover: Option<String>,
+    calc_hover: Option<crate::calc_order_ui::Focus>,
 }
 
 /// Visible heights (points) closer than this are equal: one page size can meet the viewport a
@@ -1586,8 +1586,8 @@ fn page_overlays(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_
         }
         if calc_order {
             let selected = view.prepare.selected.as_ref().map(|(name, _)| name.as_str());
-            if let Some(name) = crate::calc_order_ui::paint_page(tool_cx, form, &view.calc_order, generation, selected) {
-                frame.calc_hover = Some(name);
+            if let Some(field) = crate::calc_order_ui::paint_page(tool_cx, form, &view.calc_order, generation, selected) {
+                frame.calc_hover = Some(field);
             }
         }
     } else {
diff --git a/crates/ui-egui/src/tools/calc_order_ui.rs b/crates/ui-egui/src/tools/calc_order_ui.rs
index d2b952df3e..932420e663 100644
--- a/crates/ui-egui/src/tools/calc_order_ui.rs
+++ b/crates/ui-egui/src/tools/calc_order_ui.rs
@@ -18,6 +18,7 @@ use crate::canvas::PageToolContext;
 use crate::theme::{self, Tokens};
 use crate::{LeftPanel, PdfCraftApp, icons, widgets};
 use egui::{Align2, Color32, CornerRadius, Pos2, Rect, Sense, Shape, Stroke, Vec2, pos2, vec2};
+use pdfcraft_cos::ObjRef;
 use pdfcraft_engine::form_scripts::{CalcOp, Calculate, format_value};
 use pdfcraft_engine::{CalculatedField, CalculationIssue, CalculationOrder, Edit, FormField, FormFieldKind};
 
@@ -54,9 +55,9 @@ enum Tone {
 pub struct CalcOrderView {
     cache: Option<(u64, Arc<Listed>)>,
     /// The field whose row is under the pointer, this frame.
-    hover_row: Option<String>,
+    hover_row: Option<Focus>,
     /// The field under the pointer on the page, last frame.
-    hover_page: Option<String>,
+    hover_page: Option<Focus>,
     /// Links on page is off.
     hide_links: bool,
     /// The selected field the list last scrolled to, so a new selection (on the page too) brings
@@ -88,9 +89,47 @@ struct Row {
 struct Link {
     from: String,
     to: String,
+    /// The calculated field `to` names, whose formula reads `from`.
+    reader: ObjRef,
     tone: Tone,
 }
 
+/// The field in focus: its name, and its object when the focus is one field (its row, or its
+/// widget on the page). The Prepare selection has only a name, so it stands for every field of
+/// that name: two fields can share a name in a malformed form.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Focus {
+    name: String,
+    obj: Option<ObjRef>,
+}
+
+impl Focus {
+    fn named(name: &str) -> Self {
+        Self { name: name.to_owned(), obj: None }
+    }
+
+    /// A calculated field's row.
+    fn row(f: &CalculatedField) -> Self {
+        Self { name: f.name.clone(), obj: Some(f.obj) }
+    }
+
+    /// Whether field `name`, object `obj`, is in focus.
+    fn is(&self, name: &str, obj: ObjRef) -> bool {
+        self.name == name && self.obj.is_none_or(|o| o == obj)
+    }
+
+    /// `l` brings a value into the focus: its formula reads `l.from`.
+    fn reads(&self, l: &Link) -> bool {
+        self.is(&l.to, l.reader)
+    }
+
+    /// `l` takes the focus's value to a formula. A formula reads by name, so it reads every field
+    /// of the focus's name alike.
+    fn read_by(&self, l: &Link) -> bool {
+        l.from == self.name
+    }
+}
+
 impl CalcOrderView {
     fn listed(&mut self, doc: &pdfcraft_engine::Document) -> Arc<Listed> {
         let generation = doc.edit_generation();
@@ -112,13 +151,13 @@ impl CalcOrderView {
     }
 
     /// The field under the pointer on the page, for the next frame.
-    pub(crate) fn set_hover_page(&mut self, name: Option<String>) {
-        self.hover_page = name;
+    pub(crate) fn set_hover_page(&mut self, field: Option<Focus>) {
+        self.hover_page = field;
     }
 
     /// The field whose links show: under the pointer in the list or on the page, else selected.
-    fn focus(&self, selected: Option<&str>) -> Option<String> {
-        self.hover_row.clone().or_else(|| self.hover_page.clone()).or_else(|| selected.map(str::to_owned))
+    fn focus(&self, selected: Option<&str>) -> Option<Focus> {
+        self.hover_row.clone().or_else(|| self.hover_page.clone()).or_else(|| selected.map(Focus::named))
     }
 }
 
@@ -200,7 +239,7 @@ fn links(calculated: &[CalculatedField], mut names: Vec<&str>) -> Vec<Link> {
                 } else {
                     Tone::Ok
                 };
-                out.push(Link { from: from.to_owned(), to: c.name.clone(), tone });
+                out.push(Link { from: from.to_owned(), to: c.name.clone(), reader: c.obj, tone });
             }
         }
     }
@@ -256,25 +295,31 @@ fn names(list: &[&str]) -> String {
 }
 
 /// What the focused field reads and what reads it: "total reads sub and tax · No field reads it".
-/// `calculated` is the focus in the order, if it calculates: the fields it reads that the form
-/// doesn't have, and names its script builds as it runs, are said too.
-fn trace(links: &[Link], focus: &str, calculated: Option<&CalculatedField>) -> String {
+/// If the focus calculates (its fields in the order's `calculated`), the fields it reads that the
+/// form doesn't have, and names its script builds as it runs, are said too.
+fn trace(links: &[Link], focus: &Focus, calculated: &[CalculatedField]) -> String {
     let lang = crate::i18n::current();
     let mut reads: Vec<&str> = Vec::new();
     let mut read_by: Vec<&str> = Vec::new();
     for l in links {
-        if l.to == focus && !reads.contains(&l.from.as_str()) {
+        if focus.reads(l) && !reads.contains(&l.from.as_str()) {
             reads.push(&l.from);
         }
-        if l.from == focus && !read_by.contains(&l.to.as_str()) {
+        if focus.read_by(l) && !read_by.contains(&l.to.as_str()) {
             read_by.push(&l.to);
         }
     }
-    let issues = calculated.map(|c| c.issues.as_slice()).unwrap_or_default();
-    let missing: Vec<&str> =
-        issues.iter().filter_map(|i| if let CalculationIssue::MissingField { field } = i { Some(field.as_str()) } else { None }).collect();
-    let built = issues.contains(&CalculationIssue::BuiltNames);
+    let (mut missing, mut said): (Vec<&str>, HashSet<&str>) = (Vec::new(), HashSet::new());
+    let mut built = false;
+    for issue in calculated.iter().filter(|c| focus.is(&c.name, c.obj)).flat_map(|c| &c.issues) {
+        match issue {
+            CalculationIssue::MissingField { field } if said.insert(field) => missing.push(field),
+            CalculationIssue::BuiltNames => built = true,
+            _ => {}
+        }
+    }
     reads.extend(&missing);
+    let focus = focus.name.as_str();
     let mut parts = vec![if !reads.is_empty() {
         crate::i18n::fmt(tl!("{field} reads {fields}"), &[("field", focus), ("fields", &names(&reads))])
     } else if built {
@@ -661,14 +706,14 @@ pub(crate) fn panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
             }
             let pointed = ui.rect_contains_pointer(rect);
             if pointed {
-                hover_row = Some(f.name.clone());
+                hover_row = Some(Focus::row(f));
             }
             let visible = ui.is_rect_visible(rect);
             // The arrows' column, kept for every row so nothing moves when they show.
             let arrows_x = rect.right() - 26.0;
             if visible {
                 let press = theme::Press::track(ui, &resp);
-                if !is_selected && focus_page.as_deref() == Some(f.name.as_str()) {
+                if !is_selected && focus_page.as_ref().is_some_and(|p| p.is(&f.name, f.obj)) {
                     ui.painter().rect_filled(rect, CornerRadius::same(8), t.hover);
                 }
                 press.wash(ui, rect, 8, is_selected);
@@ -815,6 +860,16 @@ pub(crate) fn panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
     }
 }
 
+/// The focus's links, and whether a field is at either end of one or is the focus itself: the
+/// fields it reads go by name, as a read name stands for every field of that name, and the
+/// formulas that read it by object.
+fn focus_links<'a>(links: &'a [Link], focus: &'a Focus) -> (Vec<&'a Link>, impl Fn(&str, ObjRef) -> bool + 'a) {
+    let shown: Vec<&Link> = links.iter().filter(|l| focus.reads(l) || focus.read_by(l)).collect();
+    let names: HashSet<&str> = shown.iter().filter(|l| focus.reads(l)).map(|l| l.from.as_str()).collect();
+    let readers: HashSet<ObjRef> = shown.iter().filter(|l| focus.read_by(l)).map(|l| l.reader).collect();
+    (shown, move |name: &str, obj: ObjRef| focus.is(name, obj) || names.contains(name) || readers.contains(&obj))
+}
+
 /// The calculation order on page `page`: the links of the field in focus, with the fields it has
 /// nothing to do with faded, and the steps of the focus and its linked fields; with nothing in
 /// focus, the steps of the fields whose place is wrong. A form with many calculations stays
@@ -825,48 +880,50 @@ pub(crate) fn paint_page(
     view: &CalcOrderView,
     generation: u64,
     selected: Option<&str>,
-) -> Option<String> {
+) -> Option<Focus> {
     let PageToolContext { ui, xf, page, info, ptr, .. } = cx;
     let painter = ui.painter();
     let pointer = ptr.pos;
     let listed = view.current(generation)?;
     // Each field's first widget on this page.
-    let mut on_page: Vec<(&str, Rect)> = Vec::new();
+    let mut on_page: Vec<(&str, ObjRef, Rect)> = Vec::new();
     for f in form {
         if let Some(w) = f.widgets.iter().find(|w| w.page == Some(page) && !w.hidden) {
             let r = w.rect;
-            on_page.push((&f.name, xf.user_rect(info, page, [r[0] as f32, r[1] as f32, r[2] as f32, r[3] as f32])));
+            on_page.push((&f.name, f.obj, xf.user_rect(info, page, [r[0] as f32, r[1] as f32, r[2] as f32, r[3] as f32])));
         }
     }
     if on_page.is_empty() {
         return None;
     }
-    let hovered = pointer.and_then(|p| on_page.iter().rev().find(|(_, r)| r.contains(p))).map(|(n, _)| (*n).to_owned());
-    let at: HashMap<&str, Rect> = on_page.iter().copied().collect();
+    let hovered = pointer
+        .and_then(|p| on_page.iter().rev().find(|(_, _, r)| r.contains(p)))
+        .map(|(name, obj, _)| Focus { name: (*name).to_owned(), obj: Some(*obj) });
+    // Arrows start at a read name's field (one of them, if fields share it) and end at the formula's.
+    let by_name: HashMap<&str, Rect> = on_page.iter().map(|(name, _, r)| (*name, *r)).collect();
+    let by_obj: HashMap<ObjRef, Rect> = on_page.iter().map(|(_, obj, r)| (*obj, *r)).collect();
     let zoom = xf.zoom().clamp(0.5, 3.0);
     let focus = if view.hide_links { None } else { view.focus(selected) };
-    // The focus's links, and the fields at either end of them (with the focus itself).
-    let shown: Vec<&Link> = focus.as_deref().map(|f| listed.links.iter().filter(|l| l.from == f || l.to == f).collect()).unwrap_or_default();
-    let related: Option<HashSet<&str>> = focus.as_deref().map(|f| shown.iter().flat_map(|l| [l.from.as_str(), l.to.as_str()]).chain([f]).collect());
-    if let (Some(focus), Some(related)) = (focus.as_deref(), &related) {
-        for (name, r) in &on_page {
-            if !related.contains(name) {
+    let focused = focus.as_ref().map(|f| focus_links(&listed.links, f));
+    if let (Some(focus), Some((shown, related))) = (&focus, &focused) {
+        for (name, obj, r) in &on_page {
+            if !related(name, *obj) {
                 painter.rect_filled(r.expand(1.0), CornerRadius::ZERO, Color32::from_white_alpha(150));
             } else {
-                let width = if *name == focus { 2.0 } else { 1.0 };
+                let width = if focus.is(name, *obj) { 2.0 } else { 1.0 };
                 painter.rect_stroke(r.expand(1.0), CornerRadius::same(2), Stroke::new(width, LINK_OK), egui::StrokeKind::Outside);
             }
         }
-        for l in &shown {
-            if let (Some(a), Some(b)) = (at.get(l.from.as_str()), at.get(l.to.as_str())) {
+        for l in shown {
+            if let (Some(a), Some(b)) = (by_name.get(l.from.as_str()), by_obj.get(&l.reader)) {
                 arrow(painter, *a, *b, l.tone, zoom);
             }
         }
     }
     for (k, (f, row)) in listed.order.fields.iter().zip(&listed.rows).enumerate() {
-        let Some(r) = at.get(f.name.as_str()) else { continue };
-        let shown = match &related {
-            Some(related) => related.contains(f.name.as_str()),
+        let Some(r) = by_obj.get(&f.obj) else { continue };
+        let shown = match &focused {
+            Some((_, related)) => related(f.name.as_str(), f.obj),
             None => row.tone != Tone::Ok || !f.listed,
         };
         if !shown {
@@ -948,7 +1005,7 @@ pub(crate) fn paint_trace(ui: &egui::Ui, painter: &egui::Painter, viewport: Rect
     }
     let (Some(listed), Some(focus)) = (view.current(generation), view.focus(selected)) else { return };
     let t = Tokens::get(ui.ctx());
-    let text = trace(&listed.links, &focus, listed.order.fields.iter().find(|f| f.name == focus));
+    let text = trace(&listed.links, &focus, &listed.order.fields);
     let font = theme::regular(12.0);
     // Clear of the floating tool strip at the view's left.
     let room = (viewport.width() - 220.0).max(0.0);
@@ -968,7 +1025,7 @@ mod tests {
     use super::*;
 
     fn field(name: &str, reads: &[&str], issues: Vec<CalculationIssue>) -> CalculatedField {
-        let obj = pdfcraft_cos::ObjRef { num: 0, generation: 0 };
+        let obj = ObjRef { num: 0, generation: 0 };
         CalculatedField { name: name.into(), obj, reads: reads.iter().map(|r| (*r).to_owned()).collect(), listed: true, issues }
     }
 
@@ -983,7 +1040,7 @@ mod tests {
     }
 
     fn link(from: &str, to: &str, tone: Tone) -> Link {
-        Link { from: from.into(), to: to.into(), tone }
+        Link { from: from.into(), to: to.into(), reader: ObjRef { num: 0, generation: 0 }, tone }
     }
 
     #[test]
@@ -1028,10 +1085,10 @@ mod tests {
     fn the_summary_says_what_a_field_reads_and_what_reads_it() {
         crate::i18n::set_current(crate::i18n::Lang::EN);
         let links = [link("sub", "total", Tone::Late), link("tax", "total", Tone::Ok), link("qty", "sub", Tone::Ok), link("sub", "tax", Tone::Ok)];
-        assert_eq!(trace(&links, "total", None), "total reads sub and tax · No field reads it");
-        assert_eq!(trace(&links, "sub", None), "sub reads qty · total and tax read it");
-        assert_eq!(trace(&links, "tax", None), "tax reads sub · total reads it");
-        assert_eq!(trace(&links, "qty", None), "qty reads no other field · sub reads it");
+        assert_eq!(trace(&links, &Focus::named("total"), &[]), "total reads sub and tax · No field reads it");
+        assert_eq!(trace(&links, &Focus::named("sub"), &[]), "sub reads qty · total and tax read it");
+        assert_eq!(trace(&links, &Focus::named("tax"), &[]), "tax reads sub · total reads it");
+        assert_eq!(trace(&links, &Focus::named("qty"), &[]), "qty reads no other field · sub reads it");
     }
 
     /// A field the form doesn't have is read too, and said to be missing; a script's names built
@@ -1042,13 +1099,71 @@ mod tests {
         let missing = |names: &[&str]| names.iter().map(|n| CalculationIssue::MissingField { field: (*n).into() }).collect::<Vec<_>>();
         let links = [link("qty", "sub", Tone::Ok), link("sub", "total", Tone::Ok), link("tax", "total", Tone::Ok)];
         let sub = field("sub", &["qty", "discount"], missing(&["discount"]));
-        assert_eq!(trace(&links, "sub", Some(&sub)), "sub reads qty and discount · discount is missing · total reads it");
+        assert_eq!(trace(&links, &Focus::named("sub"), &[sub]), "sub reads qty and discount · discount is missing · total reads it");
         let tax = field("tax", &["subtotl", "rate"], missing(&["subtotl", "rate"]));
-        assert_eq!(trace(&links, "tax", Some(&tax)), "tax reads subtotl and rate · subtotl and rate are missing · total reads it");
+        assert_eq!(trace(&links, &Focus::named("tax"), &[tax]), "tax reads subtotl and rate · subtotl and rate are missing · total reads it");
         let rows = field("rows", &[], vec![CalculationIssue::BuiltNames]);
-        assert_eq!(trace(&links, "rows", Some(&rows)), "rows reads fields named as it runs · No field reads it");
+        assert_eq!(trace(&links, &Focus::named("rows"), &[rows]), "rows reads fields named as it runs · No field reads it");
         let both = field("total", &["sub", "tax"], vec![CalculationIssue::BuiltNames]);
-        assert_eq!(trace(&links, "total", Some(&both)), "total reads sub and tax · Some names are built as it runs · No field reads it");
+        assert_eq!(trace(&links, &Focus::named("total"), &[both]), "total reads sub and tax · Some names are built as it runs · No field reads it");
+    }
+
+    /// Two calculated fields named `total`, as a malformed form can have, each reading a field the
+    /// form doesn't have, and `grand` reading `total`.
+    fn two_totals() -> ([CalculatedField; 3], Vec<Link>) {
+        let total = |num, reads: &[&str], gone: &str| CalculatedField {
+            obj: ObjRef { num, generation: 0 },
+            ..field("total", reads, vec![CalculationIssue::MissingField { field: gone.into() }])
+        };
+        let grand = CalculatedField { obj: ObjRef { num: 3, generation: 0 }, ..field("grand", &["total"], vec![]) };
+        let calculated = [total(1, &["qty", "lost"], "lost"), total(2, &["tax", "gone"], "gone"), grand];
+        let links = links(&calculated, vec!["qty", "tax", "total", "total", "grand"]);
+        (calculated, links)
+    }
+
+    /// Hovering a row of a field that shares its name says that field's reads and missing fields,
+    /// not the first one's of that name. The selection is only a name, so it says both.
+    #[test]
+    fn a_row_sharing_its_name_is_traced_by_its_field() {
+        crate::i18n::set_current(crate::i18n::Lang::EN);
+        let (calculated, links) = two_totals();
+        let mut view = CalcOrderView::default();
+        let mut said = Vec::new();
+        for f in &calculated {
+            view.hover_row = Some(Focus::row(f));
+            let focus = view.focus(Some("total")).expect("a hovered row is the focus");
+            said.push(trace(&links, &focus, &calculated));
+        }
+        assert_eq!(
+            said,
+            [
+                "total reads qty and lost · lost is missing · grand reads it",
+                "total reads tax and gone · gone is missing · grand reads it",
+                "grand reads total · No field reads it",
+            ]
+        );
+        view.hover_row = None;
+        let selected = view.focus(Some("total")).expect("the selection is the focus");
+        assert_eq!(selected, Focus::named("total"));
+        assert_eq!(trace(&links, &selected, &calculated), "total reads qty, tax, lost and gone · lost and gone are missing · grand reads it");
+    }
+
+    /// On the page too, a field that shares its name is outlined, and its arrows drawn, as one
+    /// field: the fields it reads by name, the formulas that read it by object.
+    #[test]
+    fn a_field_sharing_its_name_is_related_on_the_page_by_its_object() {
+        let (calculated, links) = two_totals();
+        let [first, second, grand] = calculated.each_ref().map(|f| f.obj);
+        let elsewhere = ObjRef { num: 9, generation: 0 };
+        let focus = Focus::row(&calculated[0]);
+        let (shown, related) = focus_links(&links, &focus);
+        assert!(shown.iter().all(|l| l.reader == first || l.to == "grand"), "{shown:?}");
+        assert!(related("total", first) && !related("total", second), "only the field in focus");
+        assert!(related("qty", elsewhere) && !related("tax", elsewhere), "only the fields it reads");
+        assert!(related("grand", grand), "the formula that reads it");
+        let selected = Focus::named("total");
+        let (_, related) = focus_links(&links, &selected);
+        assert!(related("total", first) && related("total", second) && related("tax", elsewhere), "a selected name is every field of it");
     }
 
     /// A missing field outranks a loop on the row, but the field is still in its loop.

From 1808720d751d4a699ac6ad688814f25af6798615 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 17:12:41 +0100
Subject: [PATCH 214/270] M6: calculation checks: an AFSimple string list with
 an argument after it is read and renamed, as an array is

AFSimple_Calculate("SUM", "a, b", x) gave only a built-name site, so a
rename no longer rewrote a and b (main did) while parse_calculate still
read the sum of a and b: after a rename the sum read missing fields. The
string list now keeps its names when an argument follows, and what
follows is a name built at run time, as for an array (from the review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/forms/src/af/calc.rs  | 7 +++++--
 crates/forms/src/af/tests.rs | 6 ++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/crates/forms/src/af/calc.rs b/crates/forms/src/af/calc.rs
index c6556476a6..d29956cbc2 100644
--- a/crates/forms/src/af/calc.rs
+++ b/crates/forms/src/af/calc.rs
@@ -278,10 +278,13 @@ fn calculation_sites(js: &str) -> Vec<(Range<usize>, Site)> {
             continue;
         }
         // One string of comma-separated names, when it is the whole list (not `"row" + suffix`).
+        // An argument after it leaves the list as written, as after an array: its names are read,
+        // and what follows is a name built at run time.
         if let Some((range, list)) = string(k + 4) {
-            if punct(k + 5, ')') {
+            if punct(k + 5, ')') || punct(k + 5, ',') {
                 sites.push((range, Site::Commas(list)));
-            } else {
+            }
+            if !punct(k + 5, ')') {
                 sites.extend(built(k));
             }
             continue;
diff --git a/crates/forms/src/af/tests.rs b/crates/forms/src/af/tests.rs
index 50b3029ada..851c5c032e 100644
--- a/crates/forms/src/af/tests.rs
+++ b/crates/forms/src/af/tests.rs
@@ -199,6 +199,12 @@ fn names_built_at_run_time_are_noticed() {
     let js = "event.value = getField(\"a\").value + getField(\"row\" + i).value + AFSimple_Calculate(\"SUM\", new Array(\"a\", b));";
     assert_eq!(calculation_reads(js), ["a"]);
     assert_eq!(rename_in_calculation(js, "a", "qty"), Some(js.replace("\"a\"", "\"qty\"")));
+    // So are a list's, string or array, with another argument after it.
+    for js in ["AFSimple_Calculate(\"SUM\", \"a, b\", x);", "AFSimple_Calculate(\"SUM\", [\"a\", \"b\"], x);"] {
+        assert!(reads_built_names(js), "{js}");
+        assert_eq!(calculation_reads(js), ["a", "b"], "{js}");
+        assert_eq!(rename_in_calculation(js, "a", "qty"), Some(js.replace("\"a", "\"qty")), "{js}");
+    }
 }
 
 /// Scripts are read in one pass: a line of unfinished regular expressions, or calls nested in

From 50faef001aea8d8d5835d94a2d6ab4b6e8f8c097 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 17:12:41 +0100
Subject: [PATCH 215/270] M6: calculation checks: CalculatedField::issues says
 it covers the formula too

MissingField and BuiltNames are about the formula, not its place in the
order.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/forms/src/calc_order.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/forms/src/calc_order.rs b/crates/forms/src/calc_order.rs
index cbafd296e2..62c16ce67d 100644
--- a/crates/forms/src/calc_order.rs
+++ b/crates/forms/src/calc_order.rs
@@ -25,7 +25,7 @@ pub struct CalculatedField {
     pub reads: Vec<String>,
     /// `/CO` lists it. A field it leaves out calculates after the listed ones.
     pub listed: bool,
-    /// What is wrong with its place in the order.
+    /// What is wrong with its formula or its place in the order.
     pub issues: Vec<CalculationIssue>,
 }
 

From c97bf570292b091a7319cd69501226cf2c215979 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 17:12:41 +0100
Subject: [PATCH 216/270] M6: form_set_props refuses unknown, mistyped and
 conflicting keys in calculate and validate

A notation beside op and fields set the notation and dropped the rest, a
field name that wasn't a string was left out, a misspelt key was ignored,
and validate {"min": 0, "max": "100"} wrote a min-only range. Each is
now refused and nothing changes. A null bound, as form_fields shows the
one a range doesn't have, is no bound, so its output is taken back.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/automation/src/forms.rs           | 32 ++++++++++++++----
 crates/automation/src/tools.rs           |  2 +-
 crates/automation/tests/it/automation.rs | 41 ++++++++++++++++++++++++
 3 files changed, 68 insertions(+), 7 deletions(-)

diff --git a/crates/automation/src/forms.rs b/crates/automation/src/forms.rs
index 649366de55..78da146fa0 100644
--- a/crates/automation/src/forms.rs
+++ b/crates/automation/src/forms.rs
@@ -94,13 +94,20 @@ fn look_arg(v: &Value) -> Result<pdfcraft_engine::FieldLookPatch> {
     })
 }
 
-/// `{"min": 0, "max": 100}` or `"none"`.
+/// `{"min": 0, "max": 100}` or `"none"`. A null bound is no bound, as `form_fields` shows it.
 fn validate_arg(v: &Value) -> Result<Validate> {
     if v.as_str() == Some("none") {
         return Ok(Validate::None);
     }
     let o = v.as_object().ok_or_else(|| bad("validate must be {\"min\": …, \"max\": …} or \"none\""))?;
-    let (min, max) = (o.get("min").and_then(Value::as_f64), o.get("max").and_then(Value::as_f64));
+    if let Some(k) = o.keys().find(|k| !matches!(k.as_str(), "min" | "max")) {
+        return Err(bad(format!("unknown key {k:?} in validate (min, max)")));
+    }
+    let bound = |k: &str| match o.get(k) {
+        None | Some(Value::Null) => Ok(None),
+        Some(x) => x.as_f64().map(Some).ok_or_else(|| bad(format!("validate {k} must be a number"))),
+    };
+    let (min, max) = (bound("min")?, bound("max")?);
     if min.is_none() && max.is_none() {
         return Err(bad("validate needs min, max or both"));
     }
@@ -117,18 +124,31 @@ fn calculate_arg(v: &Value) -> Result<Calculate> {
     if o.contains_key("script") {
         return Err(bad("a custom calculate script is set with form_set_script (event: calculate)"));
     }
-    if let Some(n) = o.get("notation").and_then(Value::as_str) {
+    if let Some(k) = o.keys().find(|k| !matches!(k.as_str(), "op" | "fields" | "notation")) {
+        return Err(bad(format!("unknown key {k:?} in calculate (op and fields, or notation)")));
+    }
+    // A null is no value, as for the tool's own arguments.
+    let get = |k: &str| o.get(k).filter(|v| !v.is_null());
+    if let Some(n) = get("notation") {
+        if get("op").is_some() || get("fields").is_some() {
+            return Err(bad("calculate takes a notation, or op and fields, not both"));
+        }
+        let n = n.as_str().ok_or_else(|| bad("notation must be a string such as \"Price * Qty\""))?;
         return Ok(Calculate::Notation(n.to_string()));
     }
-    let op = match o.get("op").and_then(Value::as_str).unwrap_or("") {
+    let op = get("op").ok_or_else(|| bad("calculate needs op and fields, or a notation"))?;
+    let op = match op.as_str().ok_or_else(|| bad("op must be one of sum, product, average, min, max"))? {
         "minimum" => CalcOp::Minimum,
         "maximum" => CalcOp::Maximum,
         x => {
             CalcOp::ALL.into_iter().find(|&op| op_name(op) == x).ok_or_else(|| bad(format!("unknown op {x:?} (sum, product, average, min, max)")))?
         }
     };
-    let fields: Vec<String> =
-        o.get("fields").and_then(Value::as_array).map(|a| a.iter().filter_map(|x| x.as_str().map(str::to_owned)).collect()).unwrap_or_default();
+    let fields = get("fields").and_then(Value::as_array).ok_or_else(|| bad("calculate fields must be a list of field names"))?;
+    let fields: Vec<String> = fields
+        .iter()
+        .map(|x| x.as_str().map(str::to_owned).ok_or_else(|| bad("calculate fields must be field names (strings)")))
+        .collect::<Result<_>>()?;
     if fields.is_empty() {
         return Err(bad("calculate needs fields"));
     }
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index b41e114442..ceb64fa173 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -492,7 +492,7 @@ pub fn tools() -> Vec<ToolDef> {
                 "rotation": { "type": "integer", "enum": [0, 90, 180, 270], "description": "Widget rotation in degrees, counterclockwise. Changing between horizontal and vertical swaps the rectangle around its center." },
                 "appearance": { "type": "object", "description": "Appearance tab: border, fill, text_color (#RRGGBB, a name or \"none\"), width (0–12 points; 1 thin, 2 medium, 3 thick), style (solid, dashed, beveled, inset, underline), font (helvetica, times, courier)." },
                 "format": { "description": "Format tab: {\"type\": \"number\", \"decimals\": 2, \"currency\": \"$\", \"separator\": 0-4, \"negative\": 0-3}, {\"type\": \"percent\"}, {\"type\": \"date\"|\"time\", \"pattern\": \"mm/dd/yyyy\"}, {\"type\": \"zip\"|\"zip4\"|\"phone\"|\"ssn\"}, {\"type\": \"mask\", \"mask\": \"AA-9999\"}, or \"none\"." },
-                "validate": { "description": "Validate tab: {\"min\": 0, \"max\": 100} (either may be left out) or \"none\"." },
+                "validate": { "description": "Validate tab: {\"min\": 0, \"max\": 100} (either may be left out, or null) or \"none\"." },
                 "calculate": { "description": "Calculate tab: {\"op\": \"sum\"|\"product\"|\"average\"|\"min\"|\"max\", \"fields\": [\"a\", \"b\"]}, {\"notation\": \"Price * Qty\"} (simplified field notation), or \"none\"." },
             }),
             &["doc"],
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 7778108cb8..6745c895cb 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -5153,6 +5153,47 @@ fn every_calculation_op_can_be_read_and_given_back() {
     }
 }
 
+/// form_set_props refuses a calculate or validate it would only partly apply (a key it doesn't
+/// know, a value of the wrong type, a notation beside op and fields) and changes nothing. A
+/// validate read back from form_fields, with null for the bound it doesn't have, is taken back.
+#[test]
+fn calculate_and_validate_refuse_what_they_would_drop() {
+    let dir = workdir("calcstrict");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    for (name, y) in [("a", 20), ("b", 60), ("total", 100)] {
+        ok(&mut a, "form_add_field", json!({ "doc": doc, "page": 1, "type": "text", "rect": [20, y, 180, y + 22], "name": name }));
+    }
+    let set = json!({ "op": "sum", "fields": ["a", "b"] });
+    ok(&mut a, "form_set_props", json!({ "doc": doc, "field": "total", "calculate": set, "validate": { "min": 0, "max": 10 } }));
+    let total = |a: &mut Automation| {
+        let fields = ok(a, "form_fields", json!({ "doc": doc }));
+        fields["fields"].as_array().unwrap().iter().find(|f| f["name"] == "total").unwrap().clone()
+    };
+    for (calculate, says) in [
+        (json!({ "notation": "a", "op": "sum", "fields": ["b"] }), "not both"),
+        (json!({ "op": "sum", "fields": ["a", 5] }), "field names"),
+        (json!({ "op": "sum", "fields": "a" }), "list of field names"),
+        (json!({ "notation": 5 }), "notation must be a string"),
+        (json!({ "op": 5, "fields": ["a"] }), "op must be"),
+        (json!({ "fields": ["a"] }), "needs op"),
+        (json!({ "op": "sum", "feilds": ["a"] }), "unknown key \"feilds\""),
+    ] {
+        let e = err(&mut a, "form_set_props", json!({ "doc": doc, "field": "total", "calculate": calculate }));
+        assert!(e.to_string().contains(says), "{calculate}: {e}");
+    }
+    for (validate, says) in [(json!({ "min": 0, "max": "100" }), "max must be a number"), (json!({ "min": 0, "mxa": 5 }), "unknown key \"mxa\"")] {
+        let e = err(&mut a, "form_set_props", json!({ "doc": doc, "field": "total", "validate": validate }));
+        assert!(e.to_string().contains(says), "{validate}: {e}");
+    }
+    let t = total(&mut a);
+    assert_eq!((&t["calculate"], &t["validate"]), (&set, &json!({ "min": 0.0, "max": 10.0 })), "nothing changed");
+    ok(&mut a, "form_set_props", json!({ "doc": doc, "field": "total", "validate": { "min": null, "max": 5 } }));
+    let shown = total(&mut a)["validate"].clone();
+    assert_eq!(shown, json!({ "min": null, "max": 5.0 }));
+    ok(&mut a, "form_set_props", json!({ "doc": doc, "field": "total", "validate": shown }));
+}
+
 #[test]
 fn page_tab_orders_are_read_and_set_per_page_through_tools() {
     let dir = workdir("pagetabs");

From 50a4a19a1ad058405ce6a77cee903178231af1f8 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 17:12:41 +0100
Subject: [PATCH 217/270] M6: calculation checks: Finnish and Persian text

Both translate the neighbouring Calculation order rows; Finnish had
English copies of the new ones, and Persian came in with main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/ui-egui/src/i18n/fa.tsv | 11 +++++++++++
 crates/ui-egui/src/i18n/fi.tsv | 23 +++++++++++------------
 2 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/crates/ui-egui/src/i18n/fa.tsv b/crates/ui-egui/src/i18n/fa.tsv
index 5cfc217533..21efeb6444 100644
--- a/crates/ui-egui/src/i18n/fa.tsv
+++ b/crates/ui-egui/src/i18n/fa.tsv
@@ -538,6 +538,12 @@
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	{names} را می‌خواند که به نوبه خود آن را می‌خوانند. هیچ ترتیبی حلقه را اصلاح نمی‌کند: یکی از فرمول‌ها را تغییر دهید.
 	Not in order	نامرتب
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	در ترتیب محاسب‌های که در PDF ذخیره شده وجود ندارد: سایر نمایشگر‌های PDF ممکن است آن را محاسبه نکنند.
+	Reads {name}, which the form doesn't have, so it gets no value there.	{name} را می‌خواند که در فرم وجود ندارد، پس از آن مقداری نمی‌گیرد.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	اسکریپت آن فیلد‌هایی را هم می‌خواند که نامشان را هنگام اجرا می‌سازد، پس این خواندن‌ها قابل بررسی نیستند.
+	Missing field	فیلد ناموجود
+	Unchecked reads	خواندن‌های بررسی‌نشده
+	{field} reads fields named as it runs	{field} فیلد‌هایی را می‌خواند که نامشان هنگام اجرا ساخته می‌شود
+	Some names are built as it runs	برخی نام‌ها هنگام اجرا ساخته می‌شوند
 	Back to Prepare a form	بازگشت به آماده‌سازی فرم
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	هنوز هیچ فیلدی در این فرم مقدارش را محاسبه نمی‌کند. به یک فیلد در برگه محاسبه از ویژگی‌هایش یک محاسبه بدهید تا اینجا نمایش داده شود.
 	{names} and {last}	{names} و {last}
@@ -2514,6 +2520,11 @@ animation effects	Off	خاموش
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} پیش از {fields} محاسبه می‌شود، در حالی که آن را می‌خواند.|{field} پیش از {fields} محاسبه می‌شود، در حالی که آن‌ها را می‌خواند.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	{n} فیلد دیگر زود‌تر از موعد محاسبه می‌شود.|{n} فیلد دیگر زود‌تر از موعد محاسبه می‌شوند.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} در ترتیب ذخیره‌شده در PDF وجود ندارد، بنابراین سایر نمایشگر‌های PDF ممکن است آن را محاسبه نکنند.|{fields} در ترتیب ذخیره‌شده در PDF وجود ندارند، بنابراین سایر نمایشگر‌های PDF ممکن است آن‌ها را محاسبه نکنند.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} فرمول فیلدی را می‌خواند که در فرم وجود ندارد|{n} فرمول فیلد‌هایی را می‌خوانند که در فرم وجود ندارند
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} {fields} را می‌خواند که در فرم وجود ندارد.|{field} {fields} را می‌خواند که در فرم وجود ندارند.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} فرمول دیگر یک فیلد ناموجود را می‌خواند.|{n} فرمول دیگر فیلد‌های ناموجود را می‌خوانند.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} برخی نام‌های فیلد را هنگام اجرا می‌سازد، پس این خواندن‌ها بررسی نمی‌شوند.|{fields} برخی نام‌های فیلد را هنگام اجرا می‌سازند، پس این خواندن‌ها بررسی نمی‌شوند.
+@plural	{fields} is missing|{fields} are missing	{fields} وجود ندارد|{fields} وجود ندارند
 	Scan	اسکن
 	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	روی یک برگ کاغذ سفید امضا کنید و از آن در نور روشن و یکنواخت عکس بگیرید (از فلاش استفاده کنید). عکس را انتخاب کنید یا آن را اینجا رها کنید: PdfCraft امضا را پیدا می‌کند و کاغذ را حذف می‌کند.
 	Choose photo…	انتخاب عکس…
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index 1d4e6c7d79..e18d18d560 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -2732,6 +2732,12 @@ theme	Appearance	Teema
 	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	Lukee kenttiä {names}, jotka lukevat sitä takaisin. Mikään järjestys ei korjaa silmukkaa: muuta jotakin kaavoista.
 	Not in order	Ei järjestyksessä
 	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	Puuttuu PDF:ään tallennetusta laskentajärjestyksestä: muut PDF-katseluohjelmat eivät ehkä laske sitä.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Lukee kenttää {name}, jota lomakkeessa ei ole, joten se ei saa siitä arvoa.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Sen komentosarja lukee myös kenttiä, joiden nimet se muodostaa suorituksen aikana, joten näitä viittauksia ei voi tarkistaa.
+	Missing field	Puuttuva kenttä
+	Unchecked reads	Tarkistamattomat viittaukset
+	{field} reads fields named as it runs	{field} lukee kenttiä, joiden nimet muodostuvat suorituksen aikana
+	Some names are built as it runs	Osa nimistä muodostuu suorituksen aikana
 	Back to Prepare a form	Takaisin kohtaan Valmistele lomake
 	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	Mikään tämän lomakkeen kenttä ei vielä laske arvoaan. Anna kentälle laskenta sen ominaisuuksien Laskenta-välilehdellä, niin se näkyy tässä.
 	{names} and {last}	{names} ja {last}
@@ -2759,6 +2765,11 @@ theme	Appearance	Teema
 @plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} lasketaan ennen lukemaansa kenttää {fields}.|{field} lasketaan ennen lukemiaan kenttiä {fields}.
 @plural	{n} more field calculates too early.|{n} more fields calculate too early.	{n} muu kenttä lasketaan liian aikaisin.|{n} muuta kenttää lasketaan liian aikaisin.
 @plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} puuttuu PDF:ään tallennetusta järjestyksestä, joten muut PDF-katseluohjelmat eivät ehkä laske sitä.|{fields} puuttuvat PDF:ään tallennetusta järjestyksestä, joten muut PDF-katseluohjelmat eivät ehkä laske niitä.
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} kaava lukee kenttää, jota lomakkeessa ei ole|{n} kaavaa lukee kenttiä, joita lomakkeessa ei ole
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} lukee kenttää {fields}, jota lomakkeessa ei ole.|{field} lukee kenttiä {fields}, joita lomakkeessa ei ole.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} muu kaava lukee puuttuvaa kenttää.|{n} muuta kaavaa lukee puuttuvia kenttiä.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} muodostaa osan kenttien nimistä suorituksen aikana, joten näitä viittauksia ei tarkisteta.|{fields} muodostavat osan kenttien nimistä suorituksen aikana, joten näitä viittauksia ei tarkisteta.
+@plural	{fields} is missing|{fields} are missing	{fields} puuttuu|{fields} puuttuvat
 	Bulleted list	Luettelomerkit
 	Numbered list	Numeroitu luettelo
 	Alignment	Tasaus
@@ -2783,18 +2794,6 @@ theme	Appearance	Teema
 	The signature's signed attributes have no message digest, so the signature does not cover the document.	Allekirjoituksen allekirjoitetuista määritteistä puuttuu viestitiiviste, joten allekirjoitus ei kata asiakirjaa.
 	The signature's signed attributes name a content type other than data, so it is not a signature of the document.	Allekirjoituksen allekirjoitetut määritteet nimeävät muun sisältötyypin kuin data, joten se ei ole asiakirjan allekirjoitus.
 	Remove {standard} identification	Poista {standard}-tunniste
-# Untranslated: English text until a translator fills these in.
-	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
-	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
-	Missing field	Missing field
-	Unchecked reads	Unchecked reads
-	{field} reads fields named as it runs	{field} reads fields named as it runs
-	Some names are built as it runs	Some names are built as it runs
-@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have
-@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.
-@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} more formula reads a missing field.|{n} more formulas read missing fields.
-@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.
-@plural	{fields} is missing|{fields} are missing	{fields} is missing|{fields} are missing
 
 # Prepare a form ▸ Text field table (AI-assisted, not separately native-reviewed)
 	Add text field table	Lisää tekstikenttätaulukko

From fefb99a786a5533ab3d7bc160eb9594c8f9ebeab Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 17:12:41 +0100
Subject: [PATCH 218/270] M6: calculation checks: the page's steps are chosen
 by a function the tests reach

steps() takes the widgets by object, so each of two fields sharing a name
gets its own step; a test checks it, unfocused and with a focus (from the
review: no test failed with the step looked up by name).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/ui-egui/src/tools/calc_order_ui.rs | 53 ++++++++++++++++++-----
 1 file changed, 43 insertions(+), 10 deletions(-)

diff --git a/crates/ui-egui/src/tools/calc_order_ui.rs b/crates/ui-egui/src/tools/calc_order_ui.rs
index 932420e663..ce25d6c0a8 100644
--- a/crates/ui-egui/src/tools/calc_order_ui.rs
+++ b/crates/ui-egui/src/tools/calc_order_ui.rs
@@ -920,16 +920,9 @@ pub(crate) fn paint_page(
             }
         }
     }
-    for (k, (f, row)) in listed.order.fields.iter().zip(&listed.rows).enumerate() {
-        let Some(r) = by_obj.get(&f.obj) else { continue };
-        let shown = match &focused {
-            Some((_, related)) => related(f.name.as_str(), f.obj),
-            None => row.tone != Tone::Ok || !f.listed,
-        };
-        if !shown {
-            continue;
-        }
-        let fill = match row.tone {
+    let related = focused.as_ref().map(|(_, related)| related as Related<'_>);
+    for (k, r, tone) in steps(&listed, &by_obj, related) {
+        let fill = match tone {
             Tone::Ok => STEP,
             Tone::Late => LINK_LATE,
             Tone::Loop | Tone::Missing => LINK_LOOP,
@@ -943,6 +936,27 @@ pub(crate) fn paint_page(
     hovered
 }
 
+/// Whether a field, by name and object, is at an end of the focus's links or is the focus.
+type Related<'a> = &'a dyn Fn(&str, ObjRef) -> bool;
+
+/// The steps the page shows: each one's place in the order (from 0), the widget it goes on (its
+/// own field's, so fields that share a name each get theirs) and its tone. With a focus, the
+/// steps of the fields `related` to it; without one, those whose place is wrong.
+fn steps(listed: &Listed, by_obj: &HashMap<ObjRef, Rect>, related: Option<Related<'_>>) -> Vec<(usize, Rect, Tone)> {
+    listed
+        .order
+        .fields
+        .iter()
+        .zip(&listed.rows)
+        .enumerate()
+        .filter(|(_, (f, row))| match related {
+            Some(related) => related(&f.name, f.obj),
+            None => row.tone != Tone::Ok || !f.listed,
+        })
+        .filter_map(|(k, (f, row))| Some((k, *by_obj.get(&f.obj)?, row.tone)))
+        .collect()
+}
+
 /// Where a ray from `r`'s centre in direction `dir` (a unit vector) leaves `r`.
 fn edge(r: Rect, dir: Vec2) -> Pos2 {
     let half = r.size() / 2.0;
@@ -1166,6 +1180,25 @@ mod tests {
         assert!(related("total", first) && related("total", second) && related("tax", elsewhere), "a selected name is every field of it");
     }
 
+    /// Each step goes on its own field's widget: two fields named `total` get one each, and a
+    /// focus on one shows its step and its reader's, not the other's.
+    #[test]
+    fn a_step_goes_on_its_own_field_when_names_are_shared() {
+        let (calculated, links) = two_totals();
+        let [first, second, grand] = calculated.each_ref().map(|f| f.obj);
+        let at = |x: f32| Rect::from_min_size(pos2(x, 0.0), vec2(10.0, 10.0));
+        let by_obj = HashMap::from([(first, at(0.0)), (second, at(100.0)), (grand, at(200.0))]);
+        let rows = rows(&calculated, &[]);
+        let mut order = CalculationOrder::default();
+        order.fields = calculated.to_vec();
+        let listed = Listed { order, rows, links };
+        // Unfocused, the two broken formulas show their steps.
+        assert_eq!(steps(&listed, &by_obj, None), [(0, at(0.0), Tone::Missing), (1, at(100.0), Tone::Missing)]);
+        let focus = Focus::row(&calculated[0]);
+        let (_, related) = focus_links(&listed.links, &focus);
+        assert_eq!(steps(&listed, &by_obj, Some(&related)), [(0, at(0.0), Tone::Missing), (2, at(200.0), Tone::Ok)]);
+    }
+
     /// A missing field outranks a loop on the row, but the field is still in its loop.
     #[test]
     fn a_missing_field_marks_the_row_and_keeps_its_loop() {

From fd3634cc38f3859f9c784ea63812f6134fdbc258 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 17:27:08 +0100
Subject: [PATCH 219/270] M6: form_set_props refuses a notation it couldn't
 store as written
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A notation is kept in the script's /** BVCALC … EVCALC **/ comment and read
back from there. One holding EVCALC was stored cut short ("a EVCALC b"
read back as "a", and its JavaScript translation didn't parse), one
holding */ ended the comment, and an empty one became "event.value = ;".
form_set_props now refuses each (af::notation_storable: it has to read back
as itself). The test also pins a notation beside op alone and beside
fields alone (from the review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/automation/src/forms.rs           |  6 +++++-
 crates/automation/tests/it/automation.rs |  6 ++++++
 crates/forms/src/af.rs                   |  2 +-
 crates/forms/src/af/script.rs            |  9 +++++++++
 crates/forms/src/af/tests.rs             | 10 ++++++++++
 5 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/crates/automation/src/forms.rs b/crates/automation/src/forms.rs
index 78da146fa0..a9add477f2 100644
--- a/crates/automation/src/forms.rs
+++ b/crates/automation/src/forms.rs
@@ -1,7 +1,7 @@
 //! Form tools: list fields, fill them (several at once, one undo step), clear the form, and
 //! prepare a form (add fields one at a time or as a table, change and delete them).
 
-use pdfcraft_engine::form_scripts::{CalcOp, Calculate, Format, Validate};
+use pdfcraft_engine::form_scripts::{CalcOp, Calculate, Format, Validate, notation_storable};
 use pdfcraft_engine::{CalculationIssue, Edit, FieldProps, FieldValue, FormField, FormFieldKind, NewField, field_flags};
 use serde_json::{Value, json};
 
@@ -134,6 +134,10 @@ fn calculate_arg(v: &Value) -> Result<Calculate> {
             return Err(bad("calculate takes a notation, or op and fields, not both"));
         }
         let n = n.as_str().ok_or_else(|| bad("notation must be a string such as \"Price * Qty\""))?;
+        // Refused rather than stored as a different formula.
+        if !notation_storable(n) {
+            return Err(bad("the notation can't be stored as written: it is empty, or holds EVCALC or */, which would end it early"));
+        }
         return Ok(Calculate::Notation(n.to_string()));
     }
     let op = get("op").ok_or_else(|| bad("calculate needs op and fields, or a notation"))?;
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 6745c895cb..1504dee7a3 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -5172,6 +5172,12 @@ fn calculate_and_validate_refuse_what_they_would_drop() {
     };
     for (calculate, says) in [
         (json!({ "notation": "a", "op": "sum", "fields": ["b"] }), "not both"),
+        (json!({ "notation": "a", "op": "sum" }), "not both"),
+        (json!({ "notation": "a", "fields": ["b"] }), "not both"),
+        // A notation that wouldn't read back as itself from the script's comment.
+        (json!({ "notation": "a EVCALC b" }), "can't be stored"),
+        (json!({ "notation": "a */ x /*" }), "can't be stored"),
+        (json!({ "notation": " " }), "can't be stored"),
         (json!({ "op": "sum", "fields": ["a", 5] }), "field names"),
         (json!({ "op": "sum", "fields": "a" }), "list of field names"),
         (json!({ "notation": 5 }), "notation must be a string"),
diff --git a/crates/forms/src/af.rs b/crates/forms/src/af.rs
index 00cfc99d12..c83ce29cf3 100644
--- a/crates/forms/src/af.rs
+++ b/crates/forms/src/af.rs
@@ -22,7 +22,7 @@ use calc::{Notation, eval_notation, notation_name, notation_tokens, unique};
 pub use calc::{calculate, calculation_reads, notation_js, reads_built_names, rename_in_calculation};
 pub use format::{DATE_PRESETS, DateTime, TIME_PRESETS, format_date, format_value, js_number, keystroke, make_number, parse_date, validate};
 use script::{Arg, call};
-pub use script::{calculate_js, format_js, parse_calculate, parse_format, parse_validate, validate_js};
+pub use script::{calculate_js, format_js, notation_storable, parse_calculate, parse_format, parse_validate, validate_js};
 
 /// The Format tab.
 #[derive(Clone, Debug, PartialEq, Default)]
diff --git a/crates/forms/src/af/script.rs b/crates/forms/src/af/script.rs
index 9aed297b45..1544258a2c 100644
--- a/crates/forms/src/af/script.rs
+++ b/crates/forms/src/af/script.rs
@@ -325,6 +325,15 @@ pub fn validate_js(v: &Validate) -> Option<String> {
     }
 }
 
+/// Whether simplified field notation `expr` can be stored: the script keeps it in a comment,
+/// between `BVCALC` and `EVCALC`, and it has to read back from there as itself. An empty one, or
+/// one holding `EVCALC` or `*/` (either ends it early), can't.
+pub fn notation_storable(expr: &str) -> bool {
+    !expr.trim().is_empty()
+        && calculate_js(&Calculate::Notation(expr.to_owned())).and_then(|js| parse_calculate(&js))
+            == Some(Calculate::Notation(expr.trim().to_owned()))
+}
+
 pub fn calculate_js(c: &Calculate) -> Option<String> {
     match c {
         Calculate::None => None,
diff --git a/crates/forms/src/af/tests.rs b/crates/forms/src/af/tests.rs
index 851c5c032e..d0246d3016 100644
--- a/crates/forms/src/af/tests.rs
+++ b/crates/forms/src/af/tests.rs
@@ -217,6 +217,16 @@ fn hostile_scripts_are_read_in_one_pass() {
     assert_eq!(rename_in_calculation(&nested, "a", "b"), Some(format!("{}\"b\"", "AFSimple_Calculate(\"SUM\", new Array(".repeat(100_000))));
 }
 
+/// A notation is stored only when it reads back from the script's comment as itself.
+#[test]
+fn a_notation_is_stored_only_when_it_reads_back() {
+    assert!(notation_storable("Price * Qty"));
+    assert!(notation_storable("  a + b  "), "the spaces around it are left out when it is read");
+    for expr in ["", "  ", "a EVCALC b", "a */ x /*", "a */ b"] {
+        assert!(!notation_storable(expr), "{expr:?}");
+    }
+}
+
 /// Notation is read through one lexer: field names with escapes, numbers and operators.
 #[test]
 fn notation_is_read_by_one_lexer() {

From d7c8e6ad1bda51d6b374cc7b043ca12b2de9784e Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 17:37:58 +0100
Subject: [PATCH 220/270] M6: calculation checks: a notation's last name keeps
 the escaped space that ends it

parse_calculate trimmed the notation with str::trim, which also took an
escaped space ending its last name: "Qty * Total\ " read back as
"Qty * Total\", a field the form doesn't have, while the script's
JavaScript still read "Total ". It now trims to its first and last
token, as the field-reading scan does. notation_storable compares the
names and operators read back with those given, so a notation ending in
a lone \ (which escapes the space after it) is refused; a proptest reads
back notations of any names (from the review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/automation/src/forms.rs                |  4 +--
 .../forms/proptest-regressions/af/tests.txt   |  7 +++++
 crates/forms/src/af.rs                        |  2 +-
 crates/forms/src/af/script.rs                 | 28 ++++++++++++++-----
 crates/forms/src/af/tests.rs                  | 17 ++++++++++-
 5 files changed, 47 insertions(+), 11 deletions(-)
 create mode 100644 crates/forms/proptest-regressions/af/tests.txt

diff --git a/crates/automation/src/forms.rs b/crates/automation/src/forms.rs
index a9add477f2..eb38cb2b4e 100644
--- a/crates/automation/src/forms.rs
+++ b/crates/automation/src/forms.rs
@@ -1,7 +1,7 @@
 //! Form tools: list fields, fill them (several at once, one undo step), clear the form, and
 //! prepare a form (add fields one at a time or as a table, change and delete them).
 
-use pdfcraft_engine::form_scripts::{CalcOp, Calculate, Format, Validate, notation_storable};
+use pdfcraft_engine::form_scripts::{CalcOp, Calculate, Format, NOTATION_NOT_STORABLE, Validate, notation_storable};
 use pdfcraft_engine::{CalculationIssue, Edit, FieldProps, FieldValue, FormField, FormFieldKind, NewField, field_flags};
 use serde_json::{Value, json};
 
@@ -136,7 +136,7 @@ fn calculate_arg(v: &Value) -> Result<Calculate> {
         let n = n.as_str().ok_or_else(|| bad("notation must be a string such as \"Price * Qty\""))?;
         // Refused rather than stored as a different formula.
         if !notation_storable(n) {
-            return Err(bad("the notation can't be stored as written: it is empty, or holds EVCALC or */, which would end it early"));
+            return Err(bad(NOTATION_NOT_STORABLE));
         }
         return Ok(Calculate::Notation(n.to_string()));
     }
diff --git a/crates/forms/proptest-regressions/af/tests.txt b/crates/forms/proptest-regressions/af/tests.txt
new file mode 100644
index 0000000000..70c4d0b525
--- /dev/null
+++ b/crates/forms/proptest-regressions/af/tests.txt
@@ -0,0 +1,7 @@
+# Seeds for failure cases proptest has generated in the past. It is
+# automatically read and these particular cases re-run before any
+# novel cases are generated.
+#
+# It is recommended to check this file in to source control so that
+# everyone who runs the test benefits from these saved cases.
+cc 81dc3893ad0b46189d4e80199f44f8e58fcf0d193f67e266e37f3846f756a11e # shrinks to names = [" "]
diff --git a/crates/forms/src/af.rs b/crates/forms/src/af.rs
index c83ce29cf3..86c7971c31 100644
--- a/crates/forms/src/af.rs
+++ b/crates/forms/src/af.rs
@@ -22,7 +22,7 @@ use calc::{Notation, eval_notation, notation_name, notation_tokens, unique};
 pub use calc::{calculate, calculation_reads, notation_js, reads_built_names, rename_in_calculation};
 pub use format::{DATE_PRESETS, DateTime, TIME_PRESETS, format_date, format_value, js_number, keystroke, make_number, parse_date, validate};
 use script::{Arg, call};
-pub use script::{calculate_js, format_js, notation_storable, parse_calculate, parse_format, parse_validate, validate_js};
+pub use script::{NOTATION_NOT_STORABLE, calculate_js, format_js, notation_storable, parse_calculate, parse_format, parse_validate, validate_js};
 
 /// The Format tab.
 #[derive(Clone, Debug, PartialEq, Default)]
diff --git a/crates/forms/src/af/script.rs b/crates/forms/src/af/script.rs
index 1544258a2c..f15714c411 100644
--- a/crates/forms/src/af/script.rs
+++ b/crates/forms/src/af/script.rs
@@ -1,4 +1,4 @@
-use super::calc::{js_tokens, notation_js, notation_range};
+use super::calc::{js_tokens, notation_js, notation_range, notation_tokens};
 use super::format::{DATE_PRESETS, TIME_PRESETS};
 use super::{CalcOp, Calculate, Format, Validate};
 
@@ -255,7 +255,7 @@ pub fn parse_calculate(js: &str) -> Option<Calculate> {
     if js.contains("BVCALC")
         && let Some(range) = notation_range(js, &js_tokens(js).1)
     {
-        return Some(Calculate::Notation(js.get(range)?.trim().to_string()));
+        return Some(Calculate::Notation(notation_text(js.get(range)?).to_string()));
     }
     let args = call(js, "AFSimple_Calculate")?;
     let op = match args.first().and_then(Arg::string)?.as_str() {
@@ -325,13 +325,27 @@ pub fn validate_js(v: &Validate) -> Option<String> {
     }
 }
 
+/// Why [`notation_storable`] refuses a notation, in the words the Calculate tab and the tools say it.
+pub const NOTATION_NOT_STORABLE: &str = "the notation can't be stored as written: it is empty, or holds EVCALC or */, or ends in a lone \\";
+
 /// Whether simplified field notation `expr` can be stored: the script keeps it in a comment,
-/// between `BVCALC` and `EVCALC`, and it has to read back from there as itself. An empty one, or
-/// one holding `EVCALC` or `*/` (either ends it early), can't.
+/// between `BVCALC` and `EVCALC`, and it has to read back from there as the same names and
+/// operators. One holding `EVCALC` or `*/` ends early, and one ending in a lone `\` escapes the
+/// space after it. An empty one is refused too: it would be stored as `event.value = ;`.
 pub fn notation_storable(expr: &str) -> bool {
-    !expr.trim().is_empty()
-        && calculate_js(&Calculate::Notation(expr.to_owned())).and_then(|js| parse_calculate(&js))
-            == Some(Calculate::Notation(expr.trim().to_owned()))
+    let tokens = |s: &str| notation_tokens(s).into_iter().map(|(range, _)| s.get(range).unwrap_or_default().to_owned()).collect::<Vec<_>>();
+    let read = calculate_js(&Calculate::Notation(expr.to_owned())).and_then(|js| parse_calculate(&js));
+    !tokens(expr).is_empty() && matches!(read, Some(Calculate::Notation(n)) if tokens(&n) == tokens(expr))
+}
+
+/// `src` from its first notation token to its last: the spaces around it left out, but not an
+/// escaped space that ends the last name (`Total\ `), as `str::trim` would.
+fn notation_text(src: &str) -> &str {
+    let tokens = notation_tokens(src);
+    match (tokens.first(), tokens.last()) {
+        (Some((first, _)), Some((last, _))) => src.get(first.start..last.end).unwrap_or_default(),
+        _ => "",
+    }
 }
 
 pub fn calculate_js(c: &Calculate) -> Option<String> {
diff --git a/crates/forms/src/af/tests.rs b/crates/forms/src/af/tests.rs
index d0246d3016..79c5c7be02 100644
--- a/crates/forms/src/af/tests.rs
+++ b/crates/forms/src/af/tests.rs
@@ -222,7 +222,12 @@ fn hostile_scripts_are_read_in_one_pass() {
 fn a_notation_is_stored_only_when_it_reads_back() {
     assert!(notation_storable("Price * Qty"));
     assert!(notation_storable("  a + b  "), "the spaces around it are left out when it is read");
-    for expr in ["", "  ", "a EVCALC b", "a */ x /*", "a */ b"] {
+    // A last name that ends in a space keeps it, escaped, when the notation is read back.
+    let total = "Qty * Total\\ ";
+    assert!(notation_storable(total));
+    let read = parse_calculate(&calculate_js(&Calculate::Notation(total.into())).unwrap());
+    assert_eq!(read.as_ref().map(Calculate::reads), Some(vec!["Qty".to_owned(), "Total ".to_owned()]));
+    for expr in ["", "  ", "a EVCALC b", "a */ x /*", "a */ b", "a\\"] {
         assert!(!notation_storable(expr), "{expr:?}");
     }
 }
@@ -274,6 +279,16 @@ proptest::proptest! {
         proptest::prop_assert_eq!(back, Some(js));
     }
 
+    /// A notation of any names, written into a script, reads back from it as written.
+    #[test]
+    fn a_notation_reads_back_as_written(names in proptest::collection::vec("\\PC{1,8}", 1..5)) {
+        proptest::prop_assume!(!names.iter().any(|n| n.contains("VCALC")));
+        let expr = names.iter().map(|n| notation_name(n)).collect::<Vec<_>>().join(" + ");
+        let js = calculate_js(&Calculate::Notation(expr.clone())).unwrap();
+        proptest::prop_assert_eq!(parse_calculate(&js), Some(Calculate::Notation(expr.clone())));
+        proptest::prop_assert!(notation_storable(&expr), "{expr:?}");
+    }
+
     /// What a formula reads is the same whether it is read from the tab's settings or from
     /// the script they are written as.
     #[test]

From 46382092f1cd767780008328c4f933e29d316ac3 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 17:37:58 +0100
Subject: [PATCH 221/270] M6: Field Properties refuses a notation it couldn't
 store, and stays open with what was typed

set_props refuses such a notation before writing anything, so the
Calculate tab can't store one either (the tool already refused it). A
refused edit used to close Field Properties and lose everything typed
into it; the dialog now stays open with its changes, as the dialog for
several fields does, and the notice says why (from the review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/forms/src/author/edit.rs    |  6 +++++
 crates/ui-egui/src/dialogs.rs      | 10 ++++++---
 crates/ui-egui/tests/it/prepare.rs | 36 ++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 3 deletions(-)

diff --git a/crates/forms/src/author/edit.rs b/crates/forms/src/author/edit.rs
index 54a05f3db5..4f1a1a8632 100644
--- a/crates/forms/src/author/edit.rs
+++ b/crates/forms/src/author/edit.rs
@@ -88,6 +88,12 @@ pub fn set_props(doc: &mut Document, name: &str, props: &FieldProps) -> Result<S
         }
         patch.validate()?;
     }
+    // Refused here, before anything is written, rather than stored as a different formula.
+    if let Some(crate::af::Calculate::Notation(n)) = &props.calculate
+        && !crate::af::notation_storable(n)
+    {
+        return invalid(crate::af::NOTATION_NOT_STORABLE);
+    }
     let all = fields(doc);
     let f = all.iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?.clone();
     // Refuse a wrong type/index before any other requested property is written.
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index e57299fdcb..4e0ba2137b 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -1733,9 +1733,13 @@ fn finish_redactions_and_fields(app: &mut PdfCraftApp, req: &mut Pending) {
         // The widget being edited, by object: a radio button that joins a group by its new name
         // is appended after the group's own buttons, so its index changes.
         let widget = before.as_ref().and_then(|all| all.iter().find(|f| f.name == d.field)?.widgets.get(d.widget).map(|w| w.obj));
-        if app.apply_edit(Edit::SetFieldProps { name: d.field.clone(), props: Box::new(props) })
-            && let Some(i) = app.active
-        {
+        let applied = app.apply_edit(Edit::SetFieldProps { name: d.field.clone(), props: Box::new(props) });
+        if !applied && app.active_ids().is_some() {
+            // A refused edit (its reason is in the notice) leaves the dialog open with what was
+            // typed into it, as the several-fields dialog does, so nothing is lost meanwhile.
+            app.field_props = Some(d);
+            req.close = false;
+        } else if applied && let Some(i) = app.active {
             // Keep the (possibly renamed) field selected.
             // A dotted name is the full name; a plain one renames the field within its parent.
             let typed = d.name.trim();
diff --git a/crates/ui-egui/tests/it/prepare.rs b/crates/ui-egui/tests/it/prepare.rs
index 3fad521e68..99858e3afe 100644
--- a/crates/ui-egui/tests/it/prepare.rs
+++ b/crates/ui-egui/tests/it/prepare.rs
@@ -1404,6 +1404,42 @@ fn fields_sharing_a_name_each_show_their_own_formula() {
     }
 }
 
+/// Field Properties refuses a notation it couldn't store as written, and stays open with what was
+/// typed into it: the field keeps its formula and nothing in the dialog is lost. Once the notation
+/// is fixed, OK applies it and closes.
+#[test]
+fn a_notation_that_cannot_be_stored_keeps_field_properties_open() {
+    use pdfcraft_engine::form_scripts::Calculate;
+    use pdfcraft_engine::{Edit, FieldProps, NewField};
+    let mut h = harness();
+    for (i, name) in ["qty", "sub"].into_iter().enumerate() {
+        let y = 200.0 + 30.0 * i as f64;
+        let kind = NewField::Text { multiline: false };
+        h.state_mut().apply_edit(Edit::AddField { page: 0, rect: [20.0, y, 120.0, y + 20.0], kind, name: Some(name.into()) });
+    }
+    let props = Box::new(FieldProps { calculate: Some(Calculate::Notation("qty * 2".into())), ..Default::default() });
+    h.state_mut().apply_edit(Edit::SetFieldProps { name: "sub".into(), props });
+    let formula = |h: &Harness<'static, PdfCraftApp>| {
+        let s = h.state();
+        s.session.get(s.views[0].id).unwrap().form.iter().find(|f| f.name == "sub").unwrap().actions.calculate.clone()
+    };
+    h.state_mut().open_field_props("sub", 0);
+    h.run_steps(3);
+    let d = h.state_mut().field_props.as_mut().expect("Field Properties is open");
+    d.calculate = Calculate::Notation("qty EVCALC 2".into());
+    d.tooltip = "Subtotal".into();
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    let kept = h.state().field_props.as_ref().map(|d| (d.calculate.clone(), d.tooltip.clone()));
+    assert_eq!(kept, Some((Calculate::Notation("qty EVCALC 2".into()), "Subtotal".to_owned())), "the dialog stays open as typed");
+    assert_eq!(formula(&h), Calculate::Notation("qty * 2".into()), "the field keeps its formula");
+    h.state_mut().field_props.as_mut().expect("still open").calculate = Calculate::Notation("qty * 3".into());
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert!(h.state().field_props.is_none(), "applied and closed");
+    assert_eq!(formula(&h), Calculate::Notation("qty * 3".into()));
+}
+
 /// A formula that reads a field the form doesn't have gets a card of its own, in place of "every
 /// field calculates after the fields it reads", and its link opens that formula. A script that
 /// builds the names it reads gets a note.

From f64c71f65f9f0584e5426cadcf6de72566275972 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 17:48:37 +0100
Subject: [PATCH 222/270] M6: a test that set_props refuses an unstorable
 notation before writing anything

The tooltip given with it, which set_props writes before the calculation,
isn't set either; with the check moved to the calculation the test fails
(from the review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/forms/src/tests.rs | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 0909132a0f..95afee7c99 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -1711,6 +1711,28 @@ fn the_calculation_order_is_checked_fixed_and_kept() {
     assert_eq!(order.fixed(), ["sub", "total", "tax", "grand"], "only tax moves, to just after total");
 }
 
+/// `set_props` refuses a notation it couldn't store as written before it writes anything: the
+/// tooltip given with it, which is written before the calculation, isn't set either.
+#[test]
+fn a_notation_that_cannot_be_stored_changes_nothing() {
+    use crate::af::Calculate;
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [5 0 R] >>".into(),
+        "<< /Fields [5 0 R] /DA (/Helv 0 Tf 0 g) >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (total) /Rect [50 700 140 711] /P 3 0 R >>".into(),
+    ];
+    let mut doc = document(&objs);
+    for n in ["", "a EVCALC b", "a */ b", "a\\"] {
+        let props = FieldProps { tooltip: Some("Total".into()), calculate: Some(Calculate::Notation(n.into())), ..Default::default() };
+        assert!(set_props(&mut doc, "total", &props).is_err(), "{n:?}");
+        let all = fields(&doc);
+        let f = field(&all, "total");
+        assert_eq!((f.tooltip.as_deref(), &f.actions.calculate), (None, &Calculate::None), "{n:?} changed nothing");
+    }
+}
+
 /// A formula that reads a field the form doesn't have is flagged, whichever kind of formula it
 /// is: a field deleted from under a sum, a typo in notation, a script's `getField`. So is a
 /// script that builds the names it reads. Neither is an order Fix order can fix.

From 2055f48f5f6b5b41b67f8deb3305da74b5a199cd Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 19:39:41 +0100
Subject: [PATCH 223/270] M6: calculation checks: English copies of the new
 rows in the catalogues that had none

ckb and nb get all eleven rows, th and lo the six strings, and sq the five plurals beside its
strings, each under "# Untranslated". Their rows next to these were missing too, so following
them had added nothing.

hi, id, ko, lo and th list one plural form (plural_none), so they get no English copy of the
plurals: one English wording would be used for every count ("1 formulas read ..."). Without an
entry, the English fallback picks the right form, as it already does for the page's other plurals
in those catalogues.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/ui-egui/src/i18n/ckb.tsv | 13 +++++++++++++
 crates/ui-egui/src/i18n/lo.tsv  |  8 ++++++++
 crates/ui-egui/src/i18n/nb.tsv  | 13 +++++++++++++
 crates/ui-egui/src/i18n/sq.tsv  |  5 +++++
 crates/ui-egui/src/i18n/th.tsv  |  8 ++++++++
 5 files changed, 47 insertions(+)

diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index 71c0c62869..e97cb2f7a6 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -2749,3 +2749,16 @@ certificate	Version	وەشان
 	Rotate the selected pages clockwise	پەڕە هەڵبژێردراوەکان بە ئاڕاستەی میلی کاتژمێر بسوڕێنە
 	Extract the selected pages…	پەڕە هەڵبژێردراوەکان دەربهێنە…
 	Delete the selected pages	پەڕە هەڵبژێردراوەکان بسڕەوە
+
+# Untranslated: English text until a translator fills these in.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
+	Missing field	Missing field
+	Unchecked reads	Unchecked reads
+	{field} reads fields named as it runs	{field} reads fields named as it runs
+	Some names are built as it runs	Some names are built as it runs
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} more formula reads a missing field.|{n} more formulas read missing fields.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.
+@plural	{fields} is missing|{fields} are missing	{fields} is missing|{fields} are missing
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index 964467d823..219815d160 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -2465,3 +2465,11 @@ animation effects	Off	ປິດ
 	Rotate the selected pages clockwise	ໝູນໜ້າທີ່ເລືອກຕາມເຂັມໂມງ
 	Extract the selected pages…	ແຍກໜ້າທີ່ເລືອກອອກ…
 	Delete the selected pages	ລຶບໜ້າທີ່ເລືອກ
+
+# Untranslated: English text until a translator fills these in.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
+	Missing field	Missing field
+	Unchecked reads	Unchecked reads
+	{field} reads fields named as it runs	{field} reads fields named as it runs
+	Some names are built as it runs	Some names are built as it runs
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index 6f1739974a..96d5be7dee 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -2733,3 +2733,16 @@ key	Space	Mellomrom
 	Rotate the selected pages clockwise	Roter de valgte sidene med klokken
 	Extract the selected pages…	Trekk ut de valgte sidene…
 	Delete the selected pages	Slett de valgte sidene
+
+# Untranslated: English text until a translator fills these in.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
+	Missing field	Missing field
+	Unchecked reads	Unchecked reads
+	{field} reads fields named as it runs	{field} reads fields named as it runs
+	Some names are built as it runs	Some names are built as it runs
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} more formula reads a missing field.|{n} more formulas read missing fields.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.
+@plural	{fields} is missing|{fields} are missing	{fields} is missing|{fields} are missing
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index b6fb44e607..76c7e51bda 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -2415,6 +2415,11 @@ animation effects	Off	Joaktiv
 	Unchecked reads	Unchecked reads
 	{field} reads fields named as it runs	{field} reads fields named as it runs
 	Some names are built as it runs	Some names are built as it runs
+@plural	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have	{n} formula reads a field the form doesn't have|{n} formulas read fields the form doesn't have
+@plural	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.	{field} reads {fields}, which the form doesn't have.|{field} reads {fields}, which the form doesn't have.
+@plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} more formula reads a missing field.|{n} more formulas read missing fields.
+@plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.
+@plural	{fields} is missing|{fields} are missing	{fields} is missing|{fields} are missing
 	Mobile	Mobile
 	Move only what must move, so every field calculates after the fields it reads.	Move only what must move, so every field calculates after the fields it reads.
 	Moves only what must move	Moves only what must move
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index 2c9b892ed7..8949dcda00 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -2720,3 +2720,11 @@ theme	Appearance	ลักษณะที่ปรากฏ
 	Rotate the selected pages clockwise	หมุนหน้าที่เลือกตามเข็มนาฬิกา
 	Extract the selected pages…	แยกหน้าที่เลือกออก…
 	Delete the selected pages	ลบหน้าที่เลือก
+
+# Untranslated: English text until a translator fills these in.
+	Reads {name}, which the form doesn't have, so it gets no value there.	Reads {name}, which the form doesn't have, so it gets no value there.
+	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.	Its script also reads fields whose names it builds as it runs, so those reads can't be checked.
+	Missing field	Missing field
+	Unchecked reads	Unchecked reads
+	{field} reads fields named as it runs	{field} reads fields named as it runs
+	Some names are built as it runs	Some names are built as it runs

From ebad7f849d9dc04f8aa819efd4cfb06460de3d79 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Tue, 27 Oct 2026 19:37:12 +0100
Subject: [PATCH 224/270] M6: form_set_props' refusals are argument errors, so
 the tool's own notation guard is tested

The test only checked each refusal's message. Without the tool's notation guard, set_props
refuses the same notation with the same message as a failed edit, so the test passed with the
guard removed. It now asserts InvalidArgs for every row, and fails on "a EVCALC b" without the
guard.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/tests/it/automation.rs | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 1504dee7a3..040d20ae57 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -5154,8 +5154,9 @@ fn every_calculation_op_can_be_read_and_given_back() {
 }
 
 /// form_set_props refuses a calculate or validate it would only partly apply (a key it doesn't
-/// know, a value of the wrong type, a notation beside op and fields) and changes nothing. A
-/// validate read back from form_fields, with null for the bound it doesn't have, is taken back.
+/// know, a value of the wrong type, a notation beside op and fields) as a bad argument, before
+/// the edit runs, and changes nothing. A validate read back from form_fields, with null for the
+/// bound it doesn't have, is taken back.
 #[test]
 fn calculate_and_validate_refuse_what_they_would_drop() {
     let dir = workdir("calcstrict");
@@ -5185,12 +5186,14 @@ fn calculate_and_validate_refuse_what_they_would_drop() {
         (json!({ "fields": ["a"] }), "needs op"),
         (json!({ "op": "sum", "feilds": ["a"] }), "unknown key \"feilds\""),
     ] {
+        // InvalidArgs, not Failed: an unstorable notation is refused by the tool itself, not
+        // only by the edit underneath it.
         let e = err(&mut a, "form_set_props", json!({ "doc": doc, "field": "total", "calculate": calculate }));
-        assert!(e.to_string().contains(says), "{calculate}: {e}");
+        assert!(matches!(e, ToolError::InvalidArgs(_)) && e.to_string().contains(says), "{calculate}: {e:?}");
     }
     for (validate, says) in [(json!({ "min": 0, "max": "100" }), "max must be a number"), (json!({ "min": 0, "mxa": 5 }), "unknown key \"mxa\"")] {
         let e = err(&mut a, "form_set_props", json!({ "doc": doc, "field": "total", "validate": validate }));
-        assert!(e.to_string().contains(says), "{validate}: {e}");
+        assert!(matches!(e, ToolError::InvalidArgs(_)) && e.to_string().contains(says), "{validate}: {e:?}");
     }
     let t = total(&mut a);
     assert_eq!((&t["calculate"], &t["validate"]), (&set, &json!({ "min": 0.0, "max": 10.0 })), "nothing changed");

From e18d1bfed38272a33fad1b79b7452494a9f4dfd6 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Thu, 29 Oct 2026 22:37:03 +0100
Subject: [PATCH 225/270] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20de?=
 =?UTF-8?q?codes=20JBIG2=20globals=20within=2032=20MiB=20of=20their=20own?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An image's /JBIG2Globals were decoded with the 1 GiB any stream may decode
to, before the JBIG2 page's size is known, so the page's pixel limit didn't
bound them: a few kilobytes of Flate could make export allocate up to 1 GiB.
They now decode within MAX_GLOBALS (32 MiB); globals past it skip the image,
with the limit in the reason. The test covers one byte over and exactly the
limit, and the image's /DecodeParms direct, by reference and in an array.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/create/README.md      |  5 ++--
 crates/create/src/extract.rs | 12 ++++++--
 crates/create/src/tests.rs   | 55 ++++++++++++++++++++++++++++++++++++
 parity/acrobat-features.toml |  4 +--
 4 files changed, 70 insertions(+), 6 deletions(-)

diff --git a/crates/create/README.md b/crates/create/README.md
index 05395656a3..8cab2a1ea6 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -27,8 +27,9 @@ Every function returns a `pdfcraft_cos::Document`; the caller writes it.
 Image export and Save Image As apply each lossless image's Decode pair before converting its color components.
 JBIG2 images and masks (JBIG2 as their only filter) are decoded with `hayro-jbig2`, their `/JBIG2Globals` included,
 as `JBIG2Decode` gives them: black as 0. An image whose JBIG2 page has another width than the image, or more
-pixels than an exported image may have, is skipped; such a mask is left out and the image exported opaque, as JPX
-and CCITT masks are.
+pixels than an exported image may have, or whose globals decode to more than 32 MiB (they are decoded before the
+page's size is known, so they have a limit of their own), is skipped; such a mask is left out and the image
+exported opaque, as JPX and CCITT masks are.
 Indexed Decode values select palette entries after rounding and clipping. Color-key masks compare the original samples.
 Missing, null or malformed Decode arrays keep the default mapping.
 Soft-mask Decode intervals map samples to opacity before the mask is resized, including reversed ranges and indirect entries.
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index b46f74570f..f7fd7f122f 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -125,15 +125,23 @@ fn decode_parms(doc: &Document, s: &Stream) -> Dict {
     p.as_dict().cloned().unwrap_or_default()
 }
 
+/// The most an image's `/JBIG2Globals` decode to: the symbol and pattern dictionaries an encoder
+/// shares between pages, themselves coded, so far less than any stream may decode to
+/// ([`pdfcraft_cos::MAX_DECODED`], 1 GiB). Globals past it refuse the image.
+const MAX_GLOBALS: usize = 32 << 20;
+
 /// [`decoded`] for a JBIG2 image. Its JBIG2 page has to be the image's width, which the caller
 /// checked against the export's size limit, and within that limit itself: the decoder decodes the
 /// whole page, rows past the image's height too, so a small `/Height` over a far taller page
 /// would cost more than the limit allows. Rows past the image's height are dropped, and too few
 /// rows are refused by the caller. Globals that can't be read refuse the image, rather than
-/// decoding it without them.
+/// decoding it without them. They are decoded before the page's size is known, so the page's
+/// limit can't bound them; they have [`MAX_GLOBALS`] of their own.
 fn jbig2(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
     let globals = match decode_parms(doc, s).get(b"JBIG2Globals").map(|g| doc.resolve(g)).as_deref() {
-        Some(Object::Stream(g)) => Some(doc.with_direct_parms(g).decoded().map_err(|e| format!("the JBIG2 globals can't be read: {e}"))?),
+        Some(Object::Stream(g)) => {
+            Some(doc.with_direct_parms(g).decoded_within(MAX_GLOBALS).map_err(|e| format!("the JBIG2 globals can't be read: {e}"))?)
+        }
         _ => None,
     };
     let image = hayro_jbig2::Image::new_embedded(&s.raw, globals.as_deref()).map_err(|e| format!("the JBIG2 image can't be read: {e}"))?;
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 98fbfd7eee..9bff0c311c 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1519,3 +1519,58 @@ fn jbig2_images_export_as_their_picture() {
     let alpha: Vec<u8> = picture(h).as_chunks::<4>().0.iter().map(|p| 255 - p[0]).collect();
     assert_eq!(alphas(&exported_rgba(&page(w, h, &jbig2, None, true)).1), alpha);
 }
+
+/// A JBIG2 image's `/JBIG2Globals` are decoded before its JBIG2 page's size is known, so they have
+/// a limit of their own, 32 MiB, far below the 1 GiB of any stream: globals that Flate-decode to
+/// one byte more skip the image, with the limit in the reason, though they take a few kilobytes
+/// in the file. Globals of exactly the limit are read, and the limit is the same through an
+/// indirect `/DecodeParms`, in an array or not.
+#[test]
+fn jbig2_globals_are_decoded_within_a_limit_of_their_own() {
+    const LIMIT: usize = 32 << 20;
+    let bits = [0xF0u8, 0x0F, 0xAA, 0x55];
+    let jbig2 = pdfcraft_filters::encode_jbig2_generic(&bits, 16, 2).unwrap();
+    let picture: Vec<u8> = (0..32).flat_map(|i| if bits[i / 8] & (0x80 >> (i % 8)) != 0 { [255; 4] } else { [0, 0, 0, 255] }).collect();
+    // Globals of `len` bytes, Flate-encoded: one extension segment (ISO/IEC 14492 7.4.14), which a
+    // decoder skips; its 11-byte header gives the length of the data after it.
+    let globals = |len: usize| {
+        let mut g = vec![0, 0, 0, 0, 0x3E, 0, 0];
+        g.extend_from_slice(&u32::try_from(len - 11).unwrap().to_be_bytes());
+        g.extend_from_slice(&[0, 0, 0, 1]);
+        g.resize(len, 0);
+        pdfcraft_filters::encode_flate(&g)
+    };
+    // The image, its /DecodeParms naming `flated` as its globals: direct (0), by reference (1), or
+    // by reference in an array (2).
+    let page = |flated: &[u8], form: usize| {
+        let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+        with_image(&mut doc, |doc| {
+            let mut g = Dict::new();
+            g.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+            let g = doc.add(Object::Stream(Stream::from_raw(g, flated.to_vec())));
+            let mut parms = Dict::new();
+            parms.set(b"JBIG2Globals".to_vec(), Object::Ref(g));
+            let parms = match form {
+                0 => Object::Dict(parms),
+                1 => Object::Ref(doc.add(Object::Dict(parms))),
+                _ => Object::Array(vec![Object::Ref(doc.add(Object::Dict(parms)))]),
+            };
+            let mut d = image_dict(16, 2, "DeviceGray", 1);
+            d.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+            d.set(b"DecodeParms".to_vec(), parms);
+            Stream::from_raw(d, jbig2.clone())
+        });
+        doc
+    };
+
+    let (small, full, over) = (globals(15), globals(LIMIT), globals(LIMIT + 1));
+    assert!(over.len() < 64 << 10, "the oversized globals take {} bytes in the file", over.len());
+    assert_eq!(exported_rgba(&page(&full, 0)).1, picture, "globals of exactly the limit");
+    for form in 0..3 {
+        assert_eq!(exported_rgba(&page(&small, form)).1, picture, "small globals, form {form}");
+        let out = extract_images(&page(&over, form), &[0], 0);
+        assert!(out.images.is_empty(), "globals over the limit, form {form}");
+        let why = &out.skipped.first().expect("the image is skipped").2;
+        assert!(why.starts_with("the JBIG2 globals can't be read") && why.contains(&format!("limit of {LIMIT} bytes")), "{why}");
+    }
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 69a05410de..7bdf89ecad 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7164,8 +7164,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["export.all_images"]
 tools = ["doc_export_all_images"]
-evidence = ["crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps", "crates/create/src/tests.rs::jbig2_images_export_as_their_picture", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2"]
-notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JBIG2 images and masks decode (JBIG2 as the only filter, with /JBIG2Globals; an image whose JBIG2 page has another width, or more pixels than an export takes, is skipped, and such a mask is left out, the image exported opaque); JPX/CCITT masks are left out (image exported opaque); JPX/CCITT/separations, and JBIG2 inside other filters, reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported."
+evidence = ["crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps", "crates/create/src/tests.rs::jbig2_images_export_as_their_picture", "crates/create/src/tests.rs::jbig2_globals_are_decoded_within_a_limit_of_their_own", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2"]
+notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JBIG2 images and masks decode (JBIG2 as the only filter, with /JBIG2Globals; an image whose JBIG2 page has another width, or more pixels than an export takes, or whose globals decode to more than 32 MiB, is skipped, and such a mask is left out, the image exported opaque); JPX/CCITT masks are left out (image exported opaque); JPX/CCITT/separations, and JBIG2 inside other filters, reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported."
 
 [[feature]]
 id = "create.export-html"

From 9edd08ce0758ef9b4031f45d41ad8e5578744177 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 10:27:25 +0100
Subject: [PATCH 226/270] M11: JBIG2 symbol coding for black-and-white images

pdfcraft_filters::encode_jbig2 stores each distinct mark of a 1-bit
image (8-connected black pixels, at most 256 a side) once, as a symbol
in a symbol dictionary, and places its exact copies with an immediate
lossless text region that refers to it. Larger marks, and in a second
plan marks that occur once, go to a generic region over their box. It
keeps whichever of that and the generic coding (encode_jbig2_generic,
unchanged) is smaller. Only exact copies share a symbol, so the stream
decodes to the same bits.

Written from the JBIG committee's ISO/IEC 14492 Final Committee Draft:
6.4 and 6.5 (text region and symbol dictionary decoding), 7.2, 7.4.2
and 7.4.3 (segment headers and syntax) and Annex A (the integer coders,
checked against its worked example and Table A.1).

On six pages of rendered 300 dpi text the output is 28% of the generic
coding's size and 17% of Group 4's, at about 100 ms a page; hayro-jbig2
and Poppler (pdfimages) both decode it to the original bits. Scans,
whose copies of a letter are seldom identical, gain little: that needs
refinement coding. A dictionary shared between pages (/JBIG2Globals)
is a further step.

The optimizer's Monochrome Images > JBIG2 (lossless) and doc_optimize
mono jbig2 use it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 ROADMAP.md                          |   1 +
 crates/filters/README.md            |  10 +-
 crates/filters/src/jbig2.rs         | 147 ++++--
 crates/filters/src/jbig2/symbols.rs | 776 ++++++++++++++++++++++++++++
 crates/filters/src/lib.rs           |   4 +-
 crates/optimize/README.md           |  11 +-
 crates/optimize/src/images.rs       |   5 +-
 crates/optimize/src/lib.rs          |   5 +-
 crates/optimize/tests/optimize.rs   |  60 +++
 docs/pdf-spec-parity.md             |   5 +-
 docs/roadmap.md                     |   2 +
 parity/acrobat-features.toml        |   4 +-
 12 files changed, 965 insertions(+), 65 deletions(-)
 create mode 100644 crates/filters/src/jbig2/symbols.rs

diff --git a/ROADMAP.md b/ROADMAP.md
index f2fa3e25a6..6ae5a40a2c 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -200,6 +200,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 ## Progress log
 
+- **2026-10-26 (M11, JBIG2 symbols):** Lossless JBIG2 now stores each distinct mark of a black-and-white image once, as a symbol, and places its exact copies, when that is smaller than the generic region: on six pages of rendered 300 dpi text 28% of the generic region's size and 17% of Group 4's, and the same bits back through two independent decoders (hayro-jbig2 and Poppler). Scans, whose letters are seldom identical, gain little until refinement coding; a dictionary shared between pages (`/JBIG2Globals`) is next. Estimates unchanged.
 - **2026-10-27 (M10, OCR models):** Model staging downloads and verifies the ONNX pair after the upstream RTEN URL brownout; runtime discovery prefers complete ONNX pairs per directory, retains complete RTEN fallback and preserves directory precedence.
 - **2026-10-24 (M10, #4158 partial):** Word, HTML, RTF and PowerPoint export keep a block that continues another on its line (an italic case name, a link, a superscript) as a run in its own style inside that paragraph, with the source's word space, instead of a paragraph of its own. Style changes that wrap onto the next line still split paragraphs (the reading blocks keep style boundaries). Estimates unchanged.
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
diff --git a/crates/filters/README.md b/crates/filters/README.md
index 98363e33dc..0113e22179 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -3,7 +3,7 @@
 PDF stream filters: the decoders and encoders behind `/Filter` and `/DecodeParms`.
 
 - **Layer:** L0, standalone. No dependency on any other PdfCraft crate. `cos` depends on it (architecture §3 rule 3).
-- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder. JBIG2 generic region encoding is written here from the JBIG committee's ISO/IEC 14492 Final Committee Draft (WG1 N1359, 1999), the public draft of ITU-T T.88; its Annex H.2 test sequence checks the arithmetic coder byte for byte.
+- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder. JBIG2 encoding (generic regions, symbol dictionaries and text regions) is written here from the JBIG committee's ISO/IEC 14492 Final Committee Draft (WG1 N1359, 1999), the public draft of ITU-T T.88; its Annex H.2 test sequence checks the arithmetic coder byte for byte, and its Annex A example the integer coders.
 - `#![forbid(unsafe_code)]`. Builds for `wasm32-unknown-unknown`.
 
 ## API
@@ -23,7 +23,8 @@ decode_tolerant_counted(chain, data, max_output) -> Result<(Vec<u8>, bool /*part
 encode(filter, params, data) -> Result<Vec<u8>, FilterError>
 encode_flate(data) -> Vec<u8>   // zlib, level 6
 encode_g4(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as CCITT Group 4; columns <= MAX_G4_COLUMNS
-encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as lossless JBIG2 for JBIG2Decode; columns <= MAX_JBIG2_COLUMNS
+encode_jbig2(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as lossless JBIG2 for JBIG2Decode, symbol coded when that is smaller; columns <= MAX_JBIG2_COLUMNS
+encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // the same as one generic region
 ```
 
 - `chain` is applied first to last, as in a `/Filter` array.
@@ -43,7 +44,7 @@ encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
 | CCITTFaxDecode | not here (`Unsupported`; renderers decode it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
-| JBIG2Decode | not here (`Unsupported`; the renderer and image export decode it with `hayro-jbig2`) | `encode_jbig2_generic`: the embedded organisation (D.3) with a page information segment and an immediate lossless generic region (7.4.6), no `/JBIG2Globals`; template 0 with its nominal AT pixels and typical prediction (6.2.5), coded with the MQ arithmetic coder (Annex E, Table E.1) and ended by its 0xFF 0xAC marker. A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, so the stream decodes to the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 1,048,576 samples a row; no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
+| JBIG2Decode | not here (`Unsupported`; the renderer and image export decode it with `hayro-jbig2`) | `encode_jbig2_generic`: the embedded organisation (D.3) with a page information segment and an immediate lossless generic region (7.4.6), no `/JBIG2Globals`; template 0 with its nominal AT pixels and typical prediction (6.2.5), coded with the MQ arithmetic coder (Annex E, Table E.1) and ended by its 0xFF 0xAC marker. A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, so the stream decodes to the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 1,048,576 samples a row; no rows or columns, or too wide → Unsupported, too few bytes → Corrupt. `encode_jbig2`: the smaller of that and symbol coding (`jbig2/symbols.rs`): each distinct mark (8-connected black pixels, at most 256 a side) stored once in a symbol dictionary (7.4.2; arithmetic coded, each bitmap a template 0 generic region without typical prediction, the bitmaps sharing their contexts) and placed by an immediate lossless text region referring to it (7.4.3; bottom-left reference corner, strips of 1, 2, 4 or 8 rows, whichever is smallest), with larger marks, and in a second plan marks that occur once, in a generic region over their box. Only exact copies share a symbol (no refinement), so the stream decodes to the same bits; fewer than two symbols, more than 2^20 black runs, 65,536 symbols or 16 MiB of symbol pixels, or more than 2^24 rows, and the generic coding is used |
 
 ## Tests
 
@@ -53,8 +54,9 @@ encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1
 - `ccitt.rs`: Group 4 output decoded by `hayro-ccitt` (dev-dependency, an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
 - `mq.rs`: the arithmetic coder reproduces Annex H.2's 30 bytes from its 256 decisions.
 - `jbig2.rs`: output decoded by `hayro-jbig2` (dev-dependency, an independent decoder) matches the input bits: a text-like page (smaller than Group 4), edges, padding, all-white and all-black regions (typical rows), and property tests over bitmaps of noise and of runs; any input returns rather than panics.
+- `jbig2/symbols.rs`: the integer coders against Annex A's example and Table A.1; symbol-coded output decoded by `hayro-jbig2` matches the input bits for every plan and strip size: text whose letters repeat (under half the generic coding's size, the dictionary retained and referred to), large and lone marks left to a generic region, marks on the edges, touching at corners and inside each other's boxes, and property tests over glyphs scattered over each other and the edges with stray pixels (never larger than the generic coding); one shape, a blank page and noise are coded generically; any input returns rather than panics.
 - `fuzz/`: a detached cargo-fuzz crate (`cargo +nightly fuzz run decode`, run from `crates/filters/`).
 
 ## Status
 
-M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image codecs (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2 and CCITT decode, DCT encode), CCITT Group 3 encoding, JBIG2 symbol coding (text regions, symbol dictionaries, lossy) and Flate encode levels other than 6.
+M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image codecs (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2 and CCITT decode, DCT encode), CCITT Group 3 encoding, JBIG2 refinement coding (near-copies of a symbol), symbol dictionaries shared between images (`/JBIG2Globals`) and lossy JBIG2, and Flate encode levels other than 6.
diff --git a/crates/filters/src/jbig2.rs b/crates/filters/src/jbig2.rs
index 8983c335fd..d3b37e5aef 100644
--- a/crates/filters/src/jbig2.rs
+++ b/crates/filters/src/jbig2.rs
@@ -1,8 +1,10 @@
-//! JBIG2 generic region encoding (ITU-T T.88 | ISO/IEC 14492), for `JBIG2Decode`
-//! (ISO 32000-2 §7.4.7): lossless, template 0 with its nominal adaptive pixels, typical prediction
-//! on, MQ arithmetic coding ([`crate::mq`]). Written from the standard's 6.2.5 (coding a generic
-//! region), 7.2 (segment headers), 7.4.1, 7.4.6 and 7.4.8 (the segments) and D.3 (the embedded
-//! organisation PDF uses).
+//! JBIG2 encoding (ITU-T T.88 | ISO/IEC 14492), for `JBIG2Decode` (ISO 32000-2 §7.4.7), lossless:
+//! a generic region, template 0 with its nominal adaptive pixels, typical prediction on, MQ
+//! arithmetic coding ([`crate::mq`]); or the image's marks as symbols ([`symbols`]). Written from
+//! the standard's 6.2.5 (coding a generic region), 7.2 (segment headers), 7.4.1, 7.4.6 and 7.4.8
+//! (the segments) and D.3 (the embedded organisation PDF uses).
+
+mod symbols;
 
 use crate::FilterError;
 use crate::mq::{Context, MqEncoder};
@@ -41,6 +43,23 @@ const SLTP: [u8; 16] = [1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 1];
 /// Columns of padding either side of a row, so every template pixel of a row's pixels is in it.
 const PAD: usize = 4;
 
+/// `rows` rows of `columns` 1-bit PDF samples as lossless JBIG2, the smaller of two codings:
+/// [`encode_jbig2_generic`]'s, or one that stores each distinct mark of the image once, as a
+/// symbol, and places its copies (see [`symbols`]). Either way the stream is in the embedded
+/// organisation and decodes to the same bits without `/JBIG2Globals`.
+///
+/// Errors: as [`encode_jbig2_generic`].
+pub fn encode_jbig2(data: &[u8], columns: u32, rows: u32) -> Result<Vec<u8>, FilterError> {
+    let generic = encode_jbig2_generic(data, columns, rows)?;
+    // `encode_jbig2_generic` checked that the rows are there.
+    let stride = (columns as usize).div_ceil(8);
+    let samples = usize::try_from(rows).ok().and_then(|r| r.checked_mul(stride)).and_then(|n| data.get(..n));
+    Ok(match samples.and_then(|s| symbols::encode(s, columns, rows)) {
+        Some(coded) if coded.len() < generic.len() => coded,
+        _ => generic,
+    })
+}
+
 /// `rows` rows of `columns` 1-bit PDF samples (most significant bit first, each row starting on
 /// a new byte), as a JBIG2 stream in the embedded organisation: a page information segment and an
 /// immediate lossless generic region segment, which `JBIG2Decode` decodes to the same bits
@@ -62,69 +81,104 @@ pub fn encode_jbig2_generic(data: &[u8], columns: u32, rows: u32) -> Result<Vec<
         filter: "JBIG2Decode",
         detail: format!("{} bytes for {rows} rows of {columns} samples", data.len()),
     })?;
-    let region = generic_region(samples, width, stride);
+    let mut contexts: Vec<Context> = vec![0; 1 << 16];
+    let mut mq = MqEncoder::new();
+    let height = samples.len() / stride;
+    code_generic(&mut mq, &mut contexts, width, height, true, |y, row| {
+        let packed = samples.get(y * stride..).unwrap_or_default();
+        for (x, pixel) in row.iter_mut().enumerate() {
+            let sample = packed.get(x / 8).is_some_and(|b| b & (0x80 >> (x % 8)) != 0);
+            *pixel = u8::from(!sample);
+        }
+    });
+    let region = mq.finish();
     let mut out = Vec::with_capacity(region.len() + 64);
-    // Page information (7.4.8): the region's size, resolution unknown, eventually lossless,
-    // default pixel 0 (white), OR combination, not striped.
+    segment(&mut out, 0, 48, &[], false, &page_information(columns, rows));
+    segment(&mut out, 1, 39, &[], false, &generic_region(columns, rows, 0, 0, &region));
+    Ok(out)
+}
+
+/// A page information segment's data (7.4.8): the page's size, resolution unknown, eventually
+/// lossless, default pixel 0 (white), OR combination, not striped.
+fn page_information(columns: u32, rows: u32) -> Vec<u8> {
     let mut page = Vec::with_capacity(19);
     page.extend_from_slice(&columns.to_be_bytes());
     page.extend_from_slice(&rows.to_be_bytes());
     page.extend_from_slice(&[0; 8]);
     page.push(0x01);
     page.extend_from_slice(&[0, 0]);
-    segment(&mut out, 0, 48, &page);
-    // Immediate lossless generic region (7.4.6): region information (7.4.1) at (0, 0) with OR,
-    // flags (MMR 0, template 0, TPGDON 1), the AT pixels at their nominal places, then the data.
-    let mut generic = Vec::with_capacity(26 + region.len());
-    generic.extend_from_slice(&columns.to_be_bytes());
-    generic.extend_from_slice(&rows.to_be_bytes());
-    generic.extend_from_slice(&[0; 8]);
-    generic.push(0);
-    generic.push(0x08);
-    for (x, y) in &TEMPLATE[12..] {
-        generic.push(*x as i8 as u8);
-        generic.push(*y as i8 as u8);
-    }
-    generic.extend_from_slice(&region);
-    segment(&mut out, 1, 39, &generic);
-    Ok(out)
+    page
 }
 
-/// A segment (7.2): its header (number, type, no referred-to segments, page 1, data length), then
-/// its data.
-fn segment(out: &mut Vec<u8>, number: u32, kind: u8, data: &[u8]) {
+/// A region segment information field (7.4.1): a `width` × `height` region at (`x`, `y`) on the
+/// page, combined with it by OR.
+fn region_information(out: &mut Vec<u8>, width: u32, height: u32, x: u32, y: u32) {
+    for v in [width, height, x, y] {
+        out.extend_from_slice(&v.to_be_bytes());
+    }
+    out.push(0);
+}
+
+/// An immediate lossless generic region segment's data (7.4.6): its region information, flags
+/// (MMR 0, template 0, TPGDON 1), the AT pixels at their nominal places, then `coded`.
+fn generic_region(width: u32, height: u32, x: u32, y: u32, coded: &[u8]) -> Vec<u8> {
+    let mut data = Vec::with_capacity(26 + coded.len());
+    region_information(&mut data, width, height, x, y);
+    data.push(0x08);
+    at_pixels(&mut data);
+    data.extend_from_slice(coded);
+    data
+}
+
+/// Template 0's four AT pixels at their nominal places, as AT flags (7.4.6.3, 7.4.2.1.2).
+fn at_pixels(out: &mut Vec<u8>) {
+    for (x, y) in &TEMPLATE[12..] {
+        out.push(*x as i8 as u8);
+        out.push(*y as i8 as u8);
+    }
+}
+
+/// A segment (7.2): its header (number, type, the segments it refers to, page 1, data length),
+/// then its data. `retained`: a later segment refers to this one. Segment numbers here are below
+/// 256, so each referred-to one takes a byte (7.2.5); a segment refers to at most four, so their
+/// count and retain bits take one byte too (7.2.4), and the retain bits of the referred-to ones
+/// are 0: nothing after this segment refers to them.
+fn segment(out: &mut Vec<u8>, number: u32, kind: u8, refers_to: &[u8], retained: bool, data: &[u8]) {
     out.extend_from_slice(&number.to_be_bytes());
     out.push(kind);
-    out.push(0);
+    let count = refers_to.len().min(4);
+    out.push((count as u8) << 5 | u8::from(retained));
+    out.extend_from_slice(refers_to.get(..count).unwrap_or_default());
     out.push(1);
     // A segment's data never comes near 4 GiB here: a row is at most 1 MiB wide.
     out.extend_from_slice(&u32::try_from(data.len()).unwrap_or(u32::MAX).to_be_bytes());
     out.extend_from_slice(data);
 }
 
-/// The arithmetic-coded data of a generic region (6.2.5.7) with template 0, the nominal AT pixels
-/// and typical prediction.
-fn generic_region(samples: &[u8], width: usize, stride: usize) -> Vec<u8> {
-    let mut contexts: Vec<Context> = vec![0; 1 << 16];
-    let mut mq = MqEncoder::new();
+/// Codes a `width` × `height` bitmap as a generic region (6.2.5.7) with template 0 and the nominal
+/// AT pixels, its decisions in `contexts` (2^16 of them), with typical prediction when `typical`
+/// (TPGDON). `fill(y, row)` sets row `y`'s `width` pixels, 1 for black. Pixels outside the bitmap
+/// count as 0 (white), as the decoder takes them.
+fn code_generic(mq: &mut MqEncoder, contexts: &mut [Context], width: usize, height: usize, typical: bool, mut fill: impl FnMut(usize, &mut [u8])) {
     let sltp = SLTP.iter().enumerate().fold(0usize, |cx, (k, v)| cx | usize::from(*v) << k);
     // The two rows above the current one and the current one, as JBIG2 pixels (1 black), padded.
     let blank = vec![0u8; width + 2 * PAD];
     let (mut above2, mut above1) = (blank.clone(), blank.clone());
     let mut row = blank;
     let mut ltp = false;
-    for packed in samples.chunks_exact(stride) {
-        for (x, pixel) in row.iter_mut().skip(PAD).take(width).enumerate() {
-            let sample = packed.get(x / 8).is_some_and(|b| b & (0x80 >> (x % 8)) != 0);
-            *pixel = u8::from(!sample);
+    for y in 0..height {
+        if let Some(pixels) = row.get_mut(PAD..PAD + width) {
+            fill(y, pixels);
         }
-        // Typical prediction (6.2.5.5): a row the same as the one above is coded as one decision.
-        let typical = row == above1;
-        if let Some(cx) = contexts.get_mut(sltp) {
-            mq.encode(cx, typical != ltp);
+        if typical {
+            // Typical prediction (6.2.5.5): a row the same as the one above is coded as one decision.
+            let same = row == above1;
+            if let Some(cx) = contexts.get_mut(sltp) {
+                mq.encode(cx, same != ltp);
+            }
+            ltp = same;
         }
-        ltp = typical;
-        if !typical {
+        if !ltp {
             for x in 0..width {
                 let at = |dx: i32, dy: i32| {
                     let line = match dy {
@@ -144,7 +198,6 @@ fn generic_region(samples: &[u8], width: usize, stride: usize) -> Vec<u8> {
         std::mem::swap(&mut above2, &mut above1);
         std::mem::swap(&mut above1, &mut row);
     }
-    mq.finish()
 }
 
 #[cfg(test)]
@@ -153,7 +206,7 @@ mod tests {
 
     /// The rows an independent decoder (`hayro-jbig2`) reads from `data`, as PDF samples: true
     /// for white (a JBIG2 0).
-    fn decode(data: &[u8]) -> Vec<Vec<bool>> {
+    pub(super) fn decode(data: &[u8]) -> Vec<Vec<bool>> {
         struct Rows(Vec<Vec<bool>>, Vec<bool>, usize);
         impl hayro_jbig2::Decoder for Rows {
             fn push_pixel(&mut self, black: bool) {
@@ -175,7 +228,7 @@ mod tests {
     }
 
     /// The rows of packed samples `data`, true for a 1 bit.
-    fn unpack(data: &[u8], columns: u32, rows: u32) -> Vec<Vec<bool>> {
+    pub(super) fn unpack(data: &[u8], columns: u32, rows: u32) -> Vec<Vec<bool>> {
         let stride = (columns as usize).div_ceil(8);
         (0..rows as usize).map(|y| (0..columns as usize).map(|x| data[y * stride + x / 8] & (0x80 >> (x % 8)) != 0).collect()).collect()
     }
@@ -242,7 +295,7 @@ mod tests {
     }
 
     /// Packed samples from JBIG2 pixels (1 black): a 0 sample for each 1.
-    fn samples(pixels: &[Vec<u8>]) -> Vec<u8> {
+    pub(super) fn samples(pixels: &[Vec<u8>]) -> Vec<u8> {
         let width = pixels.first().map_or(0, Vec::len);
         let stride = width.div_ceil(8);
         let mut data = vec![0xFF; stride * pixels.len()];
diff --git a/crates/filters/src/jbig2/symbols.rs b/crates/filters/src/jbig2/symbols.rs
new file mode 100644
index 0000000000..00aa187602
--- /dev/null
+++ b/crates/filters/src/jbig2/symbols.rs
@@ -0,0 +1,776 @@
+//! JBIG2 symbol coding, lossless: each distinct mark of an image (a group of black pixels that
+//! touch, side by side or at a corner) is stored once, as a symbol in a symbol dictionary, and a
+//! text region places a copy of it wherever it occurs. Marks too large to be symbols (rules,
+//! frames, pictures) are left to a generic region beside it, and so, in [`encode`]'s second plan,
+//! are marks that occur only once. Only exact copies share a symbol, so the image decodes to the
+//! same bits. Written from the committee draft's 6.4 (the text region decoding procedure), 6.5
+//! (the symbol dictionary decoding procedure), 7.4.2 and 7.4.3 (their segments) and Annex A (the
+//! arithmetic integer coders).
+
+use std::collections::HashMap;
+use std::hash::{DefaultHasher, Hash, Hasher};
+use std::ops::Range;
+
+use super::{at_pixels, code_generic, generic_region, page_information, region_information, segment};
+use crate::mq::{Context, MqEncoder};
+
+/// The longest side of a mark stored as a symbol. A larger one is left to the generic region.
+const MAX_SYMBOL_SIDE: u32 = 256;
+
+/// The most black runs looked at. Past it (halftones, noise) the image is left to generic coding,
+/// which suits it better anyway; this bounds the memory the marks take.
+const MAX_RUNS: usize = 1 << 20;
+
+/// The most distinct symbols, and the most pixels their bitmaps may hold together.
+const MAX_SYMBOLS: usize = 1 << 16;
+const MAX_SYMBOL_PIXELS: usize = 1 << 24;
+
+/// The most rows symbol coded. With rows at most 2^20 samples wide, every coordinate and
+/// difference coded then fits the 32-bit integers Annex A codes.
+const MAX_ROWS: u32 = 1 << 24;
+
+/// The integer coders' ranges (Table A.1): how many 1 bits pick the range, how many bits give the
+/// offset into it, and its first value. The last range has no 0 after its prefix.
+const RANGES: [(u32, u32, u32); 6] = [(0, 2, 0), (1, 4, 4), (2, 6, 20), (3, 8, 84), (4, 12, 340), (5, 32, 4436)];
+
+/// A run of black pixels on row `y`, from `x0` up to but not including `x1`.
+#[derive(Clone, Copy, Debug)]
+struct Run {
+    y: u32,
+    x0: u32,
+    x1: u32,
+}
+
+/// A mark: its box (`x1` and `y1` just past it) and its runs, as a range of the run order
+/// [`marks`] gives.
+#[derive(Debug)]
+struct Mark {
+    x0: u32,
+    x1: u32,
+    y0: u32,
+    y1: u32,
+    runs: Range<usize>,
+}
+
+/// A distinct mark's bitmap, a byte a pixel (1 black), and how many marks are exact copies of it.
+#[derive(Debug)]
+struct Symbol {
+    width: u32,
+    height: u32,
+    pixels: Vec<u8>,
+    uses: u32,
+}
+
+/// An image's marks, sorted out: its black runs, its marks with the run order they index, the
+/// distinct marks of at most [`MAX_SYMBOL_SIDE`] a side as symbols, each such mark as (its
+/// symbol, the mark), and the marks too large to be symbols.
+struct Page {
+    runs: Vec<Run>,
+    marks: Vec<Mark>,
+    order: Vec<u32>,
+    symbols: Vec<Symbol>,
+    copies: Vec<(u32, u32)>,
+    large: Vec<u32>,
+}
+
+/// A symbol instance (6.4.5): the symbol, and where its bottom-left pixel goes, as S (the column)
+/// and T (the row). `width` is the symbol's.
+#[derive(Clone, Copy, Debug)]
+struct Instance {
+    id: u32,
+    s: u32,
+    t: u32,
+    width: u32,
+}
+
+/// `rows` rows of `columns` 1-bit PDF samples (black 0), symbol coded: the smaller of two plans,
+/// every mark of at most [`MAX_SYMBOL_SIDE`] a side as a symbol, or only those with a copy.
+/// `None` when neither plan has two symbols, or the image is too large or too busy to look at.
+pub(super) fn encode(samples: &[u8], columns: u32, rows: u32) -> Option<Vec<u8>> {
+    let page = page(samples, columns, rows)?;
+    [1, 2].into_iter().filter_map(|copies| plan(&page, columns, rows, copies, None)).min_by_key(Vec::len)
+}
+
+/// The image's marks and symbols; `None` past the limits above.
+fn page(samples: &[u8], columns: u32, rows: u32) -> Option<Page> {
+    if rows > MAX_ROWS {
+        return None;
+    }
+    let width = usize::try_from(columns).ok()?;
+    let stride = width.div_ceil(8);
+    if stride == 0 {
+        return None;
+    }
+    let runs = black_runs(samples, width, stride)?;
+    let (marks, order) = marks(&runs);
+    let mut page = Page { runs, marks, order, symbols: Vec::new(), copies: Vec::new(), large: Vec::new() };
+    symbols(&mut page)?;
+    Some(page)
+}
+
+/// The black runs of each row (0 samples), row by row and left to right; `None` past [`MAX_RUNS`].
+fn black_runs(samples: &[u8], width: usize, stride: usize) -> Option<Vec<Run>> {
+    let black = |row: &[u8], x: usize| row.get(x / 8).is_some_and(|b| b & (0x80 >> (x % 8)) == 0);
+    let mut runs = Vec::new();
+    for (y, row) in samples.chunks_exact(stride).enumerate() {
+        let y = u32::try_from(y).ok()?;
+        let mut x = 0;
+        while x < width {
+            // Whole white bytes at once.
+            if x % 8 == 0 && row.get(x / 8) == Some(&0xFF) {
+                x += 8;
+                continue;
+            }
+            if !black(row, x) {
+                x += 1;
+                continue;
+            }
+            let start = x;
+            while x < width && black(row, x) {
+                x += 1;
+            }
+            if runs.len() == MAX_RUNS {
+                return None;
+            }
+            runs.push(Run { y, x0: u32::try_from(start).ok()?, x1: u32::try_from(x).ok()? });
+        }
+    }
+    Some(runs)
+}
+
+/// The marks the runs make, in the order their first runs come (so from the top), and the run
+/// order: the runs' indexes, mark by mark, each mark's in row order.
+fn marks(runs: &[Run]) -> (Vec<Mark>, Vec<u32>) {
+    // Union–find over the runs; a set's root is its first run, as the larger root always joins
+    // the smaller. Runs on adjacent rows join when they overlap, counting a corner.
+    let mut parent: Vec<u32> = (0..runs.len()).map(|i| i as u32).collect();
+    let (mut above, mut above_at, mut above_y): (&[Run], usize, Option<u32>) = (&[], 0, None);
+    let mut at = 0;
+    for row in runs.chunk_by(|a, b| a.y == b.y) {
+        let y = row.first().map(|r| r.y);
+        if above_y.and_then(|a| a.checked_add(1)) == y {
+            let mut i = 0;
+            for (j, b) in row.iter().enumerate() {
+                while above.get(i).is_some_and(|a| a.x1 < b.x0) {
+                    i += 1;
+                }
+                let mut k = i;
+                while above.get(k).is_some_and(|a| a.x0 <= b.x1) {
+                    union(&mut parent, above_at + k, at + j);
+                    k += 1;
+                }
+            }
+        }
+        (above, above_at, above_y) = (row, at, y);
+        at += row.len();
+    }
+    let mut mark_of = vec![0u32; runs.len()];
+    let mut marks: Vec<Mark> = Vec::new();
+    let mut counts: Vec<usize> = Vec::new();
+    for (i, r) in runs.iter().enumerate() {
+        let root = find_root(&mut parent, i);
+        let m = if root == i {
+            marks.push(Mark { x0: r.x0, x1: r.x1, y0: r.y, y1: r.y.saturating_add(1), runs: 0..0 });
+            counts.push(0);
+            marks.len() - 1
+        } else {
+            mark_of.get(root).map_or(0, |m| *m as usize)
+        };
+        if let Some(slot) = mark_of.get_mut(i) {
+            *slot = m as u32;
+        }
+        if let (Some(mark), Some(count)) = (marks.get_mut(m), counts.get_mut(m)) {
+            mark.x0 = mark.x0.min(r.x0);
+            mark.x1 = mark.x1.max(r.x1);
+            mark.y1 = mark.y1.max(r.y.saturating_add(1));
+            *count += 1;
+        }
+    }
+    let mut next = 0;
+    for (mark, count) in marks.iter_mut().zip(&counts) {
+        mark.runs = next..next + count;
+        next += count;
+    }
+    let mut order = vec![0u32; runs.len()];
+    let mut fill: Vec<usize> = marks.iter().map(|m| m.runs.start).collect();
+    for (i, m) in mark_of.iter().enumerate() {
+        if let Some(n) = fill.get_mut(*m as usize) {
+            if let Some(slot) = order.get_mut(*n) {
+                *slot = i as u32;
+            }
+            *n += 1;
+        }
+    }
+    (marks, order)
+}
+
+/// The root of `i`'s set, halving the path to it as it goes. Parents are never above their
+/// children, so the walk ends.
+fn find_root(parent: &mut [u32], mut i: usize) -> usize {
+    loop {
+        let Some(&p) = parent.get(i) else { return i };
+        let p = p as usize;
+        if p == i {
+            return i;
+        }
+        let grandparent = parent.get(p).copied().unwrap_or(p as u32);
+        if let Some(slot) = parent.get_mut(i) {
+            *slot = grandparent;
+        }
+        i = grandparent as usize;
+    }
+}
+
+fn union(parent: &mut [u32], a: usize, b: usize) {
+    let (a, b) = (find_root(parent, a), find_root(parent, b));
+    if let Some(slot) = parent.get_mut(a.max(b)) {
+        *slot = a.min(b) as u32;
+    }
+}
+
+/// Each mark's own pixels in its box: those of its runs, not of other marks the box overlaps.
+fn pixels(mark: &Mark, runs: &[Run], order: &[u32]) -> Vec<u8> {
+    // A mark's box holds its runs, so these don't go below 0; a symbol is at most 256 a side.
+    let width = mark.x1.saturating_sub(mark.x0) as usize;
+    let height = mark.y1.saturating_sub(mark.y0) as usize;
+    let mut pixels = vec![0u8; width * height];
+    for r in order.get(mark.runs.clone()).unwrap_or_default().iter().filter_map(|i| runs.get(*i as usize)) {
+        let row = r.y.saturating_sub(mark.y0) as usize * width;
+        let from = row + r.x0.saturating_sub(mark.x0) as usize;
+        let to = row + r.x1.saturating_sub(mark.x0) as usize;
+        pixels.get_mut(from..to).unwrap_or_default().fill(1);
+    }
+    pixels
+}
+
+/// Sorts the marks into symbols: exact copies share one. `None` past [`MAX_SYMBOLS`] or
+/// [`MAX_SYMBOL_PIXELS`].
+fn symbols(page: &mut Page) -> Option<()> {
+    let mut by_hash: HashMap<u64, Vec<u32>> = HashMap::new();
+    let mut kept = 0usize;
+    for (m, mark) in page.marks.iter().enumerate() {
+        let m = u32::try_from(m).ok()?;
+        let (width, height) = (mark.x1.saturating_sub(mark.x0), mark.y1.saturating_sub(mark.y0));
+        if width > MAX_SYMBOL_SIDE || height > MAX_SYMBOL_SIDE {
+            page.large.push(m);
+            continue;
+        }
+        let pixels = pixels(mark, &page.runs, &page.order);
+        let mut hasher = DefaultHasher::new();
+        (width, height, &pixels).hash(&mut hasher);
+        let same = by_hash.entry(hasher.finish()).or_default();
+        let symbols = &mut page.symbols;
+        let known =
+            same.iter().copied().find(|s| symbols.get(*s as usize).is_some_and(|s| (s.width, s.height) == (width, height) && s.pixels == pixels));
+        let id = match known {
+            Some(id) => id,
+            None => {
+                kept = kept.checked_add(pixels.len())?;
+                if kept > MAX_SYMBOL_PIXELS || symbols.len() == MAX_SYMBOLS {
+                    return None;
+                }
+                let id = u32::try_from(symbols.len()).ok()?;
+                symbols.push(Symbol { width, height, pixels, uses: 0 });
+                same.push(id);
+                id
+            }
+        };
+        if let Some(s) = symbols.get_mut(id as usize) {
+            s.uses = s.uses.saturating_add(1);
+        }
+        page.copies.push((id, m));
+    }
+    Some(())
+}
+
+/// One plan's stream: the symbols with at least `copies` uses in a symbol dictionary, a text
+/// region placing them (in strips of 2^`log_strips` rows, or whichever size codes smallest), and
+/// the other marks in a generic region. `None` with fewer than two such symbols: their IDs would
+/// take no bits at all (SBSYMCODELEN 0), a corner of the standard left alone here.
+fn plan(page: &Page, columns: u32, rows: u32, copies: u32, log_strips: Option<u32>) -> Option<Vec<u8>> {
+    let symbol = |s: u32| page.symbols.get(s as usize);
+    // The dictionary's order (6.5.5): height classes from the shortest, each narrowest first.
+    let mut kept: Vec<u32> = (0..page.symbols.len() as u32).filter(|s| symbol(*s).is_some_and(|s| s.uses >= copies)).collect();
+    if kept.len() < 2 {
+        return None;
+    }
+    kept.sort_by_key(|s| symbol(*s).map(|s| (s.height, s.width)));
+    let mut id = vec![None; page.symbols.len()];
+    for (k, s) in kept.iter().enumerate() {
+        if let Some(slot) = id.get_mut(*s as usize) {
+            *slot = u32::try_from(k).ok();
+        }
+    }
+    let mut instances = Vec::new();
+    let mut left = page.large.clone();
+    for (s, m) in &page.copies {
+        match (id.get(*s as usize).copied().flatten(), page.marks.get(*m as usize), symbol(*s)) {
+            (Some(id), Some(mark), Some(symbol)) => instances.push(Instance { id, s: mark.x0, t: mark.y1.saturating_sub(1), width: symbol.width }),
+            _ => left.push(*m),
+        }
+    }
+    let kept: Vec<&Symbol> = kept.iter().filter_map(|s| symbol(*s)).collect();
+    let dictionary = symbol_dictionary(&kept)?;
+    let count = u32::try_from(kept.len()).ok()?;
+    let text = match log_strips {
+        Some(l) => text_region(&mut instances, count, columns, rows, l)?,
+        None => (0..4).filter_map(|l| text_region(&mut instances, count, columns, rows, l)).min_by_key(Vec::len)?,
+    };
+    let mut out = Vec::new();
+    segment(&mut out, 0, 48, &[], false, &page_information(columns, rows));
+    segment(&mut out, 1, 0, &[], true, &dictionary);
+    segment(&mut out, 2, 7, &[1], false, &text);
+    if !left.is_empty() {
+        segment(&mut out, 3, 39, &[], false, &leftover_region(&left, page)?);
+    }
+    Some(out)
+}
+
+/// A symbol dictionary segment's data (7.4.2) defining `symbols` (in dictionary order) and
+/// exporting them all: arithmetic coded, no refinement or aggregation, each bitmap a generic
+/// region with template 0, its nominal AT pixels and no typical prediction (Table 16), the
+/// bitmaps sharing one set of contexts.
+fn symbol_dictionary(symbols: &[&Symbol]) -> Option<Vec<u8>> {
+    let count = u32::try_from(symbols.len()).ok()?;
+    let mut data = vec![0, 0];
+    at_pixels(&mut data);
+    data.extend_from_slice(&count.to_be_bytes());
+    data.extend_from_slice(&count.to_be_bytes());
+    let mut mq = MqEncoder::new();
+    let mut contexts: Vec<Context> = vec![0; 1 << 16];
+    let (mut iadh, mut iadw, mut iaex) = (IntCoder::new(), IntCoder::new(), IntCoder::new());
+    let mut height = 0;
+    for class in symbols.chunk_by(|a, b| a.height == b.height) {
+        let h = class.first()?.height;
+        iadh.encode(&mut mq, Some(int(i64::from(h) - i64::from(height))?));
+        height = h;
+        let mut width = 0;
+        for s in class {
+            iadw.encode(&mut mq, Some(int(i64::from(s.width) - i64::from(width))?));
+            width = s.width;
+            let w = s.width as usize;
+            code_generic(&mut mq, &mut contexts, w, s.height as usize, false, |y, row| {
+                let line = s.pixels.get(y * w..).unwrap_or_default();
+                row.iter_mut().zip(line).for_each(|(p, v)| *p = *v);
+            });
+        }
+        iadw.encode(&mut mq, None);
+    }
+    // The export flags (6.5.10): a run of no symbols not exported, then a run of all of them.
+    iaex.encode(&mut mq, Some(0));
+    iaex.encode(&mut mq, Some(int(i64::from(count))?));
+    data.extend_from_slice(&mq.finish());
+    Some(data)
+}
+
+/// An immediate lossless text region segment's data (7.4.3) placing `instances` over the whole
+/// page: arithmetic coded, no refinement, strips of 2^`log_strips` rows, each symbol's
+/// bottom-left pixel at (S, T) (REFCORNER BOTTOMLEFT, so a line's letters share their T),
+/// not transposed, OR, default pixel 0, SBDSOFFSET 0. Sorts `instances` into strips, each
+/// left to right.
+fn text_region(instances: &mut [Instance], symbols: u32, columns: u32, rows: u32, log_strips: u32) -> Option<Vec<u8>> {
+    // LOGSBSTRIPS has two bits: strips of 1, 2, 4 or 8 rows.
+    if log_strips > 3 {
+        return None;
+    }
+    let strips = 1i64 << log_strips;
+    instances.sort_by_key(|i| (i.t >> log_strips, i.s));
+    let mut data = Vec::new();
+    region_information(&mut data, columns, rows, 0, 0);
+    data.extend_from_slice(&((log_strips as u16) << 2).to_be_bytes());
+    data.extend_from_slice(&u32::try_from(instances.len()).ok()?.to_be_bytes());
+    // SBSYMCODELEN (Table 31): ⌈log2 SBNUMSYMS⌉.
+    let length = symbols.checked_next_power_of_two()?.trailing_zeros();
+    let mut ids: Vec<Context> = vec![0; 1 << length];
+    let (mut iadt, mut iafs, mut iads, mut iait) = (IntCoder::new(), IntCoder::new(), IntCoder::new(), IntCoder::new());
+    let mut mq = MqEncoder::new();
+    // The initial STRIPT (6.4.5 step 2) is 0, so each strip's delta T is its first row over the
+    // strip size, from the strip before.
+    iadt.encode(&mut mq, Some(0));
+    let (mut strip_t, mut first_s) = (0i64, 0i64);
+    for strip in instances.chunk_by(|a, b| a.t >> log_strips == b.t >> log_strips) {
+        let t = i64::from(strip.first()?.t >> log_strips << log_strips);
+        iadt.encode(&mut mq, Some(int((t - strip_t) / strips)?));
+        strip_t = t;
+        let mut cur_s = 0;
+        for (k, instance) in strip.iter().enumerate() {
+            let s = i64::from(instance.s);
+            if k == 0 {
+                iafs.encode(&mut mq, Some(int(s - first_s)?));
+                first_s = s;
+            } else {
+                iads.encode(&mut mq, Some(int(s - cur_s)?));
+            }
+            if strips > 1 {
+                iait.encode(&mut mq, Some(int(i64::from(instance.t) - strip_t)?));
+            }
+            encode_id(&mut mq, &mut ids, length, instance.id);
+            // The next S counts from this symbol's last column (6.4.5 step 3c x).
+            cur_s = s + i64::from(instance.width) - 1;
+        }
+        iads.encode(&mut mq, None);
+    }
+    data.extend_from_slice(&mq.finish());
+    Some(data)
+}
+
+/// A generic region segment's data holding the marks `left`, over their box.
+fn leftover_region(left: &[u32], page: &Page) -> Option<Vec<u8>> {
+    let left: Vec<&Mark> = left.iter().filter_map(|m| page.marks.get(*m as usize)).collect();
+    let x0 = left.iter().map(|m| m.x0).min()?;
+    let y0 = left.iter().map(|m| m.y0).min()?;
+    let x1 = left.iter().map(|m| m.x1).max()?;
+    let y1 = left.iter().map(|m| m.y1).max()?;
+    let (width, height) = (x1.saturating_sub(x0) as usize, y1.saturating_sub(y0) as usize);
+    let stride = width.div_ceil(8);
+    // Packed, 1 for black: no larger than the image's own samples.
+    let mut packed = vec![0u8; stride.checked_mul(height)?];
+    for mark in &left {
+        for r in page.order.get(mark.runs.clone()).unwrap_or_default().iter().filter_map(|i| page.runs.get(*i as usize)) {
+            let row = r.y.saturating_sub(y0) as usize * stride;
+            for x in r.x0.saturating_sub(x0) as usize..r.x1.saturating_sub(x0) as usize {
+                if let Some(b) = packed.get_mut(row + x / 8) {
+                    *b |= 0x80 >> (x % 8);
+                }
+            }
+        }
+    }
+    let mut mq = MqEncoder::new();
+    let mut contexts: Vec<Context> = vec![0; 1 << 16];
+    code_generic(&mut mq, &mut contexts, width, height, true, |y, row| {
+        let line = packed.get(y * stride..).unwrap_or_default();
+        for (x, p) in row.iter_mut().enumerate() {
+            *p = u8::from(line.get(x / 8).is_some_and(|b| b & (0x80 >> (x % 8)) != 0));
+        }
+    });
+    Some(generic_region(u32::try_from(width).ok()?, u32::try_from(height).ok()?, x0, y0, &mq.finish()))
+}
+
+fn int(v: i64) -> Option<i32> {
+    i32::try_from(v).ok()
+}
+
+/// An arithmetic integer coder other than IAID (A.2): its 512 contexts, indexed by PREV.
+struct IntCoder([Context; 512]);
+
+impl IntCoder {
+    fn new() -> Self {
+        IntCoder([0; 512])
+    }
+
+    /// Codes `value`, or OOB for `None`.
+    fn encode(&mut self, mq: &mut MqEncoder, value: Option<i32>) {
+        for (cx, d) in decisions(value) {
+            if let Some(state) = self.0.get_mut(cx) {
+                mq.encode(state, d);
+            }
+        }
+    }
+}
+
+/// The decisions that code `value`, or OOB for `None`, with their contexts (A.2, Table A.1): the
+/// sign, the prefix that picks the range, then the offset into it, most significant bit first;
+/// OOB is a negative 0. Each decision's context is PREV: a leading 1 and the decisions before it,
+/// at most the last eight once there are more.
+fn decisions(value: Option<i32>) -> Vec<(usize, bool)> {
+    let (negative, magnitude) = value.map_or((true, 0), |v| (v < 0, v.unsigned_abs()));
+    let (ones, bits, first) =
+        RANGES.into_iter().find(|(_, bits, first)| *bits == 32 || u64::from(magnitude) < u64::from(*first) + (1 << bits)).unwrap_or(RANGES[5]);
+    let offset = magnitude - first;
+    let mut d = vec![negative];
+    d.extend(std::iter::repeat_n(true, ones as usize));
+    if ones < 5 {
+        d.push(false);
+    }
+    d.extend((0..bits).rev().map(|i| offset >> i & 1 == 1));
+    let mut prev = 1usize;
+    d.into_iter()
+        .map(|bit| {
+            let cx = prev;
+            prev = if prev < 256 { prev << 1 | usize::from(bit) } else { ((prev << 1 | usize::from(bit)) & 511) | 256 };
+            (cx, bit)
+        })
+        .collect()
+}
+
+/// Codes symbol ID `id` in `length` bits, most significant first, through IAID (A.3): each
+/// decision's context is a leading 1 and all the bits before it.
+fn encode_id(mq: &mut MqEncoder, contexts: &mut [Context], length: u32, id: u32) {
+    let mut prev = 1usize;
+    for i in (0..length).rev() {
+        let d = id >> i & 1 == 1;
+        if let Some(state) = contexts.get_mut(prev) {
+            mq.encode(state, d);
+        }
+        prev = prev << 1 | usize::from(d);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::jbig2::tests::{decode, samples, unpack};
+    use crate::jbig2::{encode_jbig2, encode_jbig2_generic};
+
+    type Bitmap = Vec<Vec<u8>>;
+
+    /// A small linear congruential generator, so the pictures are the same every run.
+    struct Lcg(u64);
+
+    impl Lcg {
+        fn below(&mut self, n: usize) -> usize {
+            self.0 = self.0.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1_442_695_040_888_963_407);
+            (self.0 >> 33) as usize % n.max(1)
+        }
+    }
+
+    /// `count` different letter-like shapes: three strokes two pixels thick in a box of 6 to 18
+    /// pixels a side, each after the first starting on one before it, so a shape is one mark;
+    /// trimmed to its pixels.
+    fn glyphs(count: usize, seed: u64) -> Vec<Bitmap> {
+        let mut r = Lcg(seed);
+        let mut out: Vec<Bitmap> = Vec::new();
+        while out.len() < count {
+            let (w, h) = (6 + r.below(13), 6 + r.below(13));
+            let mut g = vec![vec![0u8; w]; h];
+            let (mut x, mut y) = (r.below(w), r.below(h));
+            for _ in 0..3 {
+                let (dx, dy) = [(1, 0), (0, 1), (1, 1)][r.below(3)];
+                let mut stroke = Vec::new();
+                while x < w && y < h {
+                    g[y][x] = 1;
+                    g[y][(x + 1).min(w - 1)] = 1;
+                    stroke.push((x, y));
+                    x += dx;
+                    y += dy;
+                }
+                (x, y) = stroke[r.below(stroke.len())];
+            }
+            let rows: Vec<usize> = (0..h).filter(|y| g[*y].contains(&1)).collect();
+            let columns: Vec<usize> = (0..w).filter(|x| g.iter().any(|row| row[*x] == 1)).collect();
+            let g: Bitmap = g[rows[0]..=rows[rows.len() - 1]].iter().map(|row| row[columns[0]..=columns[columns.len() - 1]].to_vec()).collect();
+            if !out.contains(&g) {
+                out.push(g);
+            }
+        }
+        out
+    }
+
+    /// Draws `glyph` with its top-left pixel at (`x`, `y`), clipped to the page, by OR.
+    fn draw(page: &mut Bitmap, glyph: &Bitmap, x: i64, y: i64) {
+        for (gy, row) in glyph.iter().enumerate() {
+            for (gx, p) in row.iter().enumerate() {
+                let (px, py) = (x + gx as i64, y + gy as i64);
+                if *p == 1
+                    && px >= 0
+                    && py >= 0
+                    && let Some(cell) = page.get_mut(py as usize).and_then(|r| r.get_mut(px as usize))
+                {
+                    *cell = 1;
+                }
+            }
+        }
+    }
+
+    /// Lines of text: glyphs side by side, one to four pixels apart, each line's glyphs on its
+    /// baseline, the lines 30 rows apart; the first glyphs are the most common, as letters are.
+    fn text(columns: usize, rows: usize, glyphs: &[Bitmap], seed: u64) -> Bitmap {
+        let mut page = vec![vec![0u8; columns]; rows];
+        let mut r = Lcg(seed);
+        for baseline in (24..rows).step_by(30) {
+            let mut x = 4 + r.below(8);
+            loop {
+                let common = r.below(glyphs.len()) + 1;
+                let g = &glyphs[r.below(common)];
+                if x + g[0].len() > columns {
+                    break;
+                }
+                draw(&mut page, g, x as i64, (baseline + 1 - g.len()) as i64);
+                x += g[0].len() + 1 + r.below(4);
+            }
+        }
+        page
+    }
+
+    /// `n` glyphs anywhere, some over the edges, some over each other.
+    fn scatter(columns: usize, rows: usize, glyphs: &[Bitmap], seed: u64, n: usize) -> Bitmap {
+        let mut page = vec![vec![0u8; columns]; rows];
+        let mut r = Lcg(seed);
+        for _ in 0..n {
+            let g = &glyphs[r.below(glyphs.len())];
+            draw(&mut page, g, r.below(columns + 12) as i64 - 6, r.below(rows + 12) as i64 - 6);
+        }
+        page
+    }
+
+    /// The segments of a stream in the embedded organisation, from their headers (7.2): each one's
+    /// type, whether it is retained, and the segments it refers to.
+    fn segments(data: &[u8]) -> Vec<(u8, bool, Vec<u8>)> {
+        let (mut segments, mut at) = (Vec::new(), 0);
+        while at < data.len() {
+            let refers = usize::from(data[at + 5] >> 5);
+            let length_at = at + 6 + refers + 1;
+            let length = u32::from_be_bytes(data[length_at..length_at + 4].try_into().unwrap()) as usize;
+            segments.push((data[at + 4] & 0x3F, data[at + 5] & 1 == 1, data[at + 6..at + 6 + refers].to_vec()));
+            at = length_at + 4 + length;
+        }
+        segments
+    }
+
+    fn segment_types(data: &[u8]) -> Vec<u8> {
+        segments(data).into_iter().map(|(kind, ..)| kind).collect()
+    }
+
+    /// Every plan, at every strip size, decodes to the picture; returns how many plans there were.
+    fn every_plan_round_trips(picture: &Bitmap) -> usize {
+        let (columns, rows) = (picture[0].len() as u32, picture.len() as u32);
+        let data = samples(picture);
+        let page = page(&data, columns, rows).unwrap();
+        let mut plans = 0;
+        for copies in [1, 2] {
+            for log_strips in 0..4 {
+                if let Some(coded) = plan(&page, columns, rows, copies, Some(log_strips)) {
+                    assert_eq!(decode(&coded), unpack(&data, columns, rows), "{copies} copies, strips of {}", 1 << log_strips);
+                    plans += 1;
+                }
+            }
+        }
+        plans
+    }
+
+    /// Annex A.2's example (12 through IADW: the decisions 0101000, in contexts 1, 10, 101, …)
+    /// and Table A.1's codes.
+    #[test]
+    fn integers_are_coded_as_annex_a_says() {
+        assert_eq!(decisions(Some(12)), [(1, false), (2, true), (5, false), (10, true), (21, false), (42, false), (84, false)]);
+        let bits = |v| decisions(v).iter().map(|(_, d)| u8::from(*d)).collect::<Vec<u8>>();
+        assert_eq!(bits(None), [1, 0, 0, 0], "OOB");
+        assert_eq!(bits(Some(0)), [0, 0, 0, 0]);
+        assert_eq!(bits(Some(-1)), [1, 0, 0, 1]);
+        assert_eq!(bits(Some(-3)), [1, 0, 1, 1]);
+        assert_eq!(bits(Some(4)), [0, 1, 0, 0, 0, 0, 0]);
+        assert_eq!(bits(Some(-19)), [1, 1, 0, 1, 1, 1, 1]);
+        assert_eq!(bits(Some(83)), [0, 1, 1, 0, 1, 1, 1, 1, 1, 1]);
+        assert_eq!(bits(Some(4435))[..6], [0, 1, 1, 1, 1, 0]);
+        let big = bits(Some(4436));
+        assert_eq!((big.len(), &big[..6]), (6 + 32, &[0, 1, 1, 1, 1, 1][..]));
+        assert!(big[6..].iter().all(|b| *b == 0));
+        // PREV keeps a leading 1 and the last eight decisions.
+        let contexts: Vec<usize> = decisions(Some(i32::MIN)).iter().map(|(cx, _)| *cx).collect();
+        assert!(contexts[..8].iter().all(|cx| *cx < 256) && contexts[8..].iter().all(|cx| (256..512).contains(cx)));
+    }
+
+    /// A page of text whose letters repeat exactly, as rendered text does, keeps each letter once:
+    /// a symbol dictionary and a text region, much smaller than the generic coding.
+    #[test]
+    fn repeated_marks_are_stored_once() {
+        let picture = text(1700, 400, &glyphs(40, 7), 11);
+        let data = samples(&picture);
+        let coded = encode_jbig2(&data, 1700, 400).unwrap();
+        let generic = encode_jbig2_generic(&data, 1700, 400).unwrap();
+        // The dictionary is retained for the text region, which refers to it (7.2.4, 7.2.5).
+        assert_eq!(segments(&coded), [(48, false, vec![]), (0, true, vec![]), (7, false, vec![1])]);
+        assert_eq!(decode(&coded), unpack(&data, 1700, 400));
+        assert!(coded.len() * 2 < generic.len(), "symbols {} bytes, generic {}", coded.len(), generic.len());
+        assert_eq!(every_plan_round_trips(&picture), 8);
+    }
+
+    /// Marks too large to be symbols (a frame, a rule) go to a generic region over their box, and
+    /// with the second plan so do marks that occur once; the page still decodes to its bits.
+    #[test]
+    fn large_and_lone_marks_are_left_to_a_generic_region() {
+        let mut picture = text(900, 300, &glyphs(25, 3), 5);
+        picture[10][100..800].fill(1);
+        picture[290][100..800].fill(1);
+        for row in &mut picture[10..=290] {
+            row[100] = 1;
+            row[799] = 1;
+        }
+        // A lone blob, unlike any letter.
+        for (y, row) in picture[150..170].iter_mut().enumerate() {
+            row[850 + y % 7] = 1;
+        }
+        let data = samples(&picture);
+        let coded = encode_jbig2(&data, 900, 300).unwrap();
+        assert_eq!(segment_types(&coded), [48, 0, 7, 39]);
+        assert_eq!(decode(&coded), unpack(&data, 900, 300));
+        assert_eq!(every_plan_round_trips(&picture), 8);
+    }
+
+    /// Marks on every edge, marks touching only at a corner (one mark), a mark inside another's
+    /// box, and marks over each other's boxes.
+    #[test]
+    fn marks_at_the_edges_and_corners_round_trip() {
+        let dot = vec![vec![1u8, 1], vec![1, 1]];
+        let ell = vec![vec![1u8, 0, 0], vec![1, 0, 0], vec![1, 1, 1]];
+        let mut picture = vec![vec![0u8; 41]; 23];
+        for (x, y) in [(0, 0), (39, 0), (0, 21), (39, 21), (20, 0), (0, 10), (39, 10), (20, 21)] {
+            draw(&mut picture, &dot, x, y);
+        }
+        for (x, y) in [(10, 5), (28, 14), (12, 14)] {
+            draw(&mut picture, &ell, x, y);
+        }
+        // Corners touching: one mark.
+        picture[3][6] = 1;
+        picture[4][7] = 1;
+        picture[5][8] = 1;
+        // A ring with a dot inside, and an ell over the ring's box.
+        for i in 0..7 {
+            picture[8][20 + i] = 1;
+            picture[14][20 + i] = 1;
+            picture[8 + i][20] = 1;
+            picture[8 + i][26] = 1;
+        }
+        draw(&mut picture, &dot, 22, 10);
+        draw(&mut picture, &ell, 25, 15);
+        assert_eq!(every_plan_round_trips(&picture), 8);
+    }
+
+    /// One shape, however often, would need symbol IDs of no bits: that image is coded as a generic
+    /// region, as are a blank page and pure noise.
+    #[test]
+    fn one_shape_blank_pages_and_noise_are_coded_generically() {
+        let letter = &glyphs(1, 9)[..];
+        let mut r = Lcg(1);
+        let noise: Bitmap = (0..60).map(|_| (0..200).map(|_| u8::from(r.below(2) == 1)).collect()).collect();
+        for picture in [text(600, 200, letter, 2), vec![vec![0u8; 300]; 40], noise] {
+            let (columns, rows) = (picture[0].len() as u32, picture.len() as u32);
+            let data = samples(&picture);
+            assert_eq!(encode_jbig2(&data, columns, rows).unwrap(), encode_jbig2_generic(&data, columns, rows).unwrap());
+        }
+    }
+
+    proptest::proptest! {
+        /// Glyphs anywhere, over the edges and each other, with stray pixels: every plan decodes to
+        /// the picture, and `encode_jbig2` is never larger than the generic coding.
+        #[test]
+        fn scattered_marks_round_trip(
+            columns in 1usize..240,
+            rows in 1usize..120,
+            shapes in 2usize..10,
+            n in 0usize..80,
+            seed in proptest::num::u64::ANY,
+            stray in proptest::collection::vec((0usize..240, 0usize..120), 0..20),
+        ) {
+            let mut picture = scatter(columns, rows, &glyphs(shapes, seed), seed, n);
+            for (x, y) in stray {
+                if let Some(cell) = picture.get_mut(y).and_then(|r| r.get_mut(x)) {
+                    *cell ^= 1;
+                }
+            }
+            every_plan_round_trips(&picture);
+            let data = samples(&picture);
+            let (c, r) = (columns as u32, rows as u32);
+            let coded = encode_jbig2(&data, c, r).unwrap();
+            proptest::prop_assert!(coded.len() <= encode_jbig2_generic(&data, c, r).unwrap().len());
+            proptest::prop_assert_eq!(decode(&coded), unpack(&data, c, r));
+        }
+
+        /// Whatever it is given, it returns.
+        #[test]
+        fn any_input_returns(data in proptest::collection::vec(0u8..=255, 0..600), columns in 0u32..5000, rows in 0u32..80) {
+            let _ = encode_jbig2(&data, columns, rows);
+            let _ = encode(&data, columns, rows);
+        }
+    }
+}
diff --git a/crates/filters/src/lib.rs b/crates/filters/src/lib.rs
index da675a024b..30094e6524 100644
--- a/crates/filters/src/lib.rs
+++ b/crates/filters/src/lib.rs
@@ -7,7 +7,7 @@
 //! Image codecs (`DCTDecode`, `JPXDecode`, `JBIG2Decode`, `CCITTFaxDecode`),
 //! `Crypt` and unknown filters are reported as [`FilterError::Unsupported`] so
 //! callers keep such data encoded. 1-bit samples can be encoded as CCITT Group 4
-//! ([`encode_g4`]).
+//! ([`encode_g4`]) or lossless JBIG2 ([`encode_jbig2`]).
 //!
 //! Every decoder is bounded by a caller-supplied `max_output` (decompression-bomb
 //! defence) and never panics on malformed input.
@@ -27,7 +27,7 @@ mod runlength;
 use std::borrow::Cow;
 
 pub use ccitt::{MAX_G4_COLUMNS, encode_g4};
-pub use jbig2::{MAX_JBIG2_COLUMNS, encode_jbig2_generic};
+pub use jbig2::{MAX_JBIG2_COLUMNS, encode_jbig2, encode_jbig2_generic};
 
 /// A PDF stream filter, identified by its `/Filter` name.
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index a1c47697b5..4c8ae1cd3e 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -37,12 +37,15 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
 - **Monochrome images** (`Settings::mono`, CCITT Group 4 by default, or JBIG2): a 1-bit image
   with one colour component (grey, indexed, a separation) or an image mask, stored with no filter
   or with general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`)
-  or lossless JBIG2 (`encode_jbig2_generic`; a document below PDF 1.4 gets `/Version /1.4` in
-  its catalog) when that is smaller as stored. On 300 dpi text JBIG2 is about a third smaller
-  than Group 4. It is lossless: the samples decode to the same bits, so the colour
+  or lossless JBIG2 (`encode_jbig2`; a document below PDF 1.4 gets `/Version /1.4` in
+  its catalog) when that is smaller as stored. JBIG2 stores each distinct mark once, as a
+  symbol, when the image's marks repeat exactly, as rendered text's do: on six pages of
+  300 dpi text that came to 28% of a generic region's size and 17% of Group 4's. On scans, whose copies of a letter are seldom identical, it is a generic region,
+  about a third smaller than Group 4. It is lossless: the samples decode to the same bits, so the colour
   space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
-  JBIG2 symbol coding (lossy or lossless), monochrome downsampling, inline images, soft masks and
+  JBIG2 refinement coding (lossless gains on scans), a symbol dictionary shared between images
+  (`/JBIG2Globals`), lossy JBIG2, monochrome downsampling, inline images, soft masks and
   `/Mask` images, and Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to
   1,048,576). Redaction doesn't decode JBIG2 or Group 4 yet: a mark over part of such an image
   removes the whole image (nothing leaks). Export reads JBIG2, but nothing that exports an image
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index cf668d0fbf..392e9145ee 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -596,9 +596,10 @@ fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stre
         new.remove(k);
     }
     let data = if compression == MonoCompression::Jbig2 {
-        // One embedded JBIG2 stream with its own page; no /JBIG2Globals.
+        // One embedded JBIG2 stream with its own page (and symbol dictionary, when the image's
+        // marks repeat); no /JBIG2Globals.
         new.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
-        pdfcraft_filters::encode_jbig2_generic(&samples, w, h).ok()?
+        pdfcraft_filters::encode_jbig2(&samples, w, h).ok()?
     } else {
         let mut parms = Dict::new();
         parms.set(b"K".to_vec(), Object::Int(-1));
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index 09c487989e..7ef159d227 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -124,8 +124,9 @@ pub enum Compression {
 pub enum MonoCompression {
     /// CCITT Group 4 (lossless), when smaller than the image as it is.
     CcittG4,
-    /// JBIG2, lossless (a generic region), when smaller than the image as it is. JBIG2Decode is
-    /// PDF 1.4: an older document gets `/Version /1.4` in its catalog.
+    /// JBIG2, lossless (a generic region, or symbols when the image's marks repeat), when smaller
+    /// than the image as it is. JBIG2Decode is PDF 1.4: an older document gets `/Version /1.4` in
+    /// its catalog.
     Jbig2,
     /// Keep each image's own compression.
     Retain,
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 9a0990286e..a4315e2392 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -674,6 +674,66 @@ fn a_catalog_version_given_by_reference_is_read() {
     }
 }
 
+/// Text as a renderer draws it at 300 dpi: lines 48 rows apart of a few letter shapes, each
+/// `#` a 3 × 3 block, three columns apart with a wider gap between words, every copy of a letter
+/// the same to the pixel.
+fn rendered_text(w: u32, h: u32) -> Vec<u8> {
+    const LETTERS: [&[&str]; 5] = [
+        &["##", "##", "##", "##", "##", "##", "##", "##", "##", "##"],
+        &["......", ".####.", "##..##", "##..##", "##..##", "##..##", ".####."],
+        &["##....", "##....", "##....", "#####.", "##..##", "##..##", "##..##", "#####."],
+        &["##..##", "##..##", "##..##", "##..##", ".#####"],
+        &["##", "##", "..", "##", "##", "##", "##", "##"],
+    ];
+    let stride = (w as usize).div_ceil(8);
+    let mut data = vec![0xFF; stride * h as usize];
+    let mut seed = 0x2545_F491_4F6C_DD1Du64;
+    let mut next = move || {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        seed
+    };
+    for baseline in (32..h as usize).step_by(48) {
+        let mut x = 8;
+        while x + 20 < w as usize {
+            let letter = LETTERS[(next() % 5) as usize];
+            for (dy, row) in letter.iter().enumerate() {
+                for (dx, c) in row.bytes().enumerate() {
+                    for (py, px) in (0..9).map(|k| (baseline + 1 + 3 * dy + k / 3 - 3 * letter.len(), x + 3 * dx + k % 3)) {
+                        if c == b'#' {
+                            data[py * stride + px / 8] &= !(0x80 >> (px % 8));
+                        }
+                    }
+                }
+            }
+            x += 3 * letter[0].len() + 3 + if next() % 5 == 0 { 12 } else { 0 };
+        }
+    }
+    data
+}
+
+/// Text whose letters repeat exactly, as rendered text does, becomes JBIG2 symbols: each letter
+/// stored once and its copies placed, several times smaller than JBIG2's generic coding of the
+/// same image, and the page looks the same.
+#[test]
+fn rendered_text_becomes_jbig2_symbols() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (600, 480);
+    let text = rendered_text(w, h);
+    let im = mono_image(&mut doc, w, h, &text, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    // One image pixel a device pixel at scale 1, so a wrong pixel shows.
+    page(&mut doc, &[("Im", im)], "q 600 0 0 480 6 300 cm /Im Do Q");
+    let before = render(&doc);
+    let r = optimize(&mut doc, &Settings { mono: MonoCompression::Jbig2, ..Settings::default() }).unwrap();
+    assert_eq!(r.images_recompressed, 1);
+    let s = stream(&doc, im);
+    assert_eq!(s.dict.name(b"Filter"), Some(&b"JBIG2Decode"[..]));
+    let generic = pdfcraft_filters::encode_jbig2_generic(&text, w, h).unwrap();
+    assert!(s.raw.len() * 2 < generic.len(), "symbols {} bytes, generic {}", s.raw.len(), generic.len());
+    assert!(render(&doc) == before, "the page looks the same");
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index a1c26eefb4..68d26bcce4 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,6 +1,6 @@
 # PDF specification and standards parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: lossless JBIG2 encoding in the Optimizer; JBIG2 images export; earlier, §7.4: CCITT Group 4 encoding in the Optimizer) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: JBIG2 symbol coding in the Optimizer; earlier, lossless JBIG2 encoding, JBIG2 images export and CCITT Group 4 encoding) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -21,7 +21,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 |---|---|---|---|---|
 | §7.2–7.5 | Syntax, objects, file structure, xref tables and streams, object streams, hybrid files, incremental updates | full | **own**, tolerant, repairs damaged files | `crates/cos`; corpus 958 files; fuzzed nightly |
 | §7.4 | Stream filters: Flate, LZW, ASCII85, ASCIIHex, RunLength, predictors | full | **own** | `crates/filters` |
-| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding; **own** JBIG2 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; the Optimizer encodes CCITT Group 4 (`pdfcraft_filters::encode_g4`) and lossless JBIG2 (a generic region; no symbol coding), `optimize.mono-compression` |
+| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding; **own** JBIG2 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; the Optimizer encodes CCITT Group 4 (`pdfcraft_filters::encode_g4`) and lossless JBIG2 (a generic region, or symbols for exact copies; no refinement, `/JBIG2Globals` or lossy coding), `optimize.mono-compression` |
 | §7.5.8 | Linearization | R W | R only | `core.linearization` planned |
 | §7.6.4 | Standard security handler R2–R6 (RC4 40/128, AES-128, AES-256), crypt filters, `/EncryptMetadata`, SASLprep | full | **own**, read and write | `crates/crypt`; written files open in Acrobat DC since #836 (#774: Acrobat needs the catalog outside object streams) |
 | §7.6.5 | Public-key security handler | full | none | `core.open-public-key`, `protect.certificate-encryption` planned |
@@ -130,6 +130,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | §7.4: lossless JBIG2 symbol coding (symbol dictionaries and text regions, own, from the JBIG2 draft standard) in the Optimizer, used when smaller than the generic region |
 | 2026-10-26 | minor | §7.4: lossless JBIG2 generic-region encoding (own, from the JBIG2 draft standard) in the Optimizer; Export ▸ Images decodes JBIG2 |
 | 2026-10-26 | minor | §7.4: CCITT Group 4 encoding (`fax`) in the Optimizer |
 | 2026-10-14 | minor | §12.4.4: `/Trans` and `/Dur` read into `DocInfo::transitions` and reported by `doc_info` |
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 4f376cfb7f..804af97178 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,6 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
+> **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** minor (M11: lossless JBIG2 stores each distinct mark once, as a symbol; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-24 · **Change:** minor (M11: the PDF Optimizer can store black-and-white images as lossless JBIG2, and Export ▸ Images reads JBIG2 images; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
@@ -257,6 +258,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | M11: lossless JBIG2 symbol coding (`pdfcraft_filters::encode_jbig2`): each distinct mark stored once in a symbol dictionary and its exact copies placed by a text region, larger and lone marks in a generic region, used when smaller than the generic coding; on six pages of rendered 300 dpi text 28% of the generic region's size and 17% of Group 4's. Scans gain little until refinement coding; `/JBIG2Globals` and lossy coding not yet. Estimates unchanged. |
 | 2026-10-23 | minor | M11: lossless JBIG2 for black-and-white images (`pdfcraft_filters::encode_jbig2_generic`, a generic region coded with the MQ coder, written from the JBIG2 draft standard), as Monochrome Images ▸ JBIG2 (lossless) and `doc_optimize` `mono: jbig2`; about a third smaller than Group 4 on 300 dpi text. Export ▸ Images reads JBIG2 images (`hayro-jbig2`, with `/JBIG2Globals`). Symbol coding not yet. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 7bdf89ecad..c18856e3aa 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7384,8 +7384,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
-evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/filters/src/mq.rs::the_annex_h_test_sequence_encodes_to_its_bytes", "crates/filters/src/jbig2.rs::bitmaps_round_trip", "crates/filters/src/jbig2.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/optimize/tests/optimize.rs::black_and_white_images_become_jbig2", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4 (the default, so Reduce File Size does it too) or JBIG2, both lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. JBIG2 is a generic region (template 0, typical prediction), about a third smaller than Group 4 on 300 dpi text; a document below PDF 1.4 gets /Version 1.4. Not yet: JBIG2 symbol coding (text regions with symbol dictionaries, where JBIG2's larger gains on text come from, and its lossy mode), JBIG2Globals, monochrome downsampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to 1,048,576). Redaction doesn't decode JBIG2 or Group 4 yet: a mark over part of such an image removes the whole image (nothing leaks). Export reads JBIG2, but nothing that exports an image reads Group 4 yet: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
+evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/filters/src/mq.rs::the_annex_h_test_sequence_encodes_to_its_bytes", "crates/filters/src/jbig2.rs::bitmaps_round_trip", "crates/filters/src/jbig2.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/jbig2/symbols.rs::repeated_marks_are_stored_once", "crates/filters/src/jbig2/symbols.rs::scattered_marks_round_trip", "crates/optimize/tests/optimize.rs::black_and_white_images_become_jbig2", "crates/optimize/tests/optimize.rs::rendered_text_becomes_jbig2_symbols", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "CCITT Group 4 (the default, so Reduce File Size does it too) or JBIG2, both lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. JBIG2 stores each distinct mark once in a symbol dictionary and places its exact copies with a text region, larger and lone marks in a generic region (template 0, typical prediction), or the whole image as a generic region, whichever is smaller: on rendered 300 dpi text 28% of the generic region's size and 17% of Group 4's; on scans, whose copies of a letter are seldom identical, the generic region, about a third smaller than Group 4. A document below PDF 1.4 gets /Version 1.4. Not yet: JBIG2 refinement coding of near-copies (where lossless gains on scans would come from), a symbol dictionary shared between images (/JBIG2Globals), JBIG2's lossy mode, monochrome downsampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to 1,048,576). Redaction doesn't decode JBIG2 or Group 4 yet: a mark over part of such an image removes the whole image (nothing leaks). Export reads JBIG2, but nothing that exports an image reads Group 4 yet: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 0d40594cf9ff0ca4b421d8816257a7ec7860a28a Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 11:05:07 +0100
Subject: [PATCH 227/270] M11: JBIG2 symbol coding: tests for padding, the
 32-bit range and the mark rules

Review found behaviour the tests let break unnoticed (each was a
surviving mutant, and each new test fails on it):
- black padding bits: a run reaching past the row would stop symbol
  coding on many scans;
- Annex A's 32-bit range and PREV at exactly 256, where a decision would
  go uncoded: coordinates past 4,435 on a 12,000-pixel-wide and a
  10,050-row page, and the contexts of 4436's coding;
- marks joined at a corner are one mark; 256 pixels a side is a symbol,
  257 is left to the generic region;
- the run and row caps, at and past them.

The roadmap's status line for this change now comes first, and the
"about a third smaller than Group 4 on scans" figure is replaced by what
was measured: 27-33% on the same pages with scan-like noise added.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/filters/README.md            |  2 +-
 crates/filters/src/jbig2/symbols.rs | 94 ++++++++++++++++++++++++++++-
 crates/optimize/README.md           | 10 +--
 docs/roadmap.md                     |  2 +-
 parity/acrobat-features.toml        |  2 +-
 5 files changed, 100 insertions(+), 10 deletions(-)

diff --git a/crates/filters/README.md b/crates/filters/README.md
index 0113e22179..5df0761eb9 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -54,7 +54,7 @@ encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // t
 - `ccitt.rs`: Group 4 output decoded by `hayro-ccitt` (dev-dependency, an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
 - `mq.rs`: the arithmetic coder reproduces Annex H.2's 30 bytes from its 256 decisions.
 - `jbig2.rs`: output decoded by `hayro-jbig2` (dev-dependency, an independent decoder) matches the input bits: a text-like page (smaller than Group 4), edges, padding, all-white and all-black regions (typical rows), and property tests over bitmaps of noise and of runs; any input returns rather than panics.
-- `jbig2/symbols.rs`: the integer coders against Annex A's example and Table A.1; symbol-coded output decoded by `hayro-jbig2` matches the input bits for every plan and strip size: text whose letters repeat (under half the generic coding's size, the dictionary retained and referred to), large and lone marks left to a generic region, marks on the edges, touching at corners and inside each other's boxes, and property tests over glyphs scattered over each other and the edges with stray pixels (never larger than the generic coding); one shape, a blank page and noise are coded generically; any input returns rather than panics.
+- `jbig2/symbols.rs`: the integer coders against Annex A's example and Table A.1; symbol-coded output decoded by `hayro-jbig2` matches the input bits for every plan and strip size: text whose letters repeat (under half the generic coding's size, the dictionary retained and referred to), large and lone marks left to a generic region, marks on the edges, touching at corners and inside each other's boxes, and property tests over glyphs scattered over each other and the edges with stray pixels (never larger than the generic coding); one shape, a blank page and noise are coded generically; marks joined at a corner are one mark, and 256 pixels a side is a symbol while 257 is left out; black padding bits are ignored; coordinates past 4,435 use Annex A's 32-bit range and PREV stays below 512; past 2^20 runs or 2^24 rows the image is coded generically; any input returns rather than panics.
 - `fuzz/`: a detached cargo-fuzz crate (`cargo +nightly fuzz run decode`, run from `crates/filters/`).
 
 ## Status
diff --git a/crates/filters/src/jbig2/symbols.rs b/crates/filters/src/jbig2/symbols.rs
index 00aa187602..48013e9864 100644
--- a/crates/filters/src/jbig2/symbols.rs
+++ b/crates/filters/src/jbig2/symbols.rs
@@ -655,9 +655,97 @@ mod tests {
         let big = bits(Some(4436));
         assert_eq!((big.len(), &big[..6]), (6 + 32, &[0, 1, 1, 1, 1, 1][..]));
         assert!(big[6..].iter().all(|b| *b == 0));
-        // PREV keeps a leading 1 and the last eight decisions.
-        let contexts: Vec<usize> = decisions(Some(i32::MIN)).iter().map(|(cx, _)| *cx).collect();
-        assert!(contexts[..8].iter().all(|cx| *cx < 256) && contexts[8..].iter().all(|cx| (256..512).contains(cx)));
+        // PREV keeps a leading 1 and the last eight decisions, so it stays below 512, also when
+        // those eight are all 0 (PREV exactly 256), as in 4436's offset of 0.
+        for value in [Some(i32::MIN), Some(4436), Some(-4436), Some(4436 + 0x100), Some(i32::MAX), None] {
+            let contexts: Vec<usize> = decisions(value).iter().map(|(cx, _)| *cx).collect();
+            assert!(contexts.iter().take(8).all(|cx| *cx < 256) && contexts.iter().skip(8).all(|cx| (256..512).contains(cx)), "{value:?}");
+        }
+        assert!(decisions(Some(4436)).iter().any(|(cx, _)| *cx == 256));
+    }
+
+    /// Strips and first columns thousands of pixels apart need Annex A's 32-bit range: a mark at
+    /// the far right of a 12,000-pixel page, then one at the left below it (S back by 11,000), and
+    /// lines 5,000 rows apart. Each shape occurs twice, so both plans are made.
+    #[test]
+    fn coordinates_past_4435_round_trip() {
+        let shapes = glyphs(3, 4);
+        let mut picture = vec![vec![0u8; 12_000]; 40];
+        for (k, x) in [11_000, 0, 5_000, 11_980].into_iter().enumerate() {
+            draw(&mut picture, &shapes[k % 2], x, 2 + 9 * k as i64);
+        }
+        assert_eq!(every_plan_round_trips(&picture), 8);
+        let mut tall = vec![vec![0u8; 30]; 10_050];
+        for (k, y) in [0, 5_000, 10_030].into_iter().enumerate() {
+            draw(&mut tall, &shapes[k % 3], 3, y);
+            draw(&mut tall, &shapes[(k + 1) % 3], 15, y);
+        }
+        assert_eq!(every_plan_round_trips(&tall), 8);
+    }
+
+    /// The padding bits of a row whose width isn't a multiple of 8 are ignored whatever they are:
+    /// black (0) padding, as many scans have, neither joins the marks nor stops symbol coding.
+    #[test]
+    fn black_padding_bits_are_ignored() {
+        for columns in [13, 241, 901] {
+            let picture = text(columns, 120, &glyphs(12, 6), 8);
+            let mut data = samples(&picture);
+            let stride = columns.div_ceil(8);
+            for row in data.chunks_mut(stride) {
+                row[stride - 1] &= 0xFF << (8 * stride - columns);
+            }
+            let (c, r) = (columns as u32, 120);
+            let page = page(&data, c, r).unwrap();
+            assert!(page.marks.iter().all(|m| m.x1 as usize <= columns), "{columns} columns");
+            for copies in [1, 2] {
+                if let Some(coded) = plan(&page, c, r, copies, None) {
+                    assert_eq!(decode(&coded), unpack(&data, c, r), "{columns} columns");
+                }
+            }
+            if columns > 13 {
+                assert_eq!(segment_types(&encode_jbig2(&data, c, r).unwrap())[1], 0, "{columns} columns: symbol coded");
+            }
+        }
+    }
+
+    /// Pixels touching only at a corner are one mark (8-connected); side by side with a white
+    /// column between, two. A mark of 256 pixels a side is a symbol, one of 257 is left to the
+    /// generic region. The diagonal and the dot occur twice, so both plans are made.
+    #[test]
+    fn marks_join_at_corners_and_large_ones_are_left_out() {
+        let mut picture = vec![vec![0u8; 300]; 300];
+        for i in 0..6 {
+            picture[10 + i][10 + i] = 1;
+            picture[10 + i][100 + i] = 1;
+        }
+        picture[30][10] = 1;
+        picture[30][12] = 1;
+        picture[40][0..256].fill(1);
+        picture[60][0..257].fill(1);
+        for row in &mut picture[44..300] {
+            row[290] = 1;
+        }
+        let data = samples(&picture);
+        let page = page(&data, 300, 300).unwrap();
+        let boxes: Vec<(u32, u32, u32, u32)> = page.marks.iter().map(|m| (m.x0, m.y0, m.x1 - m.x0, m.y1 - m.y0)).collect();
+        assert_eq!(boxes, [(10, 10, 6, 6), (100, 10, 6, 6), (10, 30, 1, 1), (12, 30, 1, 1), (0, 40, 256, 1), (290, 44, 1, 256), (0, 60, 257, 1)]);
+        let large: Vec<(u32, u32)> = page.large.iter().map(|m| (page.marks[*m as usize].x0, page.marks[*m as usize].y0)).collect();
+        assert_eq!(large, [(0, 60)]);
+        assert_eq!(every_plan_round_trips(&picture), 8);
+    }
+
+    /// Past 2^20 black runs or 2^24 rows the image is left to generic coding; at 2^20 runs it is
+    /// still looked at.
+    #[test]
+    fn busy_or_tall_images_are_left_to_generic_coding() {
+        // 0x55: four black pixels a byte, each its own run, under the same ones on the next row.
+        let columns = 1 << 20;
+        let row = vec![0x55u8; columns / 8];
+        assert!(page(&row.repeat(2), columns as u32, 2).is_some(), "2^20 runs");
+        assert!(page(&row.repeat(3), columns as u32, 3).is_none(), "1.5 × 2^20 runs");
+        let tall = vec![0xFFu8; MAX_ROWS as usize + 1];
+        assert!(page(&tall, 1, MAX_ROWS + 1).is_none());
+        assert!(page(&tall, 1, MAX_ROWS).is_some());
     }
 
     /// A page of text whose letters repeat exactly, as rendered text does, keeps each letter once:
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 4c8ae1cd3e..97915f8d8c 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -40,10 +40,12 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   or lossless JBIG2 (`encode_jbig2`; a document below PDF 1.4 gets `/Version /1.4` in
   its catalog) when that is smaller as stored. JBIG2 stores each distinct mark once, as a
   symbol, when the image's marks repeat exactly, as rendered text's do: on six pages of
-  300 dpi text that came to 28% of a generic region's size and 17% of Group 4's. On scans, whose copies of a letter are seldom identical, it is a generic region,
-  about a third smaller than Group 4. It is lossless: the samples decode to the same bits, so the colour
-  space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
-  on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
+  300 dpi text that came to 28% of a generic region's size and 17% of Group 4's. On scans,
+  whose copies of a letter are seldom identical, it is nearly always a generic region: 27–33%
+  smaller than Group 4 on the same pages with scan-like noise added. It is lossless: the
+  samples decode to the same bits, so the colour space, decode array and masks stay. Group 4
+  wins on scans, whose ragged edges defeat Flate; on clean computer-drawn 1-bit art Flate can
+  be smaller, and the image then stays. Not yet:
   JBIG2 refinement coding (lossless gains on scans), a symbol dictionary shared between images
   (`/JBIG2Globals`), lossy JBIG2, monochrome downsampling, inline images, soft masks and
   `/Mask` images, and Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 804af97178..f21943c38f 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,8 +1,8 @@
 # PdfCraft roadmap: milestones and what's next
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
-> **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
 > **Last reviewed:** 2026-10-26 · **Last updated:** 2026-10-26 · **Change:** minor (M11: lossless JBIG2 stores each distinct mark once, as a symbol; estimates unchanged)
+> **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-24 · **Change:** minor (M11: the PDF Optimizer can store black-and-white images as lossless JBIG2, and Export ▸ Images reads JBIG2 images; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index c18856e3aa..e801495fde 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/filters/src/mq.rs::the_annex_h_test_sequence_encodes_to_its_bytes", "crates/filters/src/jbig2.rs::bitmaps_round_trip", "crates/filters/src/jbig2.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/jbig2/symbols.rs::repeated_marks_are_stored_once", "crates/filters/src/jbig2/symbols.rs::scattered_marks_round_trip", "crates/optimize/tests/optimize.rs::black_and_white_images_become_jbig2", "crates/optimize/tests/optimize.rs::rendered_text_becomes_jbig2_symbols", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4 (the default, so Reduce File Size does it too) or JBIG2, both lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. JBIG2 stores each distinct mark once in a symbol dictionary and places its exact copies with a text region, larger and lone marks in a generic region (template 0, typical prediction), or the whole image as a generic region, whichever is smaller: on rendered 300 dpi text 28% of the generic region's size and 17% of Group 4's; on scans, whose copies of a letter are seldom identical, the generic region, about a third smaller than Group 4. A document below PDF 1.4 gets /Version 1.4. Not yet: JBIG2 refinement coding of near-copies (where lossless gains on scans would come from), a symbol dictionary shared between images (/JBIG2Globals), JBIG2's lossy mode, monochrome downsampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to 1,048,576). Redaction doesn't decode JBIG2 or Group 4 yet: a mark over part of such an image removes the whole image (nothing leaks). Export reads JBIG2, but nothing that exports an image reads Group 4 yet: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
+notes = "CCITT Group 4 (the default, so Reduce File Size does it too) or JBIG2, both lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. JBIG2 stores each distinct mark once in a symbol dictionary and places its exact copies with a text region, larger and lone marks in a generic region (template 0, typical prediction), or the whole image as a generic region, whichever is smaller: on rendered 300 dpi text 28% of the generic region's size and 17% of Group 4's; on scans, whose copies of a letter are seldom identical, nearly always the generic region (27–33% smaller than Group 4 on the same pages with scan-like noise added). A document below PDF 1.4 gets /Version 1.4. Not yet: JBIG2 refinement coding of near-copies (where lossless gains on scans would come from), a symbol dictionary shared between images (/JBIG2Globals), JBIG2's lossy mode, monochrome downsampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to 1,048,576). Redaction doesn't decode JBIG2 or Group 4 yet: a mark over part of such an image removes the whole image (nothing leaks). Export reads JBIG2, but nothing that exports an image reads Group 4 yet: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 8eeafe330975a65b524c6a6a20d5a7fd852aa27a Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 11:22:15 +0100
Subject: [PATCH 228/270] M11: JBIG2 symbol coding: tests for tall marks, the
 other corner and the symbol caps

A second review found two rules tested one way only: a mark 257 tall
(not just wide) is left to the generic region, which also bounds the
bitmap allocated for each mark, and runs joined at the lower-left corner
are one mark. The test now has a 1 x 257 column and an anti-diagonal.
The caps on distinct symbols (65,536) and their pixels (2^24) are tested
at and past them, as the run and row caps are.

The scans figure now names its noise: with 2% or more of the letters'
edge pixels flipped, symbols save at most 8% over the generic region.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/filters/README.md            |  2 +-
 crates/filters/src/jbig2/symbols.rs | 73 ++++++++++++++++++++++++++---
 crates/optimize/README.md           |  5 +-
 parity/acrobat-features.toml        |  2 +-
 4 files changed, 72 insertions(+), 10 deletions(-)

diff --git a/crates/filters/README.md b/crates/filters/README.md
index 5df0761eb9..cf8ebb6558 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -54,7 +54,7 @@ encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // t
 - `ccitt.rs`: Group 4 output decoded by `hayro-ccitt` (dev-dependency, an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
 - `mq.rs`: the arithmetic coder reproduces Annex H.2's 30 bytes from its 256 decisions.
 - `jbig2.rs`: output decoded by `hayro-jbig2` (dev-dependency, an independent decoder) matches the input bits: a text-like page (smaller than Group 4), edges, padding, all-white and all-black regions (typical rows), and property tests over bitmaps of noise and of runs; any input returns rather than panics.
-- `jbig2/symbols.rs`: the integer coders against Annex A's example and Table A.1; symbol-coded output decoded by `hayro-jbig2` matches the input bits for every plan and strip size: text whose letters repeat (under half the generic coding's size, the dictionary retained and referred to), large and lone marks left to a generic region, marks on the edges, touching at corners and inside each other's boxes, and property tests over glyphs scattered over each other and the edges with stray pixels (never larger than the generic coding); one shape, a blank page and noise are coded generically; marks joined at a corner are one mark, and 256 pixels a side is a symbol while 257 is left out; black padding bits are ignored; coordinates past 4,435 use Annex A's 32-bit range and PREV stays below 512; past 2^20 runs or 2^24 rows the image is coded generically; any input returns rather than panics.
+- `jbig2/symbols.rs`: the integer coders against Annex A's example and Table A.1; symbol-coded output decoded by `hayro-jbig2` matches the input bits for every plan and strip size: text whose letters repeat (under half the generic coding's size, the dictionary retained and referred to), large and lone marks left to a generic region, marks on the edges, touching at corners and inside each other's boxes, and property tests over glyphs scattered over each other and the edges with stray pixels (never larger than the generic coding); one shape, a blank page and noise are coded generically; marks joined at a corner, either way, are one mark, and 256 pixels a side is a symbol while 257 wide or tall is left out; black padding bits are ignored; coordinates past 4,435 use Annex A's 32-bit range and PREV stays below 512; past 2^20 runs, 2^24 rows, 65,536 symbols or 2^24 symbol pixels the image is coded generically, and at each cap it is not; any input returns rather than panics.
 - `fuzz/`: a detached cargo-fuzz crate (`cargo +nightly fuzz run decode`, run from `crates/filters/`).
 
 ## Status
diff --git a/crates/filters/src/jbig2/symbols.rs b/crates/filters/src/jbig2/symbols.rs
index 48013e9864..e4c79bc585 100644
--- a/crates/filters/src/jbig2/symbols.rs
+++ b/crates/filters/src/jbig2/symbols.rs
@@ -708,15 +708,20 @@ mod tests {
         }
     }
 
-    /// Pixels touching only at a corner are one mark (8-connected); side by side with a white
-    /// column between, two. A mark of 256 pixels a side is a symbol, one of 257 is left to the
-    /// generic region. The diagonal and the dot occur twice, so both plans are made.
+    /// Pixels touching only at a corner, down to the right or down to the left, are one mark
+    /// (8-connected); side by side with a white column between, two. A mark of 256 pixels a side
+    /// is a symbol; one 257 wide, or 257 tall, is left to the generic region. The diagonal and the
+    /// dot occur twice, so both plans are made.
     #[test]
     fn marks_join_at_corners_and_large_ones_are_left_out() {
         let mut picture = vec![vec![0u8; 300]; 300];
         for i in 0..6 {
             picture[10 + i][10 + i] = 1;
             picture[10 + i][100 + i] = 1;
+            picture[10 + i][60 - i] = 1;
+        }
+        for row in &mut picture[0..257] {
+            row[280] = 1;
         }
         picture[30][10] = 1;
         picture[30][12] = 1;
@@ -728,9 +733,22 @@ mod tests {
         let data = samples(&picture);
         let page = page(&data, 300, 300).unwrap();
         let boxes: Vec<(u32, u32, u32, u32)> = page.marks.iter().map(|m| (m.x0, m.y0, m.x1 - m.x0, m.y1 - m.y0)).collect();
-        assert_eq!(boxes, [(10, 10, 6, 6), (100, 10, 6, 6), (10, 30, 1, 1), (12, 30, 1, 1), (0, 40, 256, 1), (290, 44, 1, 256), (0, 60, 257, 1)]);
+        assert_eq!(
+            boxes,
+            [
+                (280, 0, 1, 257),
+                (10, 10, 6, 6),
+                (55, 10, 6, 6),
+                (100, 10, 6, 6),
+                (10, 30, 1, 1),
+                (12, 30, 1, 1),
+                (0, 40, 256, 1),
+                (290, 44, 1, 256),
+                (0, 60, 257, 1)
+            ]
+        );
         let large: Vec<(u32, u32)> = page.large.iter().map(|m| (page.marks[*m as usize].x0, page.marks[*m as usize].y0)).collect();
-        assert_eq!(large, [(0, 60)]);
+        assert_eq!(large, [(280, 0), (0, 60)]);
         assert_eq!(every_plan_round_trips(&picture), 8);
     }
 
@@ -748,6 +766,49 @@ mod tests {
         assert!(page(&tall, 1, MAX_ROWS).is_some());
     }
 
+    /// Past 65,536 distinct symbols, or 2^24 pixels of them, the image is left to generic coding;
+    /// at either cap it is still looked at.
+    #[test]
+    fn too_many_symbols_are_left_to_generic_coding() {
+        // `n` distinct marks of 17 × 3: full top and bottom rows joined by a code of 1 to n, in
+        // binary, on the row between.
+        let codes = |n: usize| {
+            let (columns, rows) = (256 * 18, n.div_ceil(256) * 4);
+            let mut picture = vec![vec![0u8; columns]; rows];
+            for k in 0..n {
+                let (x, y) = (k % 256 * 18, k / 256 * 4);
+                picture[y][x..x + 17].fill(1);
+                picture[y + 2][x..x + 17].fill(1);
+                for b in (0..17).filter(|b| (k + 1) >> b & 1 == 1) {
+                    picture[y + 1][x + b] = 1;
+                }
+            }
+            (samples(&picture), columns as u32, rows as u32)
+        };
+        let (data, columns, rows) = codes(MAX_SYMBOLS);
+        assert_eq!(page(&data, columns, rows).map(|p| p.symbols.len()), Some(MAX_SYMBOLS));
+        let (data, columns, rows) = codes(MAX_SYMBOLS + 1);
+        assert!(page(&data, columns, rows).is_none());
+        // `n` black squares of 256 × 256, each with a white pixel in a different place: 2^16
+        // pixels a symbol, so 256 of them are exactly the cap.
+        let squares = |n: usize| {
+            let (columns, rows) = (16 * 258, n.div_ceil(16) * 258);
+            let mut picture = vec![vec![0u8; columns]; rows];
+            for k in 0..n {
+                let (x, y) = (k % 16 * 258, k / 16 * 258);
+                for row in &mut picture[y..y + 256] {
+                    row[x..x + 256].fill(1);
+                }
+                picture[y + 1 + k / 254][x + 1 + k % 254] = 0;
+            }
+            (samples(&picture), columns as u32, rows as u32)
+        };
+        let (data, columns, rows) = squares(256);
+        assert_eq!(page(&data, columns, rows).map(|p| p.symbols.len()), Some(256));
+        let (data, columns, rows) = squares(257);
+        assert!(page(&data, columns, rows).is_none());
+    }
+
     /// A page of text whose letters repeat exactly, as rendered text does, keeps each letter once:
     /// a symbol dictionary and a text region, much smaller than the generic coding.
     #[test]
@@ -798,7 +859,7 @@ mod tests {
         for (x, y) in [(10, 5), (28, 14), (12, 14)] {
             draw(&mut picture, &ell, x, y);
         }
-        // Corners touching: one mark.
+        // Corners touching: one mark (`marks_join_at_corners_and_large_ones_are_left_out` checks it).
         picture[3][6] = 1;
         picture[4][7] = 1;
         picture[5][8] = 1;
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 97915f8d8c..8648e39d86 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -41,8 +41,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   its catalog) when that is smaller as stored. JBIG2 stores each distinct mark once, as a
   symbol, when the image's marks repeat exactly, as rendered text's do: on six pages of
   300 dpi text that came to 28% of a generic region's size and 17% of Group 4's. On scans,
-  whose copies of a letter are seldom identical, it is nearly always a generic region: 27–33%
-  smaller than Group 4 on the same pages with scan-like noise added. It is lossless: the
+  whose copies of a letter are seldom identical, symbols gain little: on the same pages with 2%
+  or more of the letters' edge pixels flipped at random, at most 8% below a generic region,
+  which was 27–33% below Group 4. It is lossless: the
   samples decode to the same bits, so the colour space, decode array and masks stay. Group 4
   wins on scans, whose ragged edges defeat Flate; on clean computer-drawn 1-bit art Flate can
   be smaller, and the image then stays. Not yet:
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index e801495fde..2a83a68edf 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/filters/src/mq.rs::the_annex_h_test_sequence_encodes_to_its_bytes", "crates/filters/src/jbig2.rs::bitmaps_round_trip", "crates/filters/src/jbig2.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/jbig2/symbols.rs::repeated_marks_are_stored_once", "crates/filters/src/jbig2/symbols.rs::scattered_marks_round_trip", "crates/optimize/tests/optimize.rs::black_and_white_images_become_jbig2", "crates/optimize/tests/optimize.rs::rendered_text_becomes_jbig2_symbols", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4 (the default, so Reduce File Size does it too) or JBIG2, both lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. JBIG2 stores each distinct mark once in a symbol dictionary and places its exact copies with a text region, larger and lone marks in a generic region (template 0, typical prediction), or the whole image as a generic region, whichever is smaller: on rendered 300 dpi text 28% of the generic region's size and 17% of Group 4's; on scans, whose copies of a letter are seldom identical, nearly always the generic region (27–33% smaller than Group 4 on the same pages with scan-like noise added). A document below PDF 1.4 gets /Version 1.4. Not yet: JBIG2 refinement coding of near-copies (where lossless gains on scans would come from), a symbol dictionary shared between images (/JBIG2Globals), JBIG2's lossy mode, monochrome downsampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to 1,048,576). Redaction doesn't decode JBIG2 or Group 4 yet: a mark over part of such an image removes the whole image (nothing leaks). Export reads JBIG2, but nothing that exports an image reads Group 4 yet: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
+notes = "CCITT Group 4 (the default, so Reduce File Size does it too) or JBIG2, both lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. JBIG2 stores each distinct mark once in a symbol dictionary and places its exact copies with a text region, larger and lone marks in a generic region (template 0, typical prediction), or the whole image as a generic region, whichever is smaller: on rendered 300 dpi text 28% of the generic region's size and 17% of Group 4's; on scans, whose copies of a letter are seldom identical, little: on the same pages with 2% or more of the letters' edge pixels flipped at random, at most 8% below the generic region, which was 27–33% below Group 4. A document below PDF 1.4 gets /Version 1.4. Not yet: JBIG2 refinement coding of near-copies (where lossless gains on scans would come from), a symbol dictionary shared between images (/JBIG2Globals), JBIG2's lossy mode, monochrome downsampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to 1,048,576). Redaction doesn't decode JBIG2 or Group 4 yet: a mark over part of such an image removes the whole image (nothing leaks). Export reads JBIG2, but nothing that exports an image reads Group 4 yet: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From deb70c92cadadbaa474a13518299aabb73d9ff82 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 11:45:31 +0100
Subject: [PATCH 229/270] M11: JBIG2 symbol coding: at most 10,000 copies a
 text region and 32,767 symbols

A review found that a dense page came out as a stream PdfCraft's own
renderer refuses, so the page drew blank after optimizing: hayro-jbig2
decodes a text region of at most 10,000 symbol instances, and refuses
32,768 symbols or more. The stream was valid (Poppler decoded it), but
every mark went into one text region and up to 65,536 symbols were kept.
A 300 dpi letter page of the optimizer test's own text crossed it.

A page with more than 10,000 marks is now placed by several text
regions, each over a band of rows and all referring to the one symbol
dictionary, which each region but the last keeps retained (7.2.4). Past
32,767 distinct symbols the image is coded generically.

New tests: 25,000 copies placed by three regions, which decode; the
symbol caps decoded, not just reached; and in the optimizer, a whole
letter page of rendered text that looks the same as JBIG2 symbols (it
drew blank before). The READMEs say "still looked at" for the caps, and
that the scans figure is the six pages' total (20% on one page).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/filters/README.md            |   4 +-
 crates/filters/src/jbig2.rs         |  18 ++--
 crates/filters/src/jbig2/symbols.rs | 140 ++++++++++++++++++++--------
 crates/optimize/README.md           |   4 +-
 crates/optimize/tests/optimize.rs   |  18 ++++
 parity/acrobat-features.toml        |   2 +-
 6 files changed, 132 insertions(+), 54 deletions(-)

diff --git a/crates/filters/README.md b/crates/filters/README.md
index cf8ebb6558..0b06a485b6 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -44,7 +44,7 @@ encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // t
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
 | CCITTFaxDecode | not here (`Unsupported`; renderers decode it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
-| JBIG2Decode | not here (`Unsupported`; the renderer and image export decode it with `hayro-jbig2`) | `encode_jbig2_generic`: the embedded organisation (D.3) with a page information segment and an immediate lossless generic region (7.4.6), no `/JBIG2Globals`; template 0 with its nominal AT pixels and typical prediction (6.2.5), coded with the MQ arithmetic coder (Annex E, Table E.1) and ended by its 0xFF 0xAC marker. A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, so the stream decodes to the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 1,048,576 samples a row; no rows or columns, or too wide → Unsupported, too few bytes → Corrupt. `encode_jbig2`: the smaller of that and symbol coding (`jbig2/symbols.rs`): each distinct mark (8-connected black pixels, at most 256 a side) stored once in a symbol dictionary (7.4.2; arithmetic coded, each bitmap a template 0 generic region without typical prediction, the bitmaps sharing their contexts) and placed by an immediate lossless text region referring to it (7.4.3; bottom-left reference corner, strips of 1, 2, 4 or 8 rows, whichever is smallest), with larger marks, and in a second plan marks that occur once, in a generic region over their box. Only exact copies share a symbol (no refinement), so the stream decodes to the same bits; fewer than two symbols, more than 2^20 black runs, 65,536 symbols or 16 MiB of symbol pixels, or more than 2^24 rows, and the generic coding is used |
+| JBIG2Decode | not here (`Unsupported`; the renderer and image export decode it with `hayro-jbig2`) | `encode_jbig2_generic`: the embedded organisation (D.3) with a page information segment and an immediate lossless generic region (7.4.6), no `/JBIG2Globals`; template 0 with its nominal AT pixels and typical prediction (6.2.5), coded with the MQ arithmetic coder (Annex E, Table E.1) and ended by its 0xFF 0xAC marker. A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, so the stream decodes to the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 1,048,576 samples a row; no rows or columns, or too wide → Unsupported, too few bytes → Corrupt. `encode_jbig2`: the smaller of that and symbol coding (`jbig2/symbols.rs`): each distinct mark (8-connected black pixels, at most 256 a side) stored once in a symbol dictionary (7.4.2; arithmetic coded, each bitmap a template 0 generic region without typical prediction, the bitmaps sharing their contexts) and placed by immediate lossless text regions referring to it (7.4.3; bottom-left reference corner, strips of 1, 2, 4 or 8 rows, whichever is smallest), each of at most 10,000 instances over a band of rows, as the decoder PdfCraft renders with (`hayro-jbig2`) takes no more in one region, with larger marks, and in a second plan marks that occur once, in a generic region over their box. Only exact copies share a symbol (no refinement), so the stream decodes to the same bits; fewer than two symbols, more than 2^20 black runs, 32,767 symbols (that decoder refuses more) or 16 MiB of symbol pixels, or more than 2^24 rows, and the generic coding is used |
 
 ## Tests
 
@@ -54,7 +54,7 @@ encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // t
 - `ccitt.rs`: Group 4 output decoded by `hayro-ccitt` (dev-dependency, an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
 - `mq.rs`: the arithmetic coder reproduces Annex H.2's 30 bytes from its 256 decisions.
 - `jbig2.rs`: output decoded by `hayro-jbig2` (dev-dependency, an independent decoder) matches the input bits: a text-like page (smaller than Group 4), edges, padding, all-white and all-black regions (typical rows), and property tests over bitmaps of noise and of runs; any input returns rather than panics.
-- `jbig2/symbols.rs`: the integer coders against Annex A's example and Table A.1; symbol-coded output decoded by `hayro-jbig2` matches the input bits for every plan and strip size: text whose letters repeat (under half the generic coding's size, the dictionary retained and referred to), large and lone marks left to a generic region, marks on the edges, touching at corners and inside each other's boxes, and property tests over glyphs scattered over each other and the edges with stray pixels (never larger than the generic coding); one shape, a blank page and noise are coded generically; marks joined at a corner, either way, are one mark, and 256 pixels a side is a symbol while 257 wide or tall is left out; black padding bits are ignored; coordinates past 4,435 use Annex A's 32-bit range and PREV stays below 512; past 2^20 runs, 2^24 rows, 65,536 symbols or 2^24 symbol pixels the image is coded generically, and at each cap it is not; any input returns rather than panics.
+- `jbig2/symbols.rs`: the integer coders against Annex A's example and Table A.1; symbol-coded output decoded by `hayro-jbig2` matches the input bits for every plan and strip size: text whose letters repeat (under half the generic coding's size, the dictionary retained and referred to), large and lone marks left to a generic region, marks on the edges, touching at corners and inside each other's boxes, and property tests over glyphs scattered over each other and the edges with stray pixels (never larger than the generic coding); one shape, a blank page and noise are coded generically; marks joined at a corner, either way, are one mark, and 256 pixels a side is a symbol while 257 wide or tall is left out; black padding bits are ignored; coordinates past 4,435 use Annex A's 32-bit range and PREV stays below 512; past 2^20 runs, 2^24 rows, 32,767 symbols or 2^24 symbol pixels the image is coded generically, at each cap it is still looked at, and at the two symbol caps it decodes; more than 10,000 marks are placed by several text regions, the dictionary retained for each but the last; any input returns rather than panics.
 - `fuzz/`: a detached cargo-fuzz crate (`cargo +nightly fuzz run decode`, run from `crates/filters/`).
 
 ## Status
diff --git a/crates/filters/src/jbig2.rs b/crates/filters/src/jbig2.rs
index d3b37e5aef..343fbbd27d 100644
--- a/crates/filters/src/jbig2.rs
+++ b/crates/filters/src/jbig2.rs
@@ -139,16 +139,18 @@ fn at_pixels(out: &mut Vec<u8>) {
 }
 
 /// A segment (7.2): its header (number, type, the segments it refers to, page 1, data length),
-/// then its data. `retained`: a later segment refers to this one. Segment numbers here are below
-/// 256, so each referred-to one takes a byte (7.2.5); a segment refers to at most four, so their
-/// count and retain bits take one byte too (7.2.4), and the retain bits of the referred-to ones
-/// are 0: nothing after this segment refers to them.
-fn segment(out: &mut Vec<u8>, number: u32, kind: u8, refers_to: &[u8], retained: bool, data: &[u8]) {
+/// then its data. `retained`: a later segment refers to this one. `refers_to` holds each
+/// referred-to segment's number and whether a segment after this one refers to it too (its
+/// retain bit, 7.2.4). Segment numbers here stay below 256, so each referred-to one takes a byte
+/// (7.2.5); a segment refers to at most four, so their count and retain bits take one byte too.
+fn segment(out: &mut Vec<u8>, number: u32, kind: u8, refers_to: &[(u8, bool)], retained: bool, data: &[u8]) {
     out.extend_from_slice(&number.to_be_bytes());
     out.push(kind);
-    let count = refers_to.len().min(4);
-    out.push((count as u8) << 5 | u8::from(retained));
-    out.extend_from_slice(refers_to.get(..count).unwrap_or_default());
+    // At most four, so the count fits its three bits.
+    let refers_to = refers_to.get(..refers_to.len().min(4)).unwrap_or_default();
+    let kept = refers_to.iter().enumerate().fold(0u8, |bits, (k, (_, kept))| bits | u8::from(*kept) << (k + 1));
+    out.push((refers_to.len() as u8) << 5 | kept | u8::from(retained));
+    out.extend(refers_to.iter().map(|(n, _)| *n));
     out.push(1);
     // A segment's data never comes near 4 GiB here: a row is at most 1 MiB wide.
     out.extend_from_slice(&u32::try_from(data.len()).unwrap_or(u32::MAX).to_be_bytes());
diff --git a/crates/filters/src/jbig2/symbols.rs b/crates/filters/src/jbig2/symbols.rs
index e4c79bc585..a34653e748 100644
--- a/crates/filters/src/jbig2/symbols.rs
+++ b/crates/filters/src/jbig2/symbols.rs
@@ -1,8 +1,8 @@
 //! JBIG2 symbol coding, lossless: each distinct mark of an image (a group of black pixels that
-//! touch, side by side or at a corner) is stored once, as a symbol in a symbol dictionary, and a
-//! text region places a copy of it wherever it occurs. Marks too large to be symbols (rules,
-//! frames, pictures) are left to a generic region beside it, and so, in [`encode`]'s second plan,
-//! are marks that occur only once. Only exact copies share a symbol, so the image decodes to the
+//! touch, side by side or at a corner) is stored once, as a symbol in a symbol dictionary, and
+//! text regions place a copy of it wherever it occurs. Marks too large to be symbols (rules,
+//! frames, pictures) are left to a generic region beside them, and so, in [`encode`]'s second
+//! plan, are marks that occur only once. Only exact copies share a symbol, so the image decodes to the
 //! same bits. Written from the committee draft's 6.4 (the text region decoding procedure), 6.5
 //! (the symbol dictionary decoding procedure), 7.4.2 and 7.4.3 (their segments) and Annex A (the
 //! arithmetic integer coders).
@@ -21,10 +21,18 @@ const MAX_SYMBOL_SIDE: u32 = 256;
 /// which suits it better anyway; this bounds the memory the marks take.
 const MAX_RUNS: usize = 1 << 20;
 
-/// The most distinct symbols, and the most pixels their bitmaps may hold together.
-const MAX_SYMBOLS: usize = 1 << 16;
+/// The most distinct symbols, and the most pixels their bitmaps may hold together. The decoder
+/// PdfCraft renders JBIG2 with (`hayro-jbig2`) refuses 32,768 symbols or more, and others may
+/// too: past it the image is coded generically.
+const MAX_SYMBOLS: usize = (1 << 15) - 1;
 const MAX_SYMBOL_PIXELS: usize = 1 << 24;
 
+/// The most symbol instances one text region places. The decoder PdfCraft renders JBIG2 with
+/// refuses a text region of more than 10,000 (a page it then draws blank), so a page with more is
+/// placed by several regions, each over a band of rows, all referring to the one dictionary. At
+/// most [`MAX_RUNS`] marks keeps their segment numbers below 256.
+const MAX_REGION_INSTANCES: usize = 10_000;
+
 /// The most rows symbol coded. With rows at most 2^20 samples wide, every coordinate and
 /// difference coded then fits the 32-bit integers Annex A codes.
 const MAX_ROWS: u32 = 1 << 24;
@@ -73,14 +81,15 @@ struct Page {
     large: Vec<u32>,
 }
 
-/// A symbol instance (6.4.5): the symbol, and where its bottom-left pixel goes, as S (the column)
-/// and T (the row). `width` is the symbol's.
+/// A symbol instance (6.4.5): the symbol, and where its bottom-left pixel goes on the page, as S
+/// (the column) and T (the row). `width` and `height` are the symbol's.
 #[derive(Clone, Copy, Debug)]
 struct Instance {
     id: u32,
     s: u32,
     t: u32,
     width: u32,
+    height: u32,
 }
 
 /// `rows` rows of `columns` 1-bit PDF samples (black 0), symbol coded: the smaller of two plans,
@@ -283,8 +292,8 @@ fn symbols(page: &mut Page) -> Option<()> {
     Some(())
 }
 
-/// One plan's stream: the symbols with at least `copies` uses in a symbol dictionary, a text
-/// region placing them (in strips of 2^`log_strips` rows, or whichever size codes smallest), and
+/// One plan's stream: the symbols with at least `copies` uses in a symbol dictionary, text
+/// regions placing them (in strips of 2^`log_strips` rows, or whichever size codes smallest), and
 /// the other marks in a generic region. `None` with fewer than two such symbols: their IDs would
 /// take no bits at all (SBSYMCODELEN 0), a corner of the standard left alone here.
 fn plan(page: &Page, columns: u32, rows: u32, copies: u32, log_strips: Option<u32>) -> Option<Vec<u8>> {
@@ -305,23 +314,37 @@ fn plan(page: &Page, columns: u32, rows: u32, copies: u32, log_strips: Option<u3
     let mut left = page.large.clone();
     for (s, m) in &page.copies {
         match (id.get(*s as usize).copied().flatten(), page.marks.get(*m as usize), symbol(*s)) {
-            (Some(id), Some(mark), Some(symbol)) => instances.push(Instance { id, s: mark.x0, t: mark.y1.saturating_sub(1), width: symbol.width }),
+            (Some(id), Some(mark), Some(symbol)) => {
+                instances.push(Instance { id, s: mark.x0, t: mark.y1.saturating_sub(1), width: symbol.width, height: symbol.height })
+            }
             _ => left.push(*m),
         }
     }
     let kept: Vec<&Symbol> = kept.iter().filter_map(|s| symbol(*s)).collect();
     let dictionary = symbol_dictionary(&kept)?;
     let count = u32::try_from(kept.len()).ok()?;
-    let text = match log_strips {
-        Some(l) => text_region(&mut instances, count, columns, rows, l)?,
-        None => (0..4).filter_map(|l| text_region(&mut instances, count, columns, rows, l)).min_by_key(Vec::len)?,
-    };
+    // Bands of at most MAX_REGION_INSTANCES, from the top.
+    instances.sort_by_key(|i| (i.t, i.s));
+    let mut regions = Vec::new();
+    for band in instances.chunks_mut(MAX_REGION_INSTANCES) {
+        let top = band.iter().map(|i| i.t.saturating_add(1).saturating_sub(i.height)).min()?;
+        let height = band.iter().map(|i| i.t).max()?.checked_sub(top)?.checked_add(1)?;
+        regions.push(match log_strips {
+            Some(l) => text_region(band, count, columns, top, height, l)?,
+            None => (0..4).filter_map(|l| text_region(band, count, columns, top, height, l)).min_by_key(Vec::len)?,
+        });
+    }
     let mut out = Vec::new();
     segment(&mut out, 0, 48, &[], false, &page_information(columns, rows));
     segment(&mut out, 1, 0, &[], true, &dictionary);
-    segment(&mut out, 2, 7, &[1], false, &text);
+    let mut number = 2;
+    for (k, text) in regions.iter().enumerate() {
+        // The dictionary stays retained for the next region, until the last (7.2.4).
+        segment(&mut out, number, 7, &[(1, k + 1 < regions.len())], false, text);
+        number += 1;
+    }
     if !left.is_empty() {
-        segment(&mut out, 3, 39, &[], false, &leftover_region(&left, page)?);
+        segment(&mut out, number, 39, &[], false, &leftover_region(&left, page)?);
     }
     Some(out)
 }
@@ -363,20 +386,22 @@ fn symbol_dictionary(symbols: &[&Symbol]) -> Option<Vec<u8>> {
     Some(data)
 }
 
-/// An immediate lossless text region segment's data (7.4.3) placing `instances` over the whole
-/// page: arithmetic coded, no refinement, strips of 2^`log_strips` rows, each symbol's
-/// bottom-left pixel at (S, T) (REFCORNER BOTTOMLEFT, so a line's letters share their T),
-/// not transposed, OR, default pixel 0, SBDSOFFSET 0. Sorts `instances` into strips, each
-/// left to right.
-fn text_region(instances: &mut [Instance], symbols: u32, columns: u32, rows: u32, log_strips: u32) -> Option<Vec<u8>> {
+/// An immediate lossless text region segment's data (7.4.3) placing `instances` in the band of
+/// `height` rows from row `top` (which holds them): arithmetic coded, no refinement, strips of
+/// 2^`log_strips` rows, each symbol's bottom-left pixel at (S, T) (REFCORNER BOTTOMLEFT, so a
+/// line's letters share their T), not transposed, OR, default pixel 0, SBDSOFFSET 0. Sorts
+/// `instances` into strips, each left to right.
+fn text_region(instances: &mut [Instance], symbols: u32, columns: u32, top: u32, height: u32, log_strips: u32) -> Option<Vec<u8>> {
     // LOGSBSTRIPS has two bits: strips of 1, 2, 4 or 8 rows.
     if log_strips > 3 {
         return None;
     }
     let strips = 1i64 << log_strips;
-    instances.sort_by_key(|i| (i.t >> log_strips, i.s));
+    // T counts from the band's top row.
+    let t = |i: &Instance| i.t.saturating_sub(top);
+    instances.sort_by_key(|i| (t(i) >> log_strips, i.s));
     let mut data = Vec::new();
-    region_information(&mut data, columns, rows, 0, 0);
+    region_information(&mut data, columns, height, 0, top);
     data.extend_from_slice(&((log_strips as u16) << 2).to_be_bytes());
     data.extend_from_slice(&u32::try_from(instances.len()).ok()?.to_be_bytes());
     // SBSYMCODELEN (Table 31): ⌈log2 SBNUMSYMS⌉.
@@ -388,10 +413,10 @@ fn text_region(instances: &mut [Instance], symbols: u32, columns: u32, rows: u32
     // strip size, from the strip before.
     iadt.encode(&mut mq, Some(0));
     let (mut strip_t, mut first_s) = (0i64, 0i64);
-    for strip in instances.chunk_by(|a, b| a.t >> log_strips == b.t >> log_strips) {
-        let t = i64::from(strip.first()?.t >> log_strips << log_strips);
-        iadt.encode(&mut mq, Some(int((t - strip_t) / strips)?));
-        strip_t = t;
+    for strip in instances.chunk_by(|a, b| t(a) >> log_strips == t(b) >> log_strips) {
+        let first = i64::from(t(strip.first()?) >> log_strips << log_strips);
+        iadt.encode(&mut mq, Some(int((first - strip_t) / strips)?));
+        strip_t = first;
         let mut cur_s = 0;
         for (k, instance) in strip.iter().enumerate() {
             let s = i64::from(instance.s);
@@ -402,7 +427,7 @@ fn text_region(instances: &mut [Instance], symbols: u32, columns: u32, rows: u32
                 iads.encode(&mut mq, Some(int(s - cur_s)?));
             }
             if strips > 1 {
-                iait.encode(&mut mq, Some(int(i64::from(instance.t) - strip_t)?));
+                iait.encode(&mut mq, Some(int(i64::from(t(instance)) - strip_t)?));
             }
             encode_id(&mut mq, &mut ids, length, instance.id);
             // The next S counts from this symbol's last column (6.4.5 step 3c x).
@@ -603,15 +628,20 @@ mod tests {
         page
     }
 
-    /// The segments of a stream in the embedded organisation, from their headers (7.2): each one's
-    /// type, whether it is retained, and the segments it refers to.
-    fn segments(data: &[u8]) -> Vec<(u8, bool, Vec<u8>)> {
+    /// A segment's type, whether it is retained, and the segments it refers to, each with its
+    /// retain bit.
+    type Segment = (u8, bool, Vec<(u8, bool)>);
+
+    /// The segments of a stream in the embedded organisation, from their headers (7.2).
+    fn segments(data: &[u8]) -> Vec<Segment> {
         let (mut segments, mut at) = (Vec::new(), 0);
         while at < data.len() {
-            let refers = usize::from(data[at + 5] >> 5);
+            let flags = data[at + 5];
+            let refers = usize::from(flags >> 5);
             let length_at = at + 6 + refers + 1;
             let length = u32::from_be_bytes(data[length_at..length_at + 4].try_into().unwrap()) as usize;
-            segments.push((data[at + 4] & 0x3F, data[at + 5] & 1 == 1, data[at + 6..at + 6 + refers].to_vec()));
+            let referred = data[at + 6..at + 6 + refers].iter().enumerate().map(|(k, n)| (*n, flags >> (k + 1) & 1 == 1)).collect();
+            segments.push((data[at + 4] & 0x3F, flags & 1 == 1, referred));
             at = length_at + 4 + length;
         }
         segments
@@ -752,7 +782,7 @@ mod tests {
         assert_eq!(every_plan_round_trips(&picture), 8);
     }
 
-    /// Past 2^20 black runs or 2^24 rows the image is left to generic coding; at 2^20 runs it is
+    /// Past 2^20 black runs or 2^24 rows the image is left to generic coding; at either cap it is
     /// still looked at.
     #[test]
     fn busy_or_tall_images_are_left_to_generic_coding() {
@@ -766,8 +796,8 @@ mod tests {
         assert!(page(&tall, 1, MAX_ROWS).is_some());
     }
 
-    /// Past 65,536 distinct symbols, or 2^24 pixels of them, the image is left to generic coding;
-    /// at either cap it is still looked at.
+    /// Past 32,767 distinct symbols, or 2^24 pixels of them, the image is left to generic coding;
+    /// at either cap it is symbol coded, and decodes.
     #[test]
     fn too_many_symbols_are_left_to_generic_coding() {
         // `n` distinct marks of 17 × 3: full top and bottom rows joined by a code of 1 to n, in
@@ -785,8 +815,12 @@ mod tests {
             }
             (samples(&picture), columns as u32, rows as u32)
         };
+        // At the cap the symbols are coded, and an independent decoder reads them back.
         let (data, columns, rows) = codes(MAX_SYMBOLS);
-        assert_eq!(page(&data, columns, rows).map(|p| p.symbols.len()), Some(MAX_SYMBOLS));
+        let at_cap = page(&data, columns, rows).unwrap();
+        assert_eq!(at_cap.symbols.len(), MAX_SYMBOLS);
+        let coded = plan(&at_cap, columns, rows, 1, None).unwrap();
+        assert_eq!(decode(&coded), unpack(&data, columns, rows));
         let (data, columns, rows) = codes(MAX_SYMBOLS + 1);
         assert!(page(&data, columns, rows).is_none());
         // `n` black squares of 256 × 256, each with a white pixel in a different place: 2^16
@@ -804,11 +838,35 @@ mod tests {
             (samples(&picture), columns as u32, rows as u32)
         };
         let (data, columns, rows) = squares(256);
-        assert_eq!(page(&data, columns, rows).map(|p| p.symbols.len()), Some(256));
+        let at_cap = page(&data, columns, rows).unwrap();
+        assert_eq!(at_cap.symbols.len(), 256);
+        assert_eq!(decode(&plan(&at_cap, columns, rows, 1, None).unwrap()), unpack(&data, columns, rows));
         let (data, columns, rows) = squares(257);
         assert!(page(&data, columns, rows).is_none());
     }
 
+    /// More than 10,000 marks are placed by several text regions, each of at most 10,000 (more
+    /// than the decoder PdfCraft renders with accepts in one), over bands of rows, all referring to
+    /// the dictionary, which each region but the last keeps retained.
+    #[test]
+    fn more_than_10000_marks_are_placed_by_several_regions() {
+        // 25,000 copies of two 17 × 3 shapes, 256 a line, the lines 5 rows apart.
+        let mut picture = vec![vec![0u8; 256 * 18]; 25_000usize.div_ceil(256) * 5];
+        for k in 0..25_000 {
+            let (x, y) = (k % 256 * 18, k / 256 * 5);
+            picture[y][x..x + 17].fill(1);
+            picture[y + 2][x..x + 17].fill(1);
+            picture[y + 1][x + k % 2] = 1;
+        }
+        let data = samples(&picture);
+        let (columns, rows) = (picture[0].len() as u32, picture.len() as u32);
+        let coded = encode_jbig2(&data, columns, rows).unwrap();
+        let region = |kept| (7, false, vec![(1, kept)]);
+        assert_eq!(segments(&coded), [(48, false, vec![]), (0, true, vec![]), region(true), region(true), region(false)]);
+        assert_eq!(decode(&coded), unpack(&data, columns, rows));
+        assert_eq!(every_plan_round_trips(&picture), 8);
+    }
+
     /// A page of text whose letters repeat exactly, as rendered text does, keeps each letter once:
     /// a symbol dictionary and a text region, much smaller than the generic coding.
     #[test]
@@ -818,7 +876,7 @@ mod tests {
         let coded = encode_jbig2(&data, 1700, 400).unwrap();
         let generic = encode_jbig2_generic(&data, 1700, 400).unwrap();
         // The dictionary is retained for the text region, which refers to it (7.2.4, 7.2.5).
-        assert_eq!(segments(&coded), [(48, false, vec![]), (0, true, vec![]), (7, false, vec![1])]);
+        assert_eq!(segments(&coded), [(48, false, vec![]), (0, true, vec![]), (7, false, vec![(1, false)])]);
         assert_eq!(decode(&coded), unpack(&data, 1700, 400));
         assert!(coded.len() * 2 < generic.len(), "symbols {} bytes, generic {}", coded.len(), generic.len());
         assert_eq!(every_plan_round_trips(&picture), 8);
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 8648e39d86..928a2fbacd 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -42,8 +42,8 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   symbol, when the image's marks repeat exactly, as rendered text's do: on six pages of
   300 dpi text that came to 28% of a generic region's size and 17% of Group 4's. On scans,
   whose copies of a letter are seldom identical, symbols gain little: on the same pages with 2%
-  or more of the letters' edge pixels flipped at random, at most 8% below a generic region,
-  which was 27–33% below Group 4. It is lossless: the
+  or more of the letters' edge pixels flipped at random, at most 8% below a generic region in
+  total (20% on one page), and the generic region was 27–33% below Group 4. It is lossless: the
   samples decode to the same bits, so the colour space, decode array and masks stay. Group 4
   wins on scans, whose ragged edges defeat Flate; on clean computer-drawn 1-bit art Flate can
   be smaller, and the image then stays. Not yet:
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index a4315e2392..a349d8cb1b 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -734,6 +734,24 @@ fn rendered_text_becomes_jbig2_symbols() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// A whole 300 dpi letter page of rendered text, more marks than one JBIG2 text region of the
+/// decoder PdfCraft renders with takes, still looks the same as JBIG2 symbols.
+#[test]
+fn a_dense_page_of_rendered_text_looks_the_same_as_jbig2_symbols() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (2550, 3300);
+    let text = rendered_text(w, h);
+    let im = mono_image(&mut doc, w, h, &text, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    page(&mut doc, &[("Im", im)], "q 612 0 0 792 0 0 cm /Im Do Q");
+    let before = render(&doc);
+    let r = optimize(&mut doc, &Settings { mono: MonoCompression::Jbig2, ..Settings::default() }).unwrap();
+    assert_eq!(r.images_recompressed, 1);
+    let s = stream(&doc, im);
+    assert_eq!(s.dict.name(b"Filter"), Some(&b"JBIG2Decode"[..]));
+    assert!(s.raw.len() * 2 < pdfcraft_filters::encode_jbig2_generic(&text, w, h).unwrap().len(), "symbol coded");
+    assert!(render(&doc) == before, "the page looks the same");
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 2a83a68edf..a57ed83df6 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/filters/src/mq.rs::the_annex_h_test_sequence_encodes_to_its_bytes", "crates/filters/src/jbig2.rs::bitmaps_round_trip", "crates/filters/src/jbig2.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/jbig2/symbols.rs::repeated_marks_are_stored_once", "crates/filters/src/jbig2/symbols.rs::scattered_marks_round_trip", "crates/optimize/tests/optimize.rs::black_and_white_images_become_jbig2", "crates/optimize/tests/optimize.rs::rendered_text_becomes_jbig2_symbols", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4 (the default, so Reduce File Size does it too) or JBIG2, both lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. JBIG2 stores each distinct mark once in a symbol dictionary and places its exact copies with a text region, larger and lone marks in a generic region (template 0, typical prediction), or the whole image as a generic region, whichever is smaller: on rendered 300 dpi text 28% of the generic region's size and 17% of Group 4's; on scans, whose copies of a letter are seldom identical, little: on the same pages with 2% or more of the letters' edge pixels flipped at random, at most 8% below the generic region, which was 27–33% below Group 4. A document below PDF 1.4 gets /Version 1.4. Not yet: JBIG2 refinement coding of near-copies (where lossless gains on scans would come from), a symbol dictionary shared between images (/JBIG2Globals), JBIG2's lossy mode, monochrome downsampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to 1,048,576). Redaction doesn't decode JBIG2 or Group 4 yet: a mark over part of such an image removes the whole image (nothing leaks). Export reads JBIG2, but nothing that exports an image reads Group 4 yet: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
+notes = "CCITT Group 4 (the default, so Reduce File Size does it too) or JBIG2, both lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. JBIG2 stores each distinct mark once in a symbol dictionary and places its exact copies with text regions (at most 10,000 copies each), larger and lone marks in a generic region (template 0, typical prediction), or the whole image as a generic region, whichever is smaller: on rendered 300 dpi text 28% of the generic region's size and 17% of Group 4's; on scans, whose copies of a letter are seldom identical, little: on the same pages with 2% or more of the letters' edge pixels flipped at random, at most 8% below the generic region in total (20% on one page), and the generic region was 27–33% below Group 4. A document below PDF 1.4 gets /Version 1.4. Not yet: JBIG2 refinement coding of near-copies (where lossless gains on scans would come from), a symbol dictionary shared between images (/JBIG2Globals), JBIG2's lossy mode, monochrome downsampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples (JBIG2 takes rows of up to 1,048,576). Redaction doesn't decode JBIG2 or Group 4 yet: a mark over part of such an image removes the whole image (nothing leaks). Export reads JBIG2, but nothing that exports an image reads Group 4 yet: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From fe05b73d08bf2095cf9d769042df1f255665ebe4 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 12:09:03 +0100
Subject: [PATCH 230/270] M11: JBIG2 symbol coding: tests for region numbering;
 the symbol cap applies to each plan

Review of the previous commit:
- Nothing checked the segment numbers the region split assigns: a
  mutant numbering every region 2 decoded. The many-marks test now
  reads each segment's number, and has a bar too tall to be a symbol,
  so the generic region is numbered after the last text region.
- The decoder's 32,767-symbol limit was checked against all distinct
  marks, before either plan, so an image with more distinct marks lost
  the second plan, which codes only the repeated ones. The limit now
  applies to each plan (MAX_CODED_SYMBOLS); finding marks keeps its
  memory bound of 65,536 (MAX_SYMBOLS), as before the previous commit.
  A test has 32,768 distinct marks above a page of repeated text, which
  encode_jbig2 still symbol codes through the second plan.
- The dense-page optimizer test now checks that it takes several text
  regions, and a compile-time assert keeps segment numbers within a
  byte's reach.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/filters/README.md            |   4 +-
 crates/filters/src/jbig2/symbols.rs | 114 +++++++++++++++++++---------
 crates/optimize/tests/optimize.rs   |  11 +++
 3 files changed, 93 insertions(+), 36 deletions(-)

diff --git a/crates/filters/README.md b/crates/filters/README.md
index 0b06a485b6..333ee1e59b 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -44,7 +44,7 @@ encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // t
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
 | CCITTFaxDecode | not here (`Unsupported`; renderers decode it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
-| JBIG2Decode | not here (`Unsupported`; the renderer and image export decode it with `hayro-jbig2`) | `encode_jbig2_generic`: the embedded organisation (D.3) with a page information segment and an immediate lossless generic region (7.4.6), no `/JBIG2Globals`; template 0 with its nominal AT pixels and typical prediction (6.2.5), coded with the MQ arithmetic coder (Annex E, Table E.1) and ended by its 0xFF 0xAC marker. A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, so the stream decodes to the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 1,048,576 samples a row; no rows or columns, or too wide → Unsupported, too few bytes → Corrupt. `encode_jbig2`: the smaller of that and symbol coding (`jbig2/symbols.rs`): each distinct mark (8-connected black pixels, at most 256 a side) stored once in a symbol dictionary (7.4.2; arithmetic coded, each bitmap a template 0 generic region without typical prediction, the bitmaps sharing their contexts) and placed by immediate lossless text regions referring to it (7.4.3; bottom-left reference corner, strips of 1, 2, 4 or 8 rows, whichever is smallest), each of at most 10,000 instances over a band of rows, as the decoder PdfCraft renders with (`hayro-jbig2`) takes no more in one region, with larger marks, and in a second plan marks that occur once, in a generic region over their box. Only exact copies share a symbol (no refinement), so the stream decodes to the same bits; fewer than two symbols, more than 2^20 black runs, 32,767 symbols (that decoder refuses more) or 16 MiB of symbol pixels, or more than 2^24 rows, and the generic coding is used |
+| JBIG2Decode | not here (`Unsupported`; the renderer and image export decode it with `hayro-jbig2`) | `encode_jbig2_generic`: the embedded organisation (D.3) with a page information segment and an immediate lossless generic region (7.4.6), no `/JBIG2Globals`; template 0 with its nominal AT pixels and typical prediction (6.2.5), coded with the MQ arithmetic coder (Annex E, Table E.1) and ended by its 0xFF 0xAC marker. A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, so the stream decodes to the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 1,048,576 samples a row; no rows or columns, or too wide → Unsupported, too few bytes → Corrupt. `encode_jbig2`: the smaller of that and symbol coding (`jbig2/symbols.rs`): each distinct mark (8-connected black pixels, at most 256 a side) stored once in a symbol dictionary (7.4.2; arithmetic coded, each bitmap a template 0 generic region without typical prediction, the bitmaps sharing their contexts) and placed by immediate lossless text regions referring to it (7.4.3; bottom-left reference corner, strips of 1, 2, 4 or 8 rows, whichever is smallest), each of at most 10,000 instances over a band of rows, as the decoder PdfCraft renders with (`hayro-jbig2`) takes no more in one region, with larger marks, and in a second plan marks that occur once, in a generic region over their box. Only exact copies share a symbol (no refinement), so the stream decodes to the same bits; fewer than two symbols, more than 2^20 black runs, 65,536 distinct marks or 16 MiB of their pixels, or more than 2^24 rows, and the generic coding is used; a plan of more than 32,767 symbols (that decoder refuses more) isn't made |
 
 ## Tests
 
@@ -54,7 +54,7 @@ encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // t
 - `ccitt.rs`: Group 4 output decoded by `hayro-ccitt` (dev-dependency, an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
 - `mq.rs`: the arithmetic coder reproduces Annex H.2's 30 bytes from its 256 decisions.
 - `jbig2.rs`: output decoded by `hayro-jbig2` (dev-dependency, an independent decoder) matches the input bits: a text-like page (smaller than Group 4), edges, padding, all-white and all-black regions (typical rows), and property tests over bitmaps of noise and of runs; any input returns rather than panics.
-- `jbig2/symbols.rs`: the integer coders against Annex A's example and Table A.1; symbol-coded output decoded by `hayro-jbig2` matches the input bits for every plan and strip size: text whose letters repeat (under half the generic coding's size, the dictionary retained and referred to), large and lone marks left to a generic region, marks on the edges, touching at corners and inside each other's boxes, and property tests over glyphs scattered over each other and the edges with stray pixels (never larger than the generic coding); one shape, a blank page and noise are coded generically; marks joined at a corner, either way, are one mark, and 256 pixels a side is a symbol while 257 wide or tall is left out; black padding bits are ignored; coordinates past 4,435 use Annex A's 32-bit range and PREV stays below 512; past 2^20 runs, 2^24 rows, 32,767 symbols or 2^24 symbol pixels the image is coded generically, at each cap it is still looked at, and at the two symbol caps it decodes; more than 10,000 marks are placed by several text regions, the dictionary retained for each but the last; any input returns rather than panics.
+- `jbig2/symbols.rs`: the integer coders against Annex A's example and Table A.1; symbol-coded output decoded by `hayro-jbig2` matches the input bits for every plan and strip size: text whose letters repeat (under half the generic coding's size, the dictionary retained and referred to), large and lone marks left to a generic region, marks on the edges, touching at corners and inside each other's boxes, and property tests over glyphs scattered over each other and the edges with stray pixels (never larger than the generic coding); one shape, a blank page and noise are coded generically; marks joined at a corner, either way, are one mark, and 256 pixels a side is a symbol while 257 wide or tall is left out; black padding bits are ignored; coordinates past 4,435 use Annex A's 32-bit range and PREV stays below 512; past 2^20 runs, 2^24 rows, 65,536 distinct marks or 2^24 symbol pixels the image is coded generically, and at each cap it is still looked at; a plan codes at most 32,767 symbols, which decode, and past that the second plan still codes the repeated ones; more than 10,000 marks are placed by several text regions, numbered in turn, the dictionary retained for each but the last; any input returns rather than panics.
 - `fuzz/`: a detached cargo-fuzz crate (`cargo +nightly fuzz run decode`, run from `crates/filters/`).
 
 ## Status
diff --git a/crates/filters/src/jbig2/symbols.rs b/crates/filters/src/jbig2/symbols.rs
index a34653e748..e9fed24441 100644
--- a/crates/filters/src/jbig2/symbols.rs
+++ b/crates/filters/src/jbig2/symbols.rs
@@ -21,18 +21,25 @@ const MAX_SYMBOL_SIDE: u32 = 256;
 /// which suits it better anyway; this bounds the memory the marks take.
 const MAX_RUNS: usize = 1 << 20;
 
-/// The most distinct symbols, and the most pixels their bitmaps may hold together. The decoder
-/// PdfCraft renders JBIG2 with (`hayro-jbig2`) refuses 32,768 symbols or more, and others may
-/// too: past it the image is coded generically.
-const MAX_SYMBOLS: usize = (1 << 15) - 1;
+/// The most distinct marks sorted into symbols, and the most pixels their bitmaps may hold
+/// together: past either the image is left to generic coding. These bound the memory they take.
+const MAX_SYMBOLS: usize = 1 << 16;
 const MAX_SYMBOL_PIXELS: usize = 1 << 24;
 
+/// The most symbols one plan codes. The decoder PdfCraft renders JBIG2 with (`hayro-jbig2`)
+/// refuses 32,768 symbols or more, and others may too, so a plan with more isn't made.
+const MAX_CODED_SYMBOLS: usize = (1 << 15) - 1;
+
 /// The most symbol instances one text region places. The decoder PdfCraft renders JBIG2 with
 /// refuses a text region of more than 10,000 (a page it then draws blank), so a page with more is
-/// placed by several regions, each over a band of rows, all referring to the one dictionary. At
-/// most [`MAX_RUNS`] marks keeps their segment numbers below 256.
+/// placed by several regions, each over a band of rows, all referring to the one dictionary.
 const MAX_REGION_INSTANCES: usize = 10_000;
 
+// Segment numbers stay at most 256, so a referred-to one takes a byte (7.2.5): the page, the
+// dictionary, a text region for each MAX_REGION_INSTANCES of at most MAX_RUNS marks, and the
+// generic region.
+const _: () = assert!(MAX_RUNS.div_ceil(MAX_REGION_INSTANCES) + 3 <= 256);
+
 /// The most rows symbol coded. With rows at most 2^20 samples wide, every coordinate and
 /// difference coded then fits the 32-bit integers Annex A codes.
 const MAX_ROWS: u32 = 1 << 24;
@@ -94,7 +101,8 @@ struct Instance {
 
 /// `rows` rows of `columns` 1-bit PDF samples (black 0), symbol coded: the smaller of two plans,
 /// every mark of at most [`MAX_SYMBOL_SIDE`] a side as a symbol, or only those with a copy.
-/// `None` when neither plan has two symbols, or the image is too large or too busy to look at.
+/// `None` when neither plan has from two to [`MAX_CODED_SYMBOLS`] symbols, or the image is too
+/// large or too busy to look at.
 pub(super) fn encode(samples: &[u8], columns: u32, rows: u32) -> Option<Vec<u8>> {
     let page = page(samples, columns, rows)?;
     [1, 2].into_iter().filter_map(|copies| plan(&page, columns, rows, copies, None)).min_by_key(Vec::len)
@@ -294,13 +302,14 @@ fn symbols(page: &mut Page) -> Option<()> {
 
 /// One plan's stream: the symbols with at least `copies` uses in a symbol dictionary, text
 /// regions placing them (in strips of 2^`log_strips` rows, or whichever size codes smallest), and
-/// the other marks in a generic region. `None` with fewer than two such symbols: their IDs would
-/// take no bits at all (SBSYMCODELEN 0), a corner of the standard left alone here.
+/// the other marks in a generic region. `None` with fewer than two such symbols (their IDs would
+/// take no bits at all, SBSYMCODELEN 0, a corner of the standard left alone here) or more than
+/// [`MAX_CODED_SYMBOLS`].
 fn plan(page: &Page, columns: u32, rows: u32, copies: u32, log_strips: Option<u32>) -> Option<Vec<u8>> {
     let symbol = |s: u32| page.symbols.get(s as usize);
     // The dictionary's order (6.5.5): height classes from the shortest, each narrowest first.
     let mut kept: Vec<u32> = (0..page.symbols.len() as u32).filter(|s| symbol(*s).is_some_and(|s| s.uses >= copies)).collect();
-    if kept.len() < 2 {
+    if kept.len() < 2 || kept.len() > MAX_CODED_SYMBOLS {
         return None;
     }
     kept.sort_by_key(|s| symbol(*s).map(|s| (s.height, s.width)));
@@ -628,9 +637,9 @@ mod tests {
         page
     }
 
-    /// A segment's type, whether it is retained, and the segments it refers to, each with its
-    /// retain bit.
-    type Segment = (u8, bool, Vec<(u8, bool)>);
+    /// A segment's number and type, whether it is retained, and the segments it refers to, each
+    /// with its retain bit.
+    type Segment = (u32, u8, bool, Vec<(u8, bool)>);
 
     /// The segments of a stream in the embedded organisation, from their headers (7.2).
     fn segments(data: &[u8]) -> Vec<Segment> {
@@ -641,14 +650,15 @@ mod tests {
             let length_at = at + 6 + refers + 1;
             let length = u32::from_be_bytes(data[length_at..length_at + 4].try_into().unwrap()) as usize;
             let referred = data[at + 6..at + 6 + refers].iter().enumerate().map(|(k, n)| (*n, flags >> (k + 1) & 1 == 1)).collect();
-            segments.push((data[at + 4] & 0x3F, flags & 1 == 1, referred));
+            let number = u32::from_be_bytes(data[at..at + 4].try_into().unwrap());
+            segments.push((number, data[at + 4] & 0x3F, flags & 1 == 1, referred));
             at = length_at + 4 + length;
         }
         segments
     }
 
     fn segment_types(data: &[u8]) -> Vec<u8> {
-        segments(data).into_iter().map(|(kind, ..)| kind).collect()
+        segments(data).into_iter().map(|(_, kind, ..)| kind).collect()
     }
 
     /// Every plan, at every strip size, decodes to the picture; returns how many plans there were.
@@ -796,32 +806,60 @@ mod tests {
         assert!(page(&tall, 1, MAX_ROWS).is_some());
     }
 
-    /// Past 32,767 distinct symbols, or 2^24 pixels of them, the image is left to generic coding;
-    /// at either cap it is symbol coded, and decodes.
+    /// A plan codes at most 32,767 symbols, which an independent decoder reads back; with more,
+    /// the second plan can still code the repeated ones. Past 65,536 distinct marks, or 2^24
+    /// pixels of them, the image is left to generic coding; at either cap it is still looked at.
     #[test]
     fn too_many_symbols_are_left_to_generic_coding() {
-        // `n` distinct marks of 17 × 3: full top and bottom rows joined by a code of 1 to n, in
-        // binary, on the row between.
-        let codes = |n: usize| {
-            let (columns, rows) = (256 * 18, n.div_ceil(256) * 4);
+        // `n` distinct marks of 17 × 3 (full top and bottom rows joined by a code of 1 to n, in
+        // binary, on the row between), then `again` more with the codes 1 and 2 in turn.
+        let codes = |n: usize, again: usize| {
+            let (columns, rows) = (256 * 18, (n + again).div_ceil(256) * 4);
             let mut picture = vec![vec![0u8; columns]; rows];
-            for k in 0..n {
+            for k in 0..n + again {
                 let (x, y) = (k % 256 * 18, k / 256 * 4);
+                let code = if k < n { k + 1 } else { (k - n) % 2 + 1 };
                 picture[y][x..x + 17].fill(1);
                 picture[y + 2][x..x + 17].fill(1);
-                for b in (0..17).filter(|b| (k + 1) >> b & 1 == 1) {
+                for b in (0..17).filter(|b| code >> b & 1 == 1) {
                     picture[y + 1][x + b] = 1;
                 }
             }
             (samples(&picture), columns as u32, rows as u32)
         };
-        // At the cap the symbols are coded, and an independent decoder reads them back.
-        let (data, columns, rows) = codes(MAX_SYMBOLS);
+        let (data, columns, rows) = codes(MAX_CODED_SYMBOLS, 0);
         let at_cap = page(&data, columns, rows).unwrap();
-        assert_eq!(at_cap.symbols.len(), MAX_SYMBOLS);
-        let coded = plan(&at_cap, columns, rows, 1, None).unwrap();
+        assert_eq!(decode(&plan(&at_cap, columns, rows, 1, None).unwrap()), unpack(&data, columns, rows));
+        // One more distinct mark, each once: neither plan is made.
+        let (data, columns, rows) = codes(MAX_CODED_SYMBOLS + 1, 0);
+        let past = page(&data, columns, rows).unwrap();
+        assert!(plan(&past, columns, rows, 1, None).is_none() && plan(&past, columns, rows, 2, None).is_none());
+        assert_eq!(encode_jbig2(&data, columns, rows).unwrap(), encode_jbig2_generic(&data, columns, rows).unwrap());
+        // With two of them repeated, the second plan codes those two.
+        let (data, columns, rows) = codes(MAX_CODED_SYMBOLS + 1, 200);
+        let past = page(&data, columns, rows).unwrap();
+        assert!(plan(&past, columns, rows, 1, None).is_none());
+        assert_eq!(decode(&plan(&past, columns, rows, 2, None).unwrap()), unpack(&data, columns, rows));
+        // Above a page of text whose letters repeat, that second plan is the one `encode_jbig2`
+        // keeps: the first, of every mark, would code too many symbols.
+        let mut picture: Bitmap = vec![vec![0u8; 256 * 18]; 512];
+        for k in 0..=MAX_CODED_SYMBOLS {
+            let (x, y) = (k % 256 * 18, k / 256 * 4);
+            picture[y][x..x + 17].fill(1);
+            picture[y + 2][x..x + 17].fill(1);
+            for b in (0..17).filter(|b| (k + 1) >> b & 1 == 1) {
+                picture[y + 1][x + b] = 1;
+            }
+        }
+        picture.extend(text(256 * 18, 600, &glyphs(40, 7), 11));
+        let data = samples(&picture);
+        let (columns, rows) = (picture[0].len() as u32, picture.len() as u32);
+        let coded = encode_jbig2(&data, columns, rows).unwrap();
+        assert_eq!(segment_types(&coded)[1], 0, "symbol coded");
         assert_eq!(decode(&coded), unpack(&data, columns, rows));
-        let (data, columns, rows) = codes(MAX_SYMBOLS + 1);
+        let (data, columns, rows) = codes(MAX_SYMBOLS, 0);
+        assert_eq!(page(&data, columns, rows).map(|p| p.symbols.len()), Some(MAX_SYMBOLS));
+        let (data, columns, rows) = codes(MAX_SYMBOLS + 1, 0);
         assert!(page(&data, columns, rows).is_none());
         // `n` black squares of 256 × 256, each with a white pixel in a different place: 2^16
         // pixels a symbol, so 256 of them are exactly the cap.
@@ -847,22 +885,30 @@ mod tests {
 
     /// More than 10,000 marks are placed by several text regions, each of at most 10,000 (more
     /// than the decoder PdfCraft renders with accepts in one), over bands of rows, all referring to
-    /// the dictionary, which each region but the last keeps retained.
+    /// the dictionary, which each region but the last keeps retained; the generic region comes
+    /// after them, every segment numbered one more than the one before.
     #[test]
     fn more_than_10000_marks_are_placed_by_several_regions() {
-        // 25,000 copies of two 17 × 3 shapes, 256 a line, the lines 5 rows apart.
-        let mut picture = vec![vec![0u8; 256 * 18]; 25_000usize.div_ceil(256) * 5];
+        // 25,000 copies of two 17 × 3 shapes, 256 a line, the lines 5 rows apart, and a bar too
+        // tall to be a symbol beside them.
+        let mut picture = vec![vec![0u8; 256 * 18 + 100]; 25_000usize.div_ceil(256) * 5];
         for k in 0..25_000 {
             let (x, y) = (k % 256 * 18, k / 256 * 5);
             picture[y][x..x + 17].fill(1);
             picture[y + 2][x..x + 17].fill(1);
             picture[y + 1][x + k % 2] = 1;
         }
+        for row in &mut picture[0..300] {
+            row[256 * 18 + 50] = 1;
+        }
         let data = samples(&picture);
         let (columns, rows) = (picture[0].len() as u32, picture.len() as u32);
         let coded = encode_jbig2(&data, columns, rows).unwrap();
-        let region = |kept| (7, false, vec![(1, kept)]);
-        assert_eq!(segments(&coded), [(48, false, vec![]), (0, true, vec![]), region(true), region(true), region(false)]);
+        let region = |number, kept| (number, 7, false, vec![(1, kept)]);
+        assert_eq!(
+            segments(&coded),
+            [(0, 48, false, vec![]), (1, 0, true, vec![]), region(2, true), region(3, true), region(4, false), (5, 39, false, vec![])]
+        );
         assert_eq!(decode(&coded), unpack(&data, columns, rows));
         assert_eq!(every_plan_round_trips(&picture), 8);
     }
@@ -876,7 +922,7 @@ mod tests {
         let coded = encode_jbig2(&data, 1700, 400).unwrap();
         let generic = encode_jbig2_generic(&data, 1700, 400).unwrap();
         // The dictionary is retained for the text region, which refers to it (7.2.4, 7.2.5).
-        assert_eq!(segments(&coded), [(48, false, vec![]), (0, true, vec![]), (7, false, vec![(1, false)])]);
+        assert_eq!(segments(&coded), [(0, 48, false, vec![]), (1, 0, true, vec![]), (2, 7, false, vec![(1, false)])]);
         assert_eq!(decode(&coded), unpack(&data, 1700, 400));
         assert!(coded.len() * 2 < generic.len(), "symbols {} bytes, generic {}", coded.len(), generic.len());
         assert_eq!(every_plan_round_trips(&picture), 8);
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index a349d8cb1b..f8e28506a1 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -749,6 +749,17 @@ fn a_dense_page_of_rendered_text_looks_the_same_as_jbig2_symbols() {
     let s = stream(&doc, im);
     assert_eq!(s.dict.name(b"Filter"), Some(&b"JBIG2Decode"[..]));
     assert!(s.raw.len() * 2 < pdfcraft_filters::encode_jbig2_generic(&text, w, h).unwrap().len(), "symbol coded");
+    // The copies take several text regions (segment type 7, ISO/IEC 14492 7.3), read from the
+    // segment headers (7.2): number, flags, referred-to count and numbers, page, data length.
+    let mut regions = 0;
+    let mut at = 0;
+    while let Some(header) = s.raw.get(at..at + 6) {
+        let refers = usize::from(header[5] >> 5);
+        let length = u32::from_be_bytes(s.raw[at + 7 + refers..at + 11 + refers].try_into().unwrap()) as usize;
+        regions += usize::from(header[4] & 0x3F == 7);
+        at += 11 + refers + length;
+    }
+    assert!(regions > 1, "{regions} text regions");
     assert!(render(&doc) == before, "the page looks the same");
 }
 

From f3a547d71797788570bb59ad584787e14ac27438 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 13:56:37 +0100
Subject: [PATCH 231/270] =?UTF-8?q?M11:=20a=20test=20that=20Export=20?=
 =?UTF-8?q?=E2=96=B8=20Images=20reads=20symbol-coded=20JBIG2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The optimizer now writes JBIG2 images as a symbol dictionary and text
regions, and Export ▸ Images has to read them back. A page of three
repeated letters, symbol coded (smaller than the generic coding),
exports as its picture. The test is added to create.export-all-images'
parity evidence. Asked for in pre-push review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/create/src/tests.rs   | 39 ++++++++++++++++++++++++++++++++++++
 parity/acrobat-features.toml |  2 +-
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 9bff0c311c..352ff14eb4 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1417,6 +1417,45 @@ fn images_whose_predictor_is_given_by_reference_export_as_their_picture() {
     assert_eq!(exported_rgba(&doc), ("png", picture), "the JBIG2 globals' /DecodeParms by reference");
 }
 
+/// An image the optimizer stored as JBIG2 symbols (a symbol dictionary and text regions, rather
+/// than one generic region) exports as its picture.
+#[test]
+fn symbol_coded_jbig2_images_export_as_their_picture() {
+    const LETTERS: [[&str; 7]; 3] = [
+        ["#####", "#....", "####.", "#....", "#....", "#....", "#####"],
+        [".###.", "#...#", "#....", "#....", "#....", "#...#", ".###."],
+        ["#...#", "#...#", "#####", "#...#", "#...#", "#...#", "#...#"],
+    ];
+    let (w, h) = (400usize, 40usize);
+    let stride = w.div_ceil(8);
+    // 1 samples white, as a grey image's are; the letters' pixels 0.
+    let mut bits = vec![0xFFu8; stride * h];
+    for (line, top) in [2usize, 12, 22, 32].into_iter().enumerate() {
+        for (k, x) in (3..w - 6).step_by(7).enumerate() {
+            for (dy, row) in LETTERS[(k + line) % 3].iter().enumerate() {
+                for (dx, c) in row.bytes().enumerate() {
+                    if c == b'#' {
+                        bits[(top + dy) * stride + (x + dx) / 8] &= !(0x80 >> ((x + dx) % 8));
+                    }
+                }
+            }
+        }
+    }
+    let jbig2 = pdfcraft_filters::encode_jbig2(&bits, w as u32, h as u32).unwrap();
+    let generic = pdfcraft_filters::encode_jbig2_generic(&bits, w as u32, h as u32).unwrap();
+    assert!(jbig2.len() < generic.len(), "symbol coded: {} bytes, generic {}", jbig2.len(), generic.len());
+    let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+    with_image(&mut doc, |_| {
+        let mut d = image_dict(w as i64, h as i64, "DeviceGray", 1);
+        d.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+        Stream::from_raw(d, jbig2)
+    });
+    let picture: Vec<u8> = (0..w * h)
+        .flat_map(|i| if bits[i / w * stride + i % w / 8] & (0x80 >> (i % w % 8)) != 0 { [255, 255, 255, 255] } else { [0, 0, 0, 255] })
+        .collect();
+    assert_eq!(exported_rgba(&doc), ("png", picture));
+}
+
 /// Export ▸ Images reads JBIG2 images (ISO 32000-2 §7.4.7), JBIG2 black as 0: as the image, and as
 /// a stencil `/Mask` of another. Their `/JBIG2Globals` are read, from a dictionary or the one in
 /// an array, so globals that can't be read skip the image rather than being ignored. Rows past the
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index a57ed83df6..9e9f1ae804 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7164,7 +7164,7 @@ milestone = "M10"
 status = "shipped"
 commands = ["export.all_images"]
 tools = ["doc_export_all_images"]
-evidence = ["crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps", "crates/create/src/tests.rs::jbig2_images_export_as_their_picture", "crates/create/src/tests.rs::jbig2_globals_are_decoded_within_a_limit_of_their_own", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2"]
+evidence = ["crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps", "crates/create/src/tests.rs::jbig2_images_export_as_their_picture", "crates/create/src/tests.rs::jbig2_globals_are_decoded_within_a_limit_of_their_own", "crates/create/src/tests.rs::symbol_coded_jbig2_images_export_as_their_picture", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_jbig2"]
 notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JBIG2 images and masks decode (JBIG2 as the only filter, with /JBIG2Globals; an image whose JBIG2 page has another width, or more pixels than an export takes, or whose globals decode to more than 32 MiB, is skipped, and such a mask is left out, the image exported opaque); JPX/CCITT masks are left out (image exported opaque); JPX/CCITT/separations, and JBIG2 inside other filters, reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported."
 
 [[feature]]

From c7f39a4d9a341dcbdacaf3bc131ea2825f030b13 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 18:14:26 +0100
Subject: [PATCH 232/270] M11: the parity table no longer lists JBIG2 symbol
 coding as missing

docs/target-app-parity.md's optimize row lists lossy JBIG2, refinement
coding and a symbol dictionary shared between images as missing, with a
status line and a revision row.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 docs/target-app-parity.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 22832f65f2..d48333c185 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,5 +1,6 @@
 # PdfCraft parity with Adobe Acrobat Pro
 
+> **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-26 · **Change:** minor (K Optimize and standards no longer lists JBIG2 symbol coding as missing; scores and estimates unchanged)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-26 · **Change:** minor (K Optimize and standards no longer lists lossless JBIG2 as missing; scores and estimates unchanged)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-26 · **Change:** minor (`optimize.mono-compression` partial (CCITT Group 4): K Optimize and standards 15 shipped and 11 partial of 58, 35.3%; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497); estimates unchanged)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-25 · **Change:** minor (localization current state: Arabic logical catalog, explicit RTL direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite. Scores and estimates unchanged)
@@ -210,7 +211,7 @@ full parity in that area.
 | H Digital signatures | 45 | 23 | 10 | 62.2% | 45% | 40–70 | PAdES B-B signing and validation (PKCS #12, macOS Keychain, Windows store with PIN prompts), certification, encrypted documents, certificate usage checks; B-T, LTV, OCSP/CRL with caller-supplied evidence. Missing: PKCS #11 and smart cards outside Windows, timestamp-server preferences, online revocation fetching, FieldMDP and field locking, OS trust store, EU Trusted Lists, compare signed version |
 | I Scan and OCR | 26 | 5 | 2 | 23.1% | 15% | 40–75 | Searchable image (ocrs, Latin script without accents) on pages, ranges and many files. Missing: every other language (#744 Dutch; accents, CJK, Cyrillic, Arabic), editable-text output, deskew, rotation, despeckle, camera images beyond straightening (found or placed corners): orientation, clean-up, MRC compression, scanners |
 | J Create and export | 34 | 12 | 3 | 39.7% | 25% | 55–100 | Create from images, multipage TIFF, text, clipboard, blank, many files at once; export PNG/JPEG/TIFF, text, RTF; Word and HTML partial. Missing: Office/HTML/web/PostScript to PDF, Excel and PowerPoint export, Word layout fidelity (#773), SVG/XML/EPS/PS/JPEG 2000 export, accessible text |
-| K Optimize and standards | 58 | 15 | 11 | 35.3% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, JBIG2 symbol coding and lossy JBIG2, monochrome downsampling |
+| K Optimize and standards | 58 | 15 | 11 | 35.3% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, lossy JBIG2, JBIG2 refinement coding and a symbol dictionary shared between images, monochrome downsampling |
 | L Print | 39 | 15 | 1 | 39.7% | 35% | 30–55 | Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, print-ready PDF, CUPS on macOS/Linux, the Windows spooler (#756) and the browser's print dialog on the web. Missing: print as image, PostScript, all print-production tools (output preview, separations, ink manager, printer marks, colour conversion) |
 | M Accessibility | 61 | 38 | 1 | 63.1% | 30% | 40–70 | Accessibility Checker (all 32 rules, report, fixes), alternate text, title and language. Missing: autotag, Tags/Order/Content panels, Reading Order tool, artifact marking, table editor, Read Out Loud, full keyboard operation of the app, screen-reader audit |
 | N Automation, preferences, misc | 75 | 20 | 5 | 30.0% | 35% | 25–45 | CLI, MCP, UI control channel, 141 automation tools, Action Wizard (run, create), compare (text, visual, report, side by side, Text/Visual filter). Missing: most Preferences pages, Acrobat's finer compare filters, Action Wizard management, custom commands, AI providers, rich media/3D, hosted web app |
@@ -296,6 +297,7 @@ licensed OCR or AI model.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | K Optimize and standards no longer lists JBIG2 symbol coding as missing (lossless, exact copies); lossy JBIG2, refinement coding and a dictionary shared between images still are. Scores and estimates unchanged. |
 | 2026-10-26 | minor | K Optimize and standards no longer lists lossless JBIG2 as missing (a generic region, through the Optimizer's Monochrome Images); symbol coding and lossy JBIG2 still are. Scores and estimates unchanged. |
 | 2026-10-26 | minor | `optimize.mono-compression` became partial (CCITT Group 4), counted on the table's own measurement: K Optimize and standards 15 shipped and 11 partial of 58 (35.3%), no longer listing CCITT as missing; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497). Estimates unchanged. |
 | 2026-10-25 | minor | Localization current state: Arabic catalogs stay logical, Arabic/Kurdish labels take an explicit RTL direction, and stock chrome mirrors; native/browser RTL input, IME and complex workflows remain unqualified. Native Simplified Chinese uses LXGW WenKai Lite; the web build has no Hans face. Scores and estimates unchanged. |

From 2d0a7b22411d4b61f130f6175cec918153858593 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Thu, 29 Oct 2026 22:44:50 +0100
Subject: [PATCH 233/270] M11: black-and-white RGB used beyond the page content
 read stays RGB

Packing makes an RGB image grey for every use at once, but /DefaultGray and
/DefaultRGB were checked only where the walk reads: page content and forms.
An annotation's appearance, a pattern, a Type3 glyph or a soft mask's group
drawing the same image can have other default colour spaces, so its colours
could change there.

The walk now records, by object number, every reference in the resources it
reads (each /XObject entry, drawn or not, an /XObject dictionary under its
resources, resources under a page, page-tree node or form), reading the
resources of every page and of every node above one, each page and node a
root. An image the walk reached stays covered unless an object reachable
from the trailer refers to it, or to an object on its way from a page, other
than through those references, or it is held by one that isn't covered; an
eight-bit DeviceRGB image that isn't covered stays RGB. So resources, an
/XObject dictionary or a form a page shares with an appearance keep it RGB,
as does a reference with another generation, while LibreOffice's layout (one
resources object for a page, its /Pages node, and a form inside it that
names it again) still packs. The scan runs only when packing is on and there
is such an image.

The images drawn or listed where the defaults are in force are kept by
object number too, so one named with another generation there stays RGB.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/optimize/README.md         |   9 +-
 crates/optimize/src/images.rs     | 234 ++++++++++++++++++++++---
 crates/optimize/tests/optimize.rs | 281 ++++++++++++++++++++++++++++++
 parity/acrobat-features.toml      |   4 +-
 4 files changed, 498 insertions(+), 30 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 6383510c96..dec4178672 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -45,9 +45,12 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   row, not as T.4 sends them, is read as PdfCraft draws it, which at `/K 0` may be other rows than
   were coded, and an image stored again keeps them). Packed to one bit first, unless a colour-key `/Mask` is in the image's
   own values: eight-bit grey of only 0 and 255; eight-bit `DeviceRGB` of only black and white,
-  which becomes `DeviceGray` (not calibrated RGB or RGB with a profile, nor one drawn where
-  `/DefaultGray` or `/DefaultRGB` is in force, which would then draw it otherwise, nor one whose
-  soft mask has a `/Matte`); and an indexed image of 2, 4 or 8 bits that uses only palette entries
+  which becomes `DeviceGray` (not calibrated RGB or RGB with a profile, nor one drawn or listed
+  where `/DefaultGray` or `/DefaultRGB` is in force, which would then draw it otherwise, nor one
+  referred to from anywhere but the page and form resources the optimizer reads, where they may
+  be: an annotation's appearance or a pattern drawing it, directly or through resources or a form
+  it shares with a page, or another image's `/Alternates`; nor one whose soft mask has a
+  `/Matte`); and an indexed image of 2, 4 or 8 bits that uses only palette entries
   0 and 1, which keeps its palette, whatever its two colours. A decode array stays when it means
   the same at one bit (grey's, or RGB's if the same for each component, as grey's), and an indexed
   image's default one goes, as the default at one bit; otherwise the image is left alone. The grey
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index a9e87e1afc..54e382d133 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -12,11 +12,18 @@ const MAX_PIXELS: u64 = 80_000_000;
 
 /// The resources of a page, inherited from the page tree if the page has none.
 pub(crate) fn page_resources(doc: &Document, page: ObjRef) -> Option<Dict> {
+    held_page_resources(doc, page).map(|(resources, _)| resources)
+}
+
+/// [`page_resources`], and the object holding them: the page or the page-tree node they are
+/// written in (inherited from), or the resources dictionary when it is an object of its own.
+fn held_page_resources(doc: &Document, page: ObjRef) -> Option<(Dict, ObjRef)> {
     let mut node = Some(page);
     for _ in 0..64 {
-        let d = doc.get(node?).as_dict()?.clone();
+        let n = node?;
+        let d = doc.get(n).as_dict()?.clone();
         if let Some(r) = d.get(b"Resources") {
-            return doc.resolve(r).as_dict().cloned();
+            return Some((doc.resolve(r).as_dict().cloned()?, r.as_ref().unwrap_or(n)));
         }
         node = d.reference(b"Parent");
     }
@@ -53,18 +60,56 @@ struct Walk<'a> {
     /// False once a use may have been missed (depth or work limit).
     complete: bool,
     out: HashMap<ObjRef, f64>,
-    /// Images drawn at least once where `/DefaultGray` or `/DefaultRGB` is in force.
-    defaults: HashSet<ObjRef>,
+    /// Images drawn or listed at least once where `/DefaultGray` or `/DefaultRGB` is in force, by
+    /// object number: a reference with another generation reaches the same image.
+    defaults: HashSet<u32>,
+    /// The references the walk followed to reach its images, and the pages and page-tree nodes
+    /// whose resources it read.
+    read: Read,
+}
+
+/// Where a walk read a reference: under a name in an `/XObject` dictionary (an image or a form),
+/// as resources' `/XObject` dictionary, or as the `/Resources` of a page, node or form.
+#[derive(Clone, PartialEq, Eq, Hash)]
+enum Entry {
+    Name(Vec<u8>),
+    XObject,
+    Resources,
+}
+
+/// The references a walk followed, by object number: (the object referred to, the object holding
+/// the reference, where in it), and the pages and page-tree nodes whose resources it read.
+#[derive(Default)]
+struct Read {
+    entries: HashSet<(u32, u32, Entry)>,
+    roots: HashSet<u32>,
 }
 
 impl Walk<'_> {
     /// Walk one content stream, recording each image's displayed resolution (pixels per inch, the
-    /// smaller of the two axes) and descending into form XObjects. `defaults`: an enclosing
-    /// stream's resources remap a device colour space.
-    fn content(&mut self, data: &[u8], resources: &Dict, ctm: Matrix, defaults: bool) {
+    /// smaller of the two axes) and descending into form XObjects. `holder` is the object holding
+    /// `resources`. `defaults`: an enclosing stream's resources remap a device colour space.
+    fn content(&mut self, data: &[u8], resources: &Dict, holder: ObjRef, ctm: Matrix, defaults: bool) {
         let doc = self.doc;
         let defaults = defaults || remaps_device_spaces(doc, resources);
         let xobjects = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
+        let xholder = match resources.get(b"XObject").and_then(Object::as_ref) {
+            Some(x) => {
+                self.read.entries.insert((x.num, holder.num, Entry::XObject));
+                x
+            }
+            None => holder,
+        };
+        // Every entry counts as read, drawn here or not: content using these resources (a Type3
+        // glyph without its own, say) draws it under the same defaults.
+        for (name, v) in xobjects.iter() {
+            if let Some(r) = v.as_ref() {
+                self.read.entries.insert((r.num, xholder.num, Entry::Name(name.to_vec())));
+                if defaults {
+                    self.defaults.insert(r.num);
+                }
+            }
+        }
         let mut stack = vec![ctm];
         for op in pdfcraft_content::parse(data).ops {
             let top = stack.last().copied().unwrap_or(ctm);
@@ -96,10 +141,10 @@ impl Walk<'_> {
                                 *e = e.min(ppi);
                             }
                             if defaults {
-                                self.defaults.insert(r);
+                                self.defaults.insert(r.num);
                             }
                         }
-                        Some(b"Form") => self.form(r, s, resources, top, defaults),
+                        Some(b"Form") => self.form(r, s, (resources, holder), top, defaults),
                         _ => {}
                     }
                 }
@@ -108,8 +153,37 @@ impl Walk<'_> {
         }
     }
 
-    /// Descend into form `r` drawn with `ctm` from a stream whose resources are `resources`.
-    fn form(&mut self, r: ObjRef, s: &Stream, resources: &Dict, ctm: Matrix, defaults: bool) {
+    /// Read the resources of page `p` and of each page-tree node above it, each of them a root: a
+    /// node's resources are its inheriting pages' (every page is walked), or no page's.
+    fn resources_above(&mut self, p: ObjRef) {
+        let doc = self.doc;
+        let mut node = Some(p);
+        for _ in 0..64 {
+            let Some(n) = node else { return };
+            // A node met before had its own nodes above it read then.
+            if !self.read.roots.insert(n.num) {
+                return;
+            }
+            let Some(d) = doc.get(n).as_dict().cloned() else { return };
+            if let Some(r) = d.get(b"Resources")
+                && let Some(resources) = doc.resolve(r).as_dict().cloned()
+            {
+                let holder = match r.as_ref() {
+                    Some(res) => {
+                        self.read.entries.insert((res.num, n.num, Entry::Resources));
+                        res
+                    }
+                    None => n,
+                };
+                self.content(&[], &resources, holder, Matrix([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]), false);
+            }
+            node = d.reference(b"Parent");
+        }
+    }
+
+    /// Descend into form `r` drawn with `ctm` from a stream whose resources are `resources`, with
+    /// the object holding them.
+    fn form(&mut self, r: ObjRef, s: &Stream, (resources, holder): (&Dict, ObjRef), ctm: Matrix, defaults: bool) {
         if self.path.contains(&r) {
             return;
         }
@@ -144,7 +218,19 @@ impl Walk<'_> {
             return;
         };
         self.path.push(r);
-        self.content(&data, own.as_ref().unwrap_or(resources), inner, defaults);
+        match &own {
+            Some(own) => {
+                let own_holder = match s.dict.get(b"Resources").and_then(Object::as_ref) {
+                    Some(res) => {
+                        self.read.entries.insert((res.num, r.num, Entry::Resources));
+                        res
+                    }
+                    None => r,
+                };
+                self.content(&data, own, own_holder, inner, defaults);
+            }
+            None => self.content(&data, resources, holder, inner, defaults),
+        }
         self.path.pop();
     }
 }
@@ -165,9 +251,10 @@ pub fn effective_resolutions(doc: &Document, pages: &[ObjRef]) -> HashMap<ObjRef
     walk_pages(doc, pages).0
 }
 
-/// [`effective_resolutions`], and the images drawn where `/DefaultGray` or `/DefaultRGB` is in
-/// force: all of them when a use may have been missed.
-fn walk_pages(doc: &Document, pages: &[ObjRef]) -> (HashMap<ObjRef, f64>, HashSet<ObjRef>) {
+/// [`effective_resolutions`], the images drawn or listed where `/DefaultGray` or `/DefaultRGB` is
+/// in force, by object number (all of them when a use may have been missed), and the references
+/// followed to reach them.
+fn walk_pages(doc: &Document, pages: &[ObjRef]) -> (HashMap<ObjRef, f64>, HashSet<u32>, Read) {
     let mut walk = Walk {
         doc,
         path: Vec::new(),
@@ -178,12 +265,14 @@ fn walk_pages(doc: &Document, pages: &[ObjRef]) -> (HashMap<ObjRef, f64>, HashSe
         complete: true,
         out: HashMap::new(),
         defaults: HashSet::new(),
+        read: Read::default(),
     };
     for p in pages {
         let Some(dict) = doc.get(*p).as_dict().cloned() else { continue };
         let page = pdfcraft_model::Page { obj: *p, dict };
+        walk.resources_above(*p);
         let Some(contents) = page.dict.get(b"Contents") else { continue };
-        let res = page_resources(doc, *p).unwrap_or_default();
+        let (res, holder) = held_page_resources(doc, *p).unwrap_or_else(|| (Dict::default(), *p));
         walk.budget = DecodeBudget::page();
         let Some(data) = content_bytes(doc, contents, &mut walk.budget) else {
             walk.complete = false;
@@ -191,13 +280,103 @@ fn walk_pages(doc: &Document, pages: &[ObjRef]) -> (HashMap<ObjRef, f64>, HashSe
         };
         // Content coordinates are in page units; image resolution is in physical inches.
         let unit = page.user_unit(doc);
-        walk.content(&data, &res, Matrix([unit, 0.0, 0.0, unit, 0.0, 0.0]), false);
+        walk.content(&data, &res, holder, Matrix([unit, 0.0, 0.0, unit, 0.0, 0.0]), false);
     }
     if !walk.complete {
         walk.out.values_mut().for_each(|v| *v = f64::INFINITY);
-        walk.defaults.extend(walk.out.keys());
+        walk.defaults.extend(walk.out.keys().map(|r| r.num));
     }
-    (walk.out, walk.defaults)
+    (walk.out, walk.defaults, walk.read)
+}
+
+/// Whether image `r` is one [`one_bit`] may make grey: eight-bit `DeviceRGB`, not in an image codec.
+fn device_rgb(doc: &Document, r: ObjRef) -> bool {
+    let Object::Stream(s) = &*doc.get(r) else { return false };
+    let cs = s.dict.get(b"ColorSpace").map(|cs| doc.resolve(cs));
+    let codec =
+        s.filters().iter().any(|(f, _)| matches!(f, pdfcraft_filters::Filter::Dct | pdfcraft_filters::Filter::Jpx | pdfcraft_filters::Filter::Jbig2));
+    s.dict.int(b"BitsPerComponent") == Some(8)
+        && !codec
+        && cs.as_deref().and_then(Object::as_name).is_some_and(|n| matches!(n, b"DeviceRGB" | b"RGB"))
+}
+
+/// Call `f` with every reference in `o`, a dictionary's or array's included, a stream's dictionary
+/// too, but not those in objects referred to.
+fn each_ref(o: &Object, mut f: impl FnMut(ObjRef)) {
+    // Direct objects nest finitely (the parser builds trees), so this ends.
+    let mut stack = vec![o];
+    while let Some(o) = stack.pop() {
+        match o {
+            Object::Ref(r) => f(*r),
+            Object::Dict(d) => stack.extend(d.iter().map(|(_, v)| v)),
+            Object::Array(a) => stack.extend(a),
+            Object::Stream(s) => stack.extend(s.dict.iter().map(|(_, v)| v)),
+            _ => {}
+        }
+    }
+}
+
+/// The images among `images` (by object number) that may be drawn beyond what the walk read:
+/// some object the document uses refers to the image, or to an object on the way to it from a
+/// page (an `/XObject` dictionary, resources, a form), other than as the page and form resources
+/// the walk read do. So an annotation's appearance, a pattern, a Type3 glyph or a soft mask's
+/// group drawing it, directly or through resources or a form it shares with a page, counts, as
+/// other default colour spaces may be in force there, and so does any other reference (another
+/// image's `/Alternates`, say). Objects nothing reaches from the trailer don't count.
+fn used_elsewhere(doc: &Document, images: &HashSet<u32>, read: &Read) -> HashSet<u32> {
+    if images.is_empty() {
+        return HashSet::new();
+    }
+    let targets: HashSet<u32> = read.entries.iter().map(|(target, ..)| *target).collect();
+    // References to each object the walk followed, by the object holding them.
+    let mut held: HashMap<u32, HashMap<u32, usize>> = HashMap::new();
+    let mut queue: Vec<u32> = Vec::new();
+    let mut visited = HashSet::new();
+    for (_, v) in doc.trailer().iter() {
+        each_ref(v, |r| queue.push(r.num));
+    }
+    while let Some(num) = queue.pop() {
+        if !visited.insert(num) {
+            continue;
+        }
+        let obj = doc.get(ObjRef::new(num, doc.generation(num)));
+        each_ref(&obj, |r| {
+            if targets.contains(&r.num) {
+                *held.entry(r.num).or_default().entry(num).or_default() += 1;
+            }
+            if !visited.contains(&r.num) {
+                queue.push(r.num);
+            }
+        });
+    }
+    let mut seen: HashMap<(u32, u32), usize> = HashMap::new();
+    for (target, holder, _) in &read.entries {
+        *seen.entry((*target, *holder)).or_default() += 1;
+    }
+    // Covered: every reference to it is one the walk followed, held by a page or node, or by an
+    // object covered in turn. Everything the walk reached starts covered, and whatever has a
+    // reference it didn't follow, or is held by an object taken out, is taken out, until nothing
+    // more is. Content beyond what the walk read has to refer to an object on its way to the
+    // image, which takes out everything after it; a cycle the walk read whole stays covered.
+    let mut holds: HashMap<u32, Vec<u32>> = HashMap::new();
+    for (target, holders) in &held {
+        for h in holders.keys() {
+            holds.entry(*h).or_default().push(*target);
+        }
+    }
+    let mut covered: HashSet<u32> = held.keys().copied().collect();
+    let passes = |t: u32, covered: &HashSet<u32>| {
+        held.get(&t)
+            .is_some_and(|holders| holders.iter().all(|(h, n)| seen.get(&(t, *h)) == Some(n) && (read.roots.contains(h) || covered.contains(h))))
+    };
+    let mut check: Vec<u32> = covered.iter().copied().collect();
+    while let Some(t) = check.pop() {
+        if covered.contains(&t) && !passes(t, &covered) {
+            covered.remove(&t);
+            check.extend(holds.get(&t).into_iter().flatten().copied());
+        }
+    }
+    images.iter().copied().filter(|i| !covered.contains(i)).collect()
 }
 
 /// Colour components of a colour space PdfCraft resamples: gray (1) or RGB (3).
@@ -600,9 +779,9 @@ type Pixel = fn(&[u8]) -> Option<bool>;
 ///   - eight-bit `DeviceRGB` whose every pixel is black or white, which becomes `DeviceGray`. A
 ///     decode array the same for all three components becomes that one pair; another stops it.
 ///     Calibrated RGB and RGB with a profile are left out, as the profile could make them other
-///     than black and white; so is one drawn where `/DefaultGray` or `/DefaultRGB` is in force
-///     (`defaults`), which would draw it otherwise as grey, and one whose soft mask has a `/Matte`
-///     of three components;
+///     than black and white; so is one drawn where `/DefaultGray` or `/DefaultRGB` is or may be in
+///     force (`defaults`), which would draw it otherwise as grey, and one whose soft mask has a
+///     `/Matte` of three components;
 ///   - an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1, which stay 0 and
 ///     1 at one bit, whatever their colours, so the colour space stays. A decode array other than
 ///     the default stops it: in index units it would mean something else at one bit.
@@ -805,7 +984,7 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
 
 /// A black-and-white image (see [`one_bit`]) resampled and stored again per `settings`, if that is
 /// smaller as stored; `ppi` is its effective resolution, and `defaults` says it is drawn where
-/// `/DefaultGray` or `/DefaultRGB` is in force. Also says whether it was resampled.
+/// `/DefaultGray` or `/DefaultRGB` is or may be in force. Also says whether it was resampled.
 ///
 /// - **Resampled** ([`downsample_bits`]) when its resolution is above `above_ppi`, to `target_ppi`,
 ///   unless it has a soft mask, whose own size would then have to follow, or is a halftone or a
@@ -896,7 +1075,12 @@ pub(crate) fn run(
     report: &mut Report,
     progress: &mut dyn FnMut(Stage) -> bool,
 ) -> Result<(), OptimizeError> {
-    let (ppi, defaults) = walk_pages(doc, pages);
+    let (ppi, mut defaults, read) = walk_pages(doc, pages);
+    // Black-and-white RGB becomes grey, which default colour spaces would draw otherwise: one used
+    // where the walk didn't look may be drawn so.
+    let packs = settings.mono.compression != MonoCompression::Retain;
+    let rgb: HashSet<u32> = ppi.keys().filter(|r| packs && device_rgb(doc, **r)).map(|r| r.num).collect();
+    defaults.extend(used_elsewhere(doc, &rgb, &read));
     // Soft masks are processed with their image, not on their own.
     let masks: HashSet<ObjRef> = ppi
         .keys()
@@ -918,7 +1102,7 @@ pub(crate) fn run(
         // Packed from more bits a sample, it is lossless at one bit, but the grey or colour
         // settings can make it smaller still (below).
         let packed_from_more = s.dict.int(b"BitsPerComponent").is_some_and(|b| b > 1);
-        let (packed, mono) = match mono(doc, s, ppi, defaults.contains(&r), &settings.mono) {
+        let (packed, mono) = match mono(doc, s, ppi, defaults.contains(&r.num), &settings.mono) {
             Some(m) if packed_from_more => (Some(m), None),
             m => (None, m),
         };
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index edfb339d72..d8fe601a39 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1169,6 +1169,287 @@ fn black_and_white_rgb_stays_rgb_where_grey_would_be_drawn_otherwise() {
     assert_eq!(stream(&doc, img).raw, before.raw, "a use not followed");
 }
 
+/// An empty document, and a maker of images of only black and white as eight-bit `DeviceRGB`.
+fn rgb_page_fixture() -> (Document, impl Fn(&mut Document) -> ObjRef) {
+    let (w, h) = (1200u32, 480u32);
+    let rgb_data = samples_of(&bilevel(w, h, false), w, h, [&[0, 0, 0], &[255, 255, 255]], 8);
+    let image = move |doc: &mut Document| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+        doc.add(Object::Stream(Stream::flate(d, &rgb_data)))
+    };
+    (Document::new_empty(), image)
+}
+
+/// `q … cm /N Do Q` for each name, one under the other.
+fn draw_each(names: &[&str]) -> String {
+    names.iter().enumerate().map(|(i, n)| format!("q 200 0 0 80 6 {} cm /{n} Do Q ", 690 - 100 * i)).collect()
+}
+
+/// An `/XObject` dictionary of `names`.
+fn xobject_dict(names: &[(&str, ObjRef)]) -> Dict {
+    let mut x = Dict::new();
+    for (n, r) in names {
+        x.set(n.as_bytes().to_vec(), Object::Ref(*r));
+    }
+    x
+}
+
+/// A stream drawing `/Im` (or nothing) whose `/Resources` is `resources`, with `extra` in its
+/// dictionary: a form, an appearance or a tiling pattern.
+fn drawing(doc: &mut Document, resources: Option<Object>, extra: &[(&str, Object)]) -> ObjRef {
+    let mut f = Dict::new();
+    f.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 612.into(), 792.into()]));
+    if let Some(resources) = resources {
+        f.set(b"Resources".to_vec(), resources);
+    }
+    for (k, v) in extra {
+        f.set(k.as_bytes().to_vec(), v.clone());
+    }
+    doc.add(Object::Stream(Stream::from_raw(f, draw_each(&["Im"]).into_bytes())))
+}
+
+fn form_entries() -> [(&'static str, Object); 2] {
+    [("Type", Object::name("XObject")), ("Subtype", Object::name("Form"))]
+}
+
+/// Resources of `entries`.
+fn resources_of(entries: Vec<(&str, Object)>) -> Dict {
+    let mut res = Dict::new();
+    for (k, v) in entries {
+        res.set(k.as_bytes().to_vec(), v);
+    }
+    res
+}
+
+/// Give page `p` an annotation whose normal appearance is `appearance`.
+fn annotate(doc: &mut Document, p: ObjRef, appearance: ObjRef) {
+    let mut ap = Dict::new();
+    ap.set(b"N".to_vec(), Object::Ref(appearance));
+    let mut annotation = Dict::new();
+    annotation.set(b"Subtype".to_vec(), Object::name("Square"));
+    annotation.set(b"Rect".to_vec(), Object::Array(vec![0.into(), 0.into(), 100.into(), 100.into()]));
+    annotation.set(b"AP".to_vec(), Object::Dict(ap));
+    let annotation = doc.add(Object::Dict(annotation));
+    let mut annots = doc.get(p).as_dict().and_then(|d| d.get(b"Annots").and_then(|a| a.as_array().cloned())).unwrap_or_default();
+    annots.push(Object::Ref(annotation));
+    doc.update_dict(p, |d| d.set(b"Annots".to_vec(), Object::Array(annots))).unwrap();
+}
+
+/// `/DefaultGray` as a calibrated grey, in a `/ColorSpace` resource dictionary.
+fn default_gray() -> Object {
+    let mut white_point = Dict::new();
+    white_point.set(b"WhitePoint".to_vec(), Object::Array(vec![Object::Real(0.9505), 1.into(), Object::Real(1.089)]));
+    let mut c = Dict::new();
+    c.set(b"DefaultGray".to_vec(), Object::Array(vec![Object::name("CalGray"), Object::Dict(white_point)]));
+    Object::Dict(c)
+}
+
+/// Optimize with colour and grey settings that leave images alone, so only packing acts; the
+/// report's images resampled and stored again.
+fn pack_only(doc: &mut Document) -> (usize, usize) {
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    let r = optimize(doc, &Settings { color: keep, gray: keep, ..Settings::default() }).unwrap();
+    (r.images_resampled, r.images_recompressed)
+}
+
+/// Black-and-white RGB becomes grey for every use at once, so it stays RGB, byte for byte, when
+/// any use may be beyond the page content and forms the optimizer reads, where other default
+/// colour spaces may be in force: drawn by an annotation's appearance whose resources make
+/// `/DefaultGray` the grey it would be drawn in; by a tiling pattern; through an `/XObject`
+/// dictionary, or a form, that a page shares with such an appearance;
+/// referred to with another generation by the page than by such an appearance; drawn plainly on
+/// one page and, named with another generation, on a page whose resources set `/DefaultGray`;
+/// drawn plainly and only listed (not drawn) where `/DefaultGray` is in force, under the same
+/// generation or another, as a Type3 glyph without resources could draw it there; or held in an
+/// array elsewhere (another image's `/Alternates`).
+#[test]
+fn black_and_white_rgb_used_beyond_the_page_content_read_stays_rgb() {
+    let (mut doc, image) = rgb_page_fixture();
+    let [in_annotation, in_pattern, shared_xobjects, shared_form, other_generation, generation_under_defaults, listed, listed_as_1, in_array] =
+        [(); 9].map(|_| image(&mut doc));
+    let gray_resources = |im: Object| Some(Object::Dict(resources_of(vec![("XObject", im), ("ColorSpace", default_gray())])));
+    let direct = |im: ObjRef| Object::Dict(xobject_dict(&[("Im", im)]));
+
+    let appearance = drawing(&mut doc, gray_resources(direct(in_annotation)), &form_entries());
+    let pattern_entries =
+        [("PatternType", 1.into()), ("PaintType", 1.into()), ("TilingType", 1.into()), ("XStep", 612.into()), ("YStep", 792.into())];
+    let pattern = drawing(&mut doc, Some(Object::Dict(resources_of(vec![("XObject", direct(in_pattern))]))), &pattern_entries);
+    let p = page(&mut doc, &[("A", in_annotation), ("B", in_pattern)], &(draw_each(&["A", "B"]) + "/Pattern cs /P scn 0 0 10 10 re f"));
+    annotate(&mut doc, p, appearance);
+    doc.update_dict(p, |d| {
+        let mut res = d.get(b"Resources").and_then(Object::as_dict).cloned().unwrap();
+        let mut patterns = Dict::new();
+        patterns.set(b"P".to_vec(), Object::Ref(pattern));
+        res.set(b"Pattern".to_vec(), Object::Dict(patterns));
+        d.set(b"Resources".to_vec(), Object::Dict(res));
+    })
+    .unwrap();
+
+    // An /XObject dictionary of its own, read for a page, and a form drawn by a page, each also
+    // used by an appearance under DefaultGray.
+    let x = doc.add(Object::Dict(xobject_dict(&[("Im", shared_xobjects)])));
+    let q = page(&mut doc, &[], &draw_each(&["Im"]));
+    doc.update_dict(q, |d| d.set(b"Resources".to_vec(), Object::Dict(resources_of(vec![("XObject", Object::Ref(x))])))).unwrap();
+    let appearance = drawing(&mut doc, gray_resources(Object::Ref(x)), &form_entries());
+    annotate(&mut doc, q, appearance);
+    let form = drawing(&mut doc, Some(Object::Dict(resources_of(vec![("XObject", direct(shared_form))]))), &form_entries());
+    let q = page(&mut doc, &[("F", form)], &draw_each(&["F"]));
+    let appearance = drawing(&mut doc, gray_resources(Object::Dict(xobject_dict(&[("Im", form)]))), &form_entries());
+    annotate(&mut doc, q, appearance);
+
+    // The page names it with generation 1 (it is 0); the appearance with 0.
+    let q = page(&mut doc, &[("Im", ObjRef { generation: 1, ..other_generation })], &draw_each(&["Im"]));
+    let appearance = drawing(&mut doc, gray_resources(direct(other_generation)), &form_entries());
+    annotate(&mut doc, q, appearance);
+
+    // Drawn plainly as 0, and as 1 where DefaultGray is in force.
+    page(&mut doc, &[("Im", generation_under_defaults)], &draw_each(&["Im"]));
+    let q = page(&mut doc, &[], &draw_each(&["Im"]));
+    let gray = resources_of(vec![
+        ("XObject", Object::Dict(xobject_dict(&[("Im", ObjRef { generation: 1, ..generation_under_defaults })]))),
+        ("ColorSpace", default_gray()),
+    ]);
+    doc.update_dict(q, |d| d.set(b"Resources".to_vec(), Object::Dict(gray))).unwrap();
+
+    // Drawn plainly, and only listed where DefaultGray is in force, as 0 and as 1.
+    page(&mut doc, &[("A", listed), ("B", listed_as_1)], &draw_each(&["A", "B"]));
+    let q = page(&mut doc, &[], "");
+    let gray = resources_of(vec![
+        ("XObject", Object::Dict(xobject_dict(&[("A", listed), ("B", ObjRef { generation: 1, ..listed_as_1 })]))),
+        ("ColorSpace", default_gray()),
+    ]);
+    doc.update_dict(q, |d| d.set(b"Resources".to_vec(), Object::Dict(gray))).unwrap();
+
+    // Another image drawn on the page lists it as an alternate.
+    let mut alternate = Dict::new();
+    alternate.set(b"Image".to_vec(), Object::Ref(in_array));
+    let holder = image(&mut doc);
+    doc.update_dict(holder, |d| {
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        d.set(b"Alternates".to_vec(), Object::Array(vec![Object::Dict(alternate)]));
+    })
+    .unwrap();
+    page(&mut doc, &[("Im", in_array), ("Alt", holder)], &draw_each(&["Im"]));
+
+    let kept = [in_annotation, in_pattern, shared_xobjects, shared_form, other_generation, generation_under_defaults, listed, listed_as_1, in_array];
+    let before = kept.map(|r| stream(&doc, r));
+    pack_only(&mut doc);
+    for (i, b) in kept.iter().zip(&before) {
+        let s = stream(&doc, *i);
+        assert_eq!((&s.dict, &s.raw), (&b.dict, &b.raw), "{i:?}");
+    }
+}
+
+/// Black-and-white RGB that the page content and forms the optimizer reads are the only uses of
+/// becomes grey, however its resources are written: drawn on two pages, by a form, under two
+/// names on one page; through resources that are an object of their own, shared by two pages,
+/// whose `/XObject` dictionary is one too; through resources an object of their own with a direct
+/// `/XObject` dictionary; through resources a page inherits from the page tree; by a form whose
+/// `/Resources` is a reference; by a form without resources, through its page's; listed under a
+/// second name nothing draws; through resources an object of their own that a page without
+/// content lists too; and with an object nothing in the document reaches referring to it as well.
+#[test]
+fn black_and_white_rgb_drawn_only_where_the_optimizer_reads_becomes_grey() {
+    let (mut doc, image) = rgb_page_fixture();
+    let [everywhere, shared_resources, resources_object, inherited, form_resources_object, no_resources, spare_name, no_contents, unreachable] =
+        [(); 9].map(|_| image(&mut doc));
+    let set_resources = |doc: &mut Document, q: ObjRef, res: Object| doc.update_dict(q, |d| d.set(b"Resources".to_vec(), res)).unwrap();
+
+    let form =
+        drawing(&mut doc, Some(Object::Dict(resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("Im", everywhere)])))]))), &form_entries());
+    page(&mut doc, &[("E", everywhere), ("F", form)], &draw_each(&["E", "F"]));
+    page(&mut doc, &[("E", everywhere), ("G", everywhere)], &draw_each(&["E", "G"]));
+
+    let x = doc.add(Object::Dict(xobject_dict(&[("Im", shared_resources)])));
+    let res = doc.add(Object::Dict(resources_of(vec![("XObject", Object::Ref(x))])));
+    for _ in 0..2 {
+        let q = page(&mut doc, &[], &draw_each(&["Im"]));
+        set_resources(&mut doc, q, Object::Ref(res));
+    }
+    let res = doc.add(Object::Dict(resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("Im", resources_object)])))])));
+    let q = page(&mut doc, &[], &draw_each(&["Im"]));
+    set_resources(&mut doc, q, Object::Ref(res));
+
+    let q = page(&mut doc, &[], &draw_each(&["I"]));
+    doc.update_dict(q, |d| {
+        d.remove(b"Resources");
+    })
+    .unwrap();
+    let pages = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|d| d.reference(b"Pages"))).unwrap();
+    set_resources(&mut doc, pages, Object::Dict(resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("I", inherited)])))])));
+
+    let res = doc.add(Object::Dict(resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("Im", form_resources_object)])))])));
+    let form = drawing(&mut doc, Some(Object::Ref(res)), &form_entries());
+    page(&mut doc, &[("F", form)], &draw_each(&["F"]));
+    let form = drawing(&mut doc, None, &form_entries());
+    page(&mut doc, &[("F", form), ("Im", no_resources)], &draw_each(&["F"]));
+
+    page(&mut doc, &[("C", spare_name), ("D", spare_name)], &draw_each(&["C"]));
+    let res = doc.add(Object::Dict(resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("Im", no_contents)])))])));
+    for drawn in [true, false] {
+        let q = page(&mut doc, &[], &draw_each(&["Im"]));
+        set_resources(&mut doc, q, Object::Ref(res));
+        if !drawn {
+            doc.update_dict(q, |d| {
+                d.remove(b"Contents");
+            })
+            .unwrap();
+        }
+    }
+
+    page(&mut doc, &[("Im", unreachable)], &draw_each(&["Im"]));
+    // A form nothing refers to, drawing it under DefaultGray.
+    let orphan = resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("Im", unreachable)]))), ("ColorSpace", default_gray())]);
+    drawing(&mut doc, Some(Object::Dict(orphan)), &form_entries());
+
+    let grey = [everywhere, shared_resources, resources_object, inherited, form_resources_object, no_resources, spare_name, no_contents, unreachable];
+    assert_eq!(pack_only(&mut doc), (0, grey.len()));
+    for i in grey {
+        let s = stream(&doc, i);
+        assert_eq!((s.dict.get(b"ColorSpace"), s.dict.int(b"BitsPerComponent")), (Some(&Object::name("DeviceGray")), Some(1)), "{i:?}");
+    }
+}
+
+/// LibreOffice writes one resources object for a page and its `/Pages` node, and a transparency
+/// group's form whose `/Resources` is that same object, which the object lists in turn. Black-
+/// and-white RGB in it becomes grey: every reference is one the page walk reads, the cycle
+/// included. Drawn from outside as well, by an appearance under `/DefaultGray` that draws the
+/// form, it stays RGB.
+#[test]
+fn black_and_white_rgb_in_resources_its_page_tree_and_a_form_share_becomes_grey() {
+    for outside in [false, true] {
+        let (mut doc, image) = rgb_page_fixture();
+        let img = image(&mut doc);
+        let res = doc.add(Object::Dict(Dict::new()));
+        let form = drawing(&mut doc, Some(Object::Ref(res)), &form_entries());
+        doc.update_dict(res, |d| d.set(b"XObject".to_vec(), Object::Dict(xobject_dict(&[("Im", img), ("Tr", form)])))).unwrap();
+        let p = page(&mut doc, &[], &draw_each(&["Im", "Tr"]));
+        let pages = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|d| d.reference(b"Pages"))).unwrap();
+        for holder in [p, pages] {
+            doc.update_dict(holder, |d| d.set(b"Resources".to_vec(), Object::Ref(res))).unwrap();
+        }
+        if outside {
+            let gray = resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("Im", form)]))), ("ColorSpace", default_gray())]);
+            let appearance = drawing(&mut doc, Some(Object::Dict(gray)), &form_entries());
+            annotate(&mut doc, p, appearance);
+        }
+        let before = stream(&doc, img);
+        pack_only(&mut doc);
+        let s = stream(&doc, img);
+        if outside {
+            assert_eq!((&s.dict, &s.raw), (&before.dict, &before.raw), "drawn from outside too");
+        } else {
+            assert_eq!((s.dict.get(b"ColorSpace"), s.dict.int(b"BitsPerComponent")), (Some(&Object::name("DeviceGray")), Some(1)));
+        }
+    }
+}
+
 /// Black-and-white images above 450 ppi are averaged down to 300 ppi, by default: 1-bit Flate, CCITT
 /// Group 4 (alone and behind ASCIIHexDecode), an image mask (its inverting decode array stays), and
 /// eight-bit grey and RGB of only black and white (the RGB also the other way round, with a decode
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 99deb812bc..26e94eda01 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7384,8 +7384,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
-evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn where /DefaultGray or /DefaultRGB is in force, and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/optimize/tests/optimize.rs::black_and_white_rgb_used_beyond_the_page_content_read_stays_rgb", "crates/optimize/tests/optimize.rs::black_and_white_rgb_drawn_only_where_the_optimizer_reads_becomes_grey", "crates/optimize/tests/optimize.rs::black_and_white_rgb_in_resources_its_page_tree_and_a_form_share_becomes_grey", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn or listed where /DefaultGray or /DefaultRGB is in force or referred to from anywhere but the page and form resources read (an annotation's appearance or a pattern drawing it, directly or through resources or a form shared with a page; another image's /Alternates), and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 834a4daf9c7e1d1f487efb67b1fec305f30e44fb Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 29 Oct 2026 22:10:15 -0400
Subject: [PATCH 234/270] CI: workflows only call craft-common-actions at @main
 (#5378)

AGENTS.md (and CLAUDE.md where present) gets a CI workflows section: workflows only call
craft-common-actions at @main, with no other jobs; feature and fix PRs don't touch CI and
link or open a craft-common-actions issue (a PR only for a small fix that is safe for
every app and does not increase CI time); legacy jobs
aren't added to and move only as their own task, staying until a shared workflow runs them.

windows-arm64.yml moves from its SHA pin to @main. The pinned revision is on
craft-common-actions main and the workflow (and the actions it calls) is identical
there, so nothing changes in behaviour.
---
 .github/workflows/windows-arm64.yml | 3 ++-
 AGENTS.md                           | 5 +++++
 CLAUDE.md                           | 5 +++++
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
index 838af4524c..f3e2b20c7e 100644
--- a/.github/workflows/windows-arm64.yml
+++ b/.github/workflows/windows-arm64.yml
@@ -27,7 +27,8 @@ permissions:
 
 jobs:
   windows-arm64:
-    uses: storytold/craft-common-actions/.github/workflows/windows-arm64.yml@8bb4e5ab95443171104ad88113fe1ef9b0e5ce3f
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/windows-arm64.yml@main
     with:
       app-name: pdfcraft
       app-dir: PdfCraft
diff --git a/AGENTS.md b/AGENTS.md
index 2ecfe99a02..1f90ec3d8f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -138,3 +138,8 @@ Follow `CLAUDE.md`. It covers quality gates, layering, commit rules and how to r
   GitHub profiles). Never hand-edit `contributors.json`.
 - Maintainers refresh the stats with `python3 ../../craftrules/scripts/contributors.py .` (it also
   re-verifies who wrote each `people.toml` entry; `--check` only verifies).
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
diff --git a/CLAUDE.md b/CLAUDE.md
index cd1b5b284a..ef8a730ede 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -57,3 +57,8 @@ PdfCraft is a clean-room, open-source, Rust-native PDF application targeting Ado
 
 ## Current bootstrap debt (tracked in STATUS.md)
 - `pdfcraft-render` renders through the `hayro` crate directly and inspects documents through `lopdf`. Both get replaced by `cos` / `model` / the DisplayList device (M1–M2, ADR-0004).
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.

From f76dbb9e8c4436d0ba879190c4fc44f9630d9c20 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 29 Oct 2026 22:21:27 -0400
Subject: [PATCH 235/270] deps: bump tar, zip, roxmltree, rustls-webpki and
 symphonia to their latest versions (#5381)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- `zip`: 9.1.0 → 9.1.3

Requirement `roxmltree` 0.20 → 0.21: `ParsingOptions` gained `entity_resolver` (initializers take `..Default::default()`, i.e. none, as before) and is no longer `Copy` (two functions build it with a closure, the pattern merge.rs already used).
---
 Cargo.lock                    | 12 ++++++------
 crates/preflight/Cargo.toml   |  2 +-
 crates/preflight/src/xmp.rs   |  2 +-
 crates/xfa/Cargo.toml         |  2 +-
 crates/xfa/src/data/import.rs |  8 ++++----
 crates/xfa/src/data/merge.rs  |  8 ++++----
 crates/xfa/src/data/path.rs   |  2 +-
 crates/xfa/src/parse.rs       |  2 +-
 crates/xfa/src/pdf/strip.rs   |  2 +-
 crates/xfdf/Cargo.toml        |  2 +-
 crates/xfdf/src/common.rs     |  2 +-
 11 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 8fd7c9133b..2aea771074 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4544,7 +4544,7 @@ dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
  "pdfcraft-model",
- "roxmltree 0.20.0",
+ "roxmltree 0.21.2",
 ]
 
 [[package]]
@@ -4707,7 +4707,7 @@ dependencies = [
  "pdfcraft-cos",
  "pdfcraft-fonts",
  "png 0.18.1",
- "roxmltree 0.20.0",
+ "roxmltree 0.21.2",
  "sha2 0.11.1",
  "thiserror 2.0.21",
 ]
@@ -4720,7 +4720,7 @@ dependencies = [
  "pdfcraft-cos",
  "pdfcraft-forms",
  "pdfcraft-model",
- "roxmltree 0.20.0",
+ "roxmltree 0.21.2",
  "thiserror 2.0.21",
 ]
 
@@ -6753,7 +6753,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.5",
  "windows-sys 0.59.0",
@@ -8594,9 +8594,9 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "9.1.0"
+version = "9.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2886b00003a72c4ccee3f42cfc34908d33b2508a74d827dc2a4244706475c704"
+checksum = "1156b39d142a34b999c2310a50455e0cb3760bf7efad0122f796d813bee26ccb"
 dependencies = [
  "crc32fast",
  "flate2",
diff --git a/crates/preflight/Cargo.toml b/crates/preflight/Cargo.toml
index 082e44fc5c..99a72d9b6c 100644
--- a/crates/preflight/Cargo.toml
+++ b/crates/preflight/Cargo.toml
@@ -14,7 +14,7 @@ workspace = true
 pdfcraft-content = { workspace = true }
 pdfcraft-cos = { workspace = true }
 pdfcraft-model = { workspace = true }
-roxmltree = "0.20"
+roxmltree = "0.21"
 
 [dev-dependencies]
 flate2 = { workspace = true }
diff --git a/crates/preflight/src/xmp.rs b/crates/preflight/src/xmp.rs
index 0aaab12b23..7a54d70a1b 100644
--- a/crates/preflight/src/xmp.rs
+++ b/crates/preflight/src/xmp.rs
@@ -34,7 +34,7 @@ fn parsed_identifier(xmp: &str, namespace: &str, local: &str) -> Result<Option<S
     if !xml_limits_ok(xmp) {
         return Err(());
     }
-    let options = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: 100_000 };
+    let options = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: 100_000, ..Default::default() };
     let doc = roxmltree::Document::parse_with_options(xmp, options).map_err(|_| ())?;
     for node in doc.descendants().filter(roxmltree::Node::is_element) {
         if let Some(value) = node.attribute((namespace, local)) {
diff --git a/crates/xfa/Cargo.toml b/crates/xfa/Cargo.toml
index d917018057..687efaf18e 100644
--- a/crates/xfa/Cargo.toml
+++ b/crates/xfa/Cargo.toml
@@ -13,7 +13,7 @@ workspace = true
 [dependencies]
 pdfcraft-cos = { workspace = true }
 pdfcraft-fonts = { workspace = true }
-roxmltree = "0.20"
+roxmltree = "0.21"
 base64 = "0.23"
 png = "0.18"
 sha2 = "0.11"
diff --git a/crates/xfa/src/data/import.rs b/crates/xfa/src/data/import.rs
index 7582d86763..006f4ff73b 100644
--- a/crates/xfa/src/data/import.rs
+++ b/crates/xfa/src/data/import.rs
@@ -192,7 +192,7 @@ pub fn parse_data_file(text: &str, expect_root: Option<&str>) -> Result<Vec<Impo
     if crate::xml_nesting_depth(text) > MAX_IMPORT_DEPTH {
         return Err(XfaError::TooLarge(format!("the data file nests more than {MAX_IMPORT_DEPTH} levels deep")));
     }
-    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
+    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES, ..Default::default() };
     let parsed = roxmltree::Document::parse_with_options(text, opts).map_err(|e| XfaError::Malformed(format!("the data file is not XML: {e}")))?;
     let root = parsed.root_element();
     let local = root.tag_name().name();
@@ -304,14 +304,14 @@ pub fn export_data(doc: &Document, xdp: bool, pdf_name: &str) -> Result<String,
 /// data element), each with the namespaces it uses declared on it. `Ok(None)`: no datasets
 /// element; `Err`: the text can't be read.
 fn datasets_markup(text: &str) -> Result<Option<(String, String)>, ()> {
-    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
+    let opts = || roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES, ..Default::default() };
     if crate::xml_nesting_depth(text) > crate::MAX_XML_DEPTH {
         return Err(());
     }
     let wrapped = format!("{WRAP_OPEN}{text}{WRAP_CLOSE}");
-    let (src, parsed) = match roxmltree::Document::parse_with_options(text, opts) {
+    let (src, parsed) = match roxmltree::Document::parse_with_options(text, opts()) {
         Ok(d) => (text, d),
-        Err(_) => (wrapped.as_str(), roxmltree::Document::parse_with_options(&wrapped, opts).map_err(|_| ())?),
+        Err(_) => (wrapped.as_str(), roxmltree::Document::parse_with_options(&wrapped, opts()).map_err(|_| ())?),
     };
     let Some(ds) = parsed.descendants().find(|n| n.is_element() && n.tag_name().name() == "datasets") else { return Ok(None) };
     let data = ds.children().find(|n| n.is_element() && n.tag_name().name() == "data");
diff --git a/crates/xfa/src/data/merge.rs b/crates/xfa/src/data/merge.rs
index 48b4cedabf..0aefc634b5 100644
--- a/crates/xfa/src/data/merge.rs
+++ b/crates/xfa/src/data/merge.rs
@@ -117,7 +117,7 @@ fn merge(text: &str, within: Within, op: Op, warnings: &mut Vec<String>) -> Merg
         warnings.push("The XFA data nests XML elements deeper than the reader accepts; the field values were not written to it".into());
         return Merged::Failed;
     }
-    let opts = || roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
+    let opts = || roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES, ..Default::default() };
     // A packet of an array may use the prefixes the XDP envelope declares: read it inside
     // an element declaring the usual ones.
     let wrapped;
@@ -389,9 +389,9 @@ pub(super) fn readable(text: &str, within: Within, warnings: &mut Vec<String>) -
         warnings.push(format!("The XFA data would be larger than {} MB; it was not written", MAX_PACKET_WRITE >> 20));
         return false;
     }
-    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
-    let ok = roxmltree::Document::parse_with_options(text, opts).is_ok()
-        || (within == Within::Packet && roxmltree::Document::parse_with_options(&format!("{WRAP_OPEN}{text}{WRAP_CLOSE}"), opts).is_ok());
+    let opts = || roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES, ..Default::default() };
+    let ok = roxmltree::Document::parse_with_options(text, opts()).is_ok()
+        || (within == Within::Packet && roxmltree::Document::parse_with_options(&format!("{WRAP_OPEN}{text}{WRAP_CLOSE}"), opts()).is_ok());
     if !ok {
         warnings.push("The XFA data would not be well-formed XML after this change; it was not written".into());
     }
diff --git a/crates/xfa/src/data/path.rs b/crates/xfa/src/data/path.rs
index ef61cdbd59..d3568817d2 100644
--- a/crates/xfa/src/data/path.rs
+++ b/crates/xfa/src/data/path.rs
@@ -15,7 +15,7 @@ pub fn parse_datasets(xdp: &str) -> Option<DataNode> {
     if crate::xml_nesting_depth(xdp) > crate::MAX_XML_DEPTH {
         return None;
     }
-    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
+    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES, ..Default::default() };
     let doc = roxmltree::Document::parse_with_options(xdp, opts).ok()?;
     let datasets = doc.descendants().find(|n| n.is_element() && n.tag_name().name() == "datasets")?;
     let data = datasets.children().find(|n| n.is_element() && n.tag_name().name() == "data")?;
diff --git a/crates/xfa/src/parse.rs b/crates/xfa/src/parse.rs
index 838d1730ea..fc114aebac 100644
--- a/crates/xfa/src/parse.rs
+++ b/crates/xfa/src/parse.rs
@@ -725,7 +725,7 @@ pub fn parse(xml: &str) -> Result<(Template, Vec<String>), XfaError> {
             crate::MAX_XML_DEPTH
         )));
     }
-    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
+    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES, ..Default::default() };
     let doc = roxmltree::Document::parse_with_options(xml, opts).map_err(|e| XfaError::Malformed(format!("template XML: {e}")))?;
     let root = doc.root_element();
     // The XDP's config packet has a <template> element too: the one we want is in the
diff --git a/crates/xfa/src/pdf/strip.rs b/crates/xfa/src/pdf/strip.rs
index 2f3084ec93..b753510653 100644
--- a/crates/xfa/src/pdf/strip.rs
+++ b/crates/xfa/src/pdf/strip.rs
@@ -126,7 +126,7 @@ pub fn strip(doc: &mut Document) -> Result<Stripped, XfaError> {
             }
             // One XDP: the packets it holds are the envelope's children.
             let text = s.decoded_within(64 << 20).ok().and_then(|b| crate::packets::decode(&b)).map(|(t, _)| t).unwrap_or_default();
-            let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: 1_000_000 };
+            let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: 1_000_000, ..Default::default() };
             if crate::xml_nesting_depth(&text) <= crate::MAX_XML_DEPTH
                 && let Ok(parsed) = roxmltree::Document::parse_with_options(&text, opts)
             {
diff --git a/crates/xfdf/Cargo.toml b/crates/xfdf/Cargo.toml
index 3ede565030..f868c95719 100644
--- a/crates/xfdf/Cargo.toml
+++ b/crates/xfdf/Cargo.toml
@@ -13,5 +13,5 @@ pdfcraft-cos = { workspace = true }
 pdfcraft-annot = { workspace = true }
 pdfcraft-forms = { workspace = true }
 pdfcraft-model = { workspace = true }
-roxmltree = "0.20"
+roxmltree = "0.21"
 thiserror = { workspace = true }
diff --git a/crates/xfdf/src/common.rs b/crates/xfdf/src/common.rs
index c4ac9f600d..488277dc19 100644
--- a/crates/xfdf/src/common.rs
+++ b/crates/xfdf/src/common.rs
@@ -86,7 +86,7 @@ pub(crate) fn check_form_xml_depth(text: &str) -> Result<(), DataError> {
 }
 
 pub(crate) fn parse_form_xml(text: &str) -> Result<roxmltree::Document<'_>, roxmltree::Error> {
-    roxmltree::Document::parse_with_options(text, roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES })
+    roxmltree::Document::parse_with_options(text, roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES, ..Default::default() })
 }
 
 pub(crate) const SUBTYPES: [(&str, &str); 17] = [

From 3517d05b47bf6a7fa7ce3908c15da42d9acd7ef2 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Fri, 30 Oct 2026 01:27:58 -0400
Subject: [PATCH 236/270] Update prompt shows the app icon and accent color
 instead of a letter (#5388)

UPDATE_APP (native builds; craft-update is a native-only dependency) carries our 128 px icon and accent (#b70228, its red, from the icon (#5245)). The updater, the self-update
helper and craft-update's startup prompt all get them through crate::UPDATE_APP; the
prompt draws the icon, the accent and "by ArtCraft" (craft-update's default developer).

craft-update is pinned to storytold/craft-libs main at 1065653e7 (#434).
Clippy fixes for Rust 1.99 in untouched code (same logic):
- crates/edit/src/images.rs
- crates/forms/src/appearance.rs
---
 Cargo.lock                             | 19 ++++++++++---------
 Cargo.toml                             |  3 ++-
 apps/pdfcraft/src/main.rs              |  2 +-
 crates/edit/src/images.rs              |  5 ++---
 crates/forms/src/appearance.rs         |  2 +-
 crates/ui-egui/src/lib.rs              |  9 +++++++++
 crates/ui-egui/src/platform/updates.rs |  4 ++--
 7 files changed, 27 insertions(+), 17 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2aea771074..efe849ad78 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -229,7 +229,7 @@ dependencies = [
  "objc2-foundation 0.3.2",
  "parking_lot",
  "percent-encoding",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
  "wl-clipboard-rs",
  "x11rb",
 ]
@@ -1279,13 +1279,14 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545#e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545"
+source = "git+https://github.com/storytold/craft-libs?rev=1065653e75854e9c17e1ff563acdd344c1b185f0#1065653e75854e9c17e1ff563acdd344c1b185f0"
 dependencies = [
  "chrono",
  "dunce",
  "egui",
  "flate2",
  "getrandom 0.3.4",
+ "image",
  "log",
  "plist",
  "semver",
@@ -2015,7 +2016,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4114,7 +4115,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5259,7 +5260,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5796,7 +5797,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5866,7 +5867,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6756,7 +6757,7 @@ dependencies = [
  "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.5",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7867,7 +7868,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 64a3cf5b60..145495bed4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -23,7 +23,8 @@ craft-keymap = { git = "https://github.com/storytold/craft-libs", version = "0.1
 craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545" }
 # Whether a path stored in a document may be opened (GoToR link targets).
 craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545" }
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545", features = ["egui"] }
+# craft-update with storytold/craft-libs#434: the update prompt shows the app's icon, accent and developer.
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "1065653e75854e9c17e1ff563acdd344c1b185f0", features = ["egui"] }
 # internal
 pdfcraft-geom = { path = "crates/geom", version = "0.15.0" }
 pdfcraft-filters = { path = "crates/filters", version = "0.15.0" }
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index f8e4e5b0d2..814730f344 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -196,7 +196,7 @@ fn rejoin_split_paths(args: Vec<String>, exists: impl Fn(&str) -> bool) -> Vec<S
 fn main() -> eframe::Result {
     // Windows: the update helper is a copy of this program started with `--finish-update`.
     #[cfg(windows)]
-    if let Some(result) = craft_update::self_update::finish(&craft_update::suite::PDFCRAFT, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
+    if let Some(result) = craft_update::self_update::finish(&pdfcraft_ui_egui::UPDATE_APP, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
         std::process::exit(i32::from(result.is_err()));
     }
     // First, so the panic hook and every start-up warning are recorded (`logging`).
diff --git a/crates/edit/src/images.rs b/crates/edit/src/images.rs
index 5180e76018..c39ee44fc9 100644
--- a/crates/edit/src/images.rs
+++ b/crates/edit/src/images.rs
@@ -186,12 +186,11 @@ impl ImageState {
                     self.path.curve_to(self.point(x1, y1), end, end);
                 }
             }
-            b"h" => {
+            b"h"
                 // ClosePath with no subpath panics by the same contract (#3581).
-                if self.path.elements().last().is_some() {
+                if self.path.elements().last().is_some() => {
                     self.path.close_path();
                 }
-            }
             b"re" => {
                 if let Some([x, y, w, h]) = op.nums::<4>() {
                     self.path.move_to(self.point(x, y));
diff --git a/crates/forms/src/appearance.rs b/crates/forms/src/appearance.rs
index b6fedbd55c..c9ff86d17a 100644
--- a/crates/forms/src/appearance.rs
+++ b/crates/forms/src/appearance.rs
@@ -599,7 +599,7 @@ fn comb_dividers(doc: &Document, wd: &Dict, w: f64, h: f64, cells: usize) -> Str
     let inset = border_width(doc, wd);
     let lw = line_width(doc, wd);
     let Some(bc) = color_array(doc, mk.as_ref(), b"BC") else { return String::new() };
-    if !(inset > 0.0 && inset.is_finite() && lw > 0.0 && lw.is_finite()) || !(2..=MAX_COMB_DIVIDERS).contains(&cells) {
+    if !(inset > 0.0 && inset.is_finite() && lw > 0.0 && lw.is_finite() && (2..=MAX_COMB_DIVIDERS).contains(&cells)) {
         return String::new();
     }
     let cell = w / cells as f64;
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 8a8c51775a..440c0d13c3 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -9,6 +9,15 @@
 // The settings object in `persist` is one `json!` literal past the default limit of 128.
 #![recursion_limit = "256"]
 
+/// PdfCraft as craft-update knows it, with its 128 px icon and accent colour: the update
+/// prompt shows both, and an AppImage's menu entry gets the icon.
+#[cfg(not(target_arch = "wasm32"))]
+pub const UPDATE_APP: craft_update::app::App = craft_update::app::App {
+    icon_png: Some(include_bytes!("../../../assets/app-icon/hicolor/128x128/apps/ai.storyteller.pdfcraft.png")),
+    accent: Some([0xb7, 0x02, 0x28]),
+    ..craft_update::suite::PDFCRAFT
+};
+
 use crate::control::Host as _;
 
 /// Translate an English UI string into the current language (see [`i18n`]).
diff --git a/crates/ui-egui/src/platform/updates.rs b/crates/ui-egui/src/platform/updates.rs
index fa59f9a89f..7ffebdcbc0 100644
--- a/crates/ui-egui/src/platform/updates.rs
+++ b/crates/ui-egui/src/platform/updates.rs
@@ -30,7 +30,7 @@ impl Default for Updates {
     fn default() -> Self {
         Self {
             #[cfg(not(target_arch = "wasm32"))]
-            updater: Updater::new(&craft_update::suite::PDFCRAFT, env!("CARGO_PKG_VERSION")),
+            updater: Updater::new(&crate::UPDATE_APP, env!("CARGO_PKG_VERSION")),
             open: false,
             #[cfg(not(target_arch = "wasm32"))]
             startup_check: false,
@@ -50,7 +50,7 @@ impl PdfCraftApp {
     /// Replaces the network with `source` (tests).
     #[cfg(not(target_arch = "wasm32"))]
     pub fn set_update_source(&mut self, source: UpdateSource) {
-        self.updates.updater = Updater::new(&craft_update::suite::PDFCRAFT, env!("CARGO_PKG_VERSION")).with_source(source);
+        self.updates.updater = Updater::new(&crate::UPDATE_APP, env!("CARGO_PKG_VERSION")).with_source(source);
     }
 
     /// Help ▸ Check for updates: ask for the latest release and show the outcome.

From 1d1cbc4ec92012767f5b48c92b451e15eb401c42 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Fri, 30 Oct 2026 02:35:18 -0400
Subject: [PATCH 237/270] UPD.1: honor app pretend versions in update checks
 (#5397)

---
 Cargo.lock               | 2 +-
 Cargo.toml               | 4 ++--
 contributors/people.toml | 3 +++
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index efe849ad78..c4f57c0260 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1279,7 +1279,7 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=1065653e75854e9c17e1ff563acdd344c1b185f0#1065653e75854e9c17e1ff563acdd344c1b185f0"
+source = "git+https://github.com/storytold/craft-libs?rev=04aa1703b32d299e54f78fcde4182f2b393a9116#04aa1703b32d299e54f78fcde4182f2b393a9116"
 dependencies = [
  "chrono",
  "dunce",
diff --git a/Cargo.toml b/Cargo.toml
index 145495bed4..4938963369 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -23,8 +23,8 @@ craft-keymap = { git = "https://github.com/storytold/craft-libs", version = "0.1
 craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545" }
 # Whether a path stored in a document may be opened (GoToR link targets).
 craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545" }
-# craft-update with storytold/craft-libs#434: the update prompt shows the app's icon, accent and developer.
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "1065653e75854e9c17e1ff563acdd344c1b185f0", features = ["egui"] }
+# craft-update: app-specific pretend versions apply to startup and manual checks.
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "04aa1703b32d299e54f78fcde4182f2b393a9116", features = ["egui"] }
 # internal
 pdfcraft-geom = { path = "crates/geom", version = "0.15.0" }
 pdfcraft-filters = { path = "crates/filters", version = "0.15.0" }
diff --git a/contributors/people.toml b/contributors/people.toml
index dd75a07314..53cc2391ed 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -180,3 +180,6 @@ sync_github_name = true
 [people.dotCooCoo]
 real_name = "Robert Lee"
 sync_github_name = true
+
+[people.dylanmtaylor]
+sync_github_name = true

From ee82cf1a72c97ff890584bed782831e9eccd7738 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 08:58:13 +0100
Subject: [PATCH 238/270] Remove extra blank lines after relocating font-size
 controls

---
 crates/ui-egui/src/panels/format_text_ui.rs | 2 --
 1 file changed, 2 deletions(-)

diff --git a/crates/ui-egui/src/panels/format_text_ui.rs b/crates/ui-egui/src/panels/format_text_ui.rs
index 4645ca367b..5807bb1731 100644
--- a/crates/ui-egui/src/panels/format_text_ui.rs
+++ b/crates/ui-egui/src/panels/format_text_ui.rs
@@ -353,8 +353,6 @@ fn typed_font_size(text: &str) -> Option<f64> {
     (value.is_finite() && (1.0..=500.0).contains(&value)).then_some(value)
 }
 
-
-
 #[cfg(test)]
 mod tests {
     #[test]

From 7227eb68ab383e47413f1a980f340f5132cf4144 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:10:05 +0100
Subject: [PATCH 239/270] Name the Pages sidebar keyboard group and record its
 accessible snapshot

---
 crates/ui-egui/src/panels/pages.rs             | 1 +
 crates/ui-egui/tests/it/view.rs                | 1 +
 crates/ui-egui/tests/snapshots/panel_pages.txt | 1 +
 3 files changed, 3 insertions(+)

diff --git a/crates/ui-egui/src/panels/pages.rs b/crates/ui-egui/src/panels/pages.rs
index cda3cb5ec3..1d16331eb9 100644
--- a/crates/ui-egui/src/panels/pages.rs
+++ b/crates/ui-egui/src/panels/pages.rs
@@ -91,6 +91,7 @@ pub(super) fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut cr
     let focus_id = ui.make_persistent_id(("pages-keyboard", view.id));
     view.pages_focus_id = Some(focus_id);
     let keyboard = ui.interact(ui.clip_rect(), focus_id, Sense::focusable_noninteractive());
+    keyboard.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Group, ui.is_enabled(), tl!("Pages")));
     let owns_keyboard = keyboard.has_focus();
     // Escape remains with the panel after the pointer moves away.
     ui.memory_mut(|m| m.set_focus_lock_filter(focus_id, egui::EventFilter { escape: true, ..Default::default() }));
diff --git a/crates/ui-egui/tests/it/view.rs b/crates/ui-egui/tests/it/view.rs
index c04bc16312..b9a01f408f 100644
--- a/crates/ui-egui/tests/it/view.rs
+++ b/crates/ui-egui/tests/it/view.rs
@@ -57,6 +57,7 @@ fn sidebar_key(h: &mut Harness<'static, PdfCraftApp>, key: Key, modifiers: Modif
 fn pages_sidebar_select_all_keeps_current_page_and_keyboard_scope() {
     use egui_kittest::kittest::Queryable;
     let mut h = harness(&[("panel", "pages")]);
+    let _ = h.get_by_role_and_label(egui::accesskit::Role::Group, "Pages");
     h.get_by_label("Page 2").click();
     h.run_steps(3);
     assert_eq!(h.state().views[0].current, 1);
diff --git a/crates/ui-egui/tests/snapshots/panel_pages.txt b/crates/ui-egui/tests/snapshots/panel_pages.txt
index 7f432057d9..e438fe3798 100644
--- a/crates/ui-egui/tests/snapshots/panel_pages.txt
+++ b/crates/ui-egui/tests/snapshots/panel_pages.txt
@@ -7,6 +7,7 @@ Label = "100%"
 Button "Smaller thumbnails" [off]
 Slider "Thumbnail size"
 Button "Larger thumbnails" [off]
+Group "Pages"
 Button "Page 1" [off]
 Label = "1"
 Button "Page 2" [off]

From e19f9646906df51c287f9b049feb8199cd645996 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:10:25 +0100
Subject: [PATCH 240/270] Handle the current fallible FDF export API in the
 round-trip regression

---
 crates/xfdf/src/tests.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/xfdf/src/tests.rs b/crates/xfdf/src/tests.rs
index 1f35f82b70..0da17c1e67 100644
--- a/crates/xfdf/src/tests.rs
+++ b/crates/xfdf/src/tests.rs
@@ -1254,7 +1254,7 @@ fn edited_button_export_values_round_trip_in_all_data_formats() {
     set_value(&mut doc, "Agree", &FieldValue::Check(true)).unwrap();
     set_value(&mut doc, "Size", &FieldValue::Radio(Some("Small".into()))).unwrap();
     let doc = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
-    let mut exports = vec![export_xfdf(&doc, false, true, "").into_bytes(), export_fdf(&doc, false, true, "")];
+    let mut exports = vec![export_xfdf(&doc, false, true, "").into_bytes(), export_fdf(&doc, false, true, "").unwrap()];
     exports.extend([Format::Xml, Format::Csv, Format::Txt].map(|f| export_data(&doc, f).into_bytes()));
     for (index, bytes) in exports.into_iter().enumerate() {
         if index < 2 {

From 4b319bb3835709626c663b8d41b72d2f9574acc0 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:29:42 +0100
Subject: [PATCH 241/270] Keep typed font sizes accessible and within the
 current panel layout

Use a named compact preset arrow beside the field, retain the row alignment/width assertions for the editable control, and open the current colour flyout in the saved-text regression. No accessibility or layout checks are disabled.
---
 crates/ui-egui/src/panels/format_text_ui.rs | 54 ++++++++++++---------
 crates/ui-egui/tests/it/content.rs          |  4 +-
 crates/ui-egui/tests/it/editing.rs          |  2 +
 3 files changed, 35 insertions(+), 25 deletions(-)

diff --git a/crates/ui-egui/src/panels/format_text_ui.rs b/crates/ui-egui/src/panels/format_text_ui.rs
index 5807bb1731..8b36e79846 100644
--- a/crates/ui-egui/src/panels/format_text_ui.rs
+++ b/crates/ui-egui/src/panels/format_text_ui.rs
@@ -320,32 +320,40 @@ fn colour_button(ui: &mut egui::Ui, t: &Tokens, color: [f64; 3]) -> egui::Respon
 /// Commit a typed size once (Enter or leaving the field), rather than one undo step per key.
 /// The bounds match AddedText validation, so the panel also accepts coloured text below 8 pt.
 fn font_size_input(ui: &mut egui::Ui, size: &mut f64) {
-    let id = ui.make_persistent_id("font-size-input");
-    let (previous, mut text) = ui.data(|d| d.get_temp::<(u64, String)>(id)).unwrap_or_else(|| (size.to_bits(), size.to_string()));
-    if previous != size.to_bits() {
-        text = size.to_string();
-    }
-    let response = ui.add(egui::TextEdit::singleline(&mut text).id(id).desired_width(44.0)).accessible_name(tl!("Font size:"));
-    let cancel = (response.has_focus() || response.lost_focus()) && ui.input(|i| i.key_pressed(egui::Key::Escape));
-    if cancel {
-        text = size.to_string();
-        response.surrender_focus();
-    } else if response.lost_focus() || (response.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter))) {
-        if let Some(value) = typed_font_size(&text) {
-            *size = value;
+    ui.scope(|ui| {
+        ui.spacing_mut().item_spacing.x = 2.0;
+        let id = ui.make_persistent_id("font-size-input");
+        let (previous, mut text) = ui.data(|d| d.get_temp::<(u64, String)>(id)).unwrap_or_else(|| (size.to_bits(), size.to_string()));
+        if previous != size.to_bits() {
+            text = size.to_string();
         }
-        text = size.to_string();
-    }
-    let before = *size;
-    craft_ui::ComboBox::from_id_salt("font-size").selected_text("pt").width(28.0).show_ui(ui, |ui| {
-        for value in SIZES {
-            ui.selectable_value(size, value, format!("{value} pt"));
+        let field = egui::TextEdit::singleline(&mut text).id(id).desired_width(40.0);
+        let response = ui.add_sized([40.0, ui.spacing().interact_size.y], field).accessible_name(tl!("Font size:"));
+        let cancel = (response.has_focus() || response.lost_focus()) && ui.input(|i| i.key_pressed(egui::Key::Escape));
+        if cancel {
+            text = size.to_string();
+            response.surrender_focus();
+        } else if response.lost_focus() || (response.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter))) {
+            if let Some(value) = typed_font_size(&text) {
+                *size = value;
+            }
+            text = size.to_string();
         }
+        let before = *size;
+        let list = icons::button(ui, "chevron-down", PRESET_LIST, false, tl!("Font size"));
+        egui::Popup::menu(&list).show(|ui| {
+            for value in SIZES {
+                if ui.selectable_label(*size == value, format!("{value} pt")).clicked() {
+                    *size = value;
+                    ui.close();
+                }
+            }
+        });
+        if *size != before {
+            text = size.to_string();
+        }
+        ui.data_mut(|d| d.insert_temp(id, (size.to_bits(), text)));
     });
-    if *size != before {
-        text = size.to_string();
-    }
-    ui.data_mut(|d| d.insert_temp(id, (size.to_bits(), text)));
 }
 
 fn typed_font_size(text: &str) -> Option<f64> {
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 4a7927f692..aa832fe2df 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -699,7 +699,7 @@ fn format_text_rows_line_up_and_fit_the_panel() {
     let combo = |h: &Harness<'static, PdfCraftApp>, value: &str| {
         h.query_all_by_role(Role::ComboBox).find(|n| n.value().as_deref() == Some(value)).map(|n| n.rect()).expect(value)
     };
-    let (font, size) = (combo(&h, "Helvetica"), combo(&h, "12"));
+    let (font, size) = (combo(&h, "Helvetica"), h.get_by_label("Font size:").rect());
     let middle = |r: egui::Rect| r.center().y;
     for label in ["Colour", "Alignment"] {
         let other = h.get_by_label(label).rect();
@@ -716,7 +716,7 @@ fn format_text_rows_line_up_and_fit_the_panel() {
     for r in &scale_row {
         assert!((middle(*r) - middle(scale_row[0])).abs() < 0.5, "{scale_row:?}");
     }
-    for r in h.query_all_by_role(Role::ComboBox).map(|n| n.rect()).chain(scale_row) {
+    for r in h.query_all_by_role(Role::ComboBox).map(|n| n.rect()).chain(scale_row).chain([size, h.get_by_label("Font size").rect()]) {
         assert!(r.right() <= font.right() + 0.5, "{r:?} reaches past the panel ({font:?})");
     }
 }
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 0dc4914b17..b0a8be83d2 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -4166,6 +4166,8 @@ fn typed_small_coloured_text_size_survives_save_and_reopen() {
     h.event(egui::Event::Text("6.5".into()));
     h.key_press(Key::Enter);
     h.run_steps(4);
+    h.get_by_label("Colour").click();
+    h.run_steps(2);
     h.get_by_label("Blue").click();
     h.run_steps(4);
     let id = h.state().views[0].id;

From a07f94f2f7527c34c92e4022a572557ca33d6fe8 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 10:46:11 +0100
Subject: [PATCH 242/270] test: supply Fill & Sign colour in combined
 window-title fixture

---
 crates/ui-egui/tests/it/viewer.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/ui-egui/tests/it/viewer.rs b/crates/ui-egui/tests/it/viewer.rs
index 85e11616b3..3d824b9ea1 100644
--- a/crates/ui-egui/tests/it/viewer.rs
+++ b/crates/ui-egui/tests/it/viewer.rs
@@ -1046,7 +1046,7 @@ fn the_window_title_marks_a_draft_that_is_not_applied_yet() {
     h.run_steps(2);
     assert_eq!(h.state().window_title, "b.pdf — PdfCraft");
     let i = h.state().active.unwrap();
-    h.state_mut().views[i].fill_text = Some(TypeBox { page: 0, at: [40.0, 200.0], text: "Typed".into(), size: 10.0, focus: false });
+    h.state_mut().views[i].fill_text = Some(TypeBox { page: 0, at: [40.0, 200.0], text: "Typed".into(), size: 10.0, color: [0.0; 3], focus: false });
     h.run_steps(2);
     let s = h.state();
     assert!(!s.session.get(s.views[i].id).unwrap().dirty, "nothing applied to the document yet");

From bdf56209ce6a22980ef488eec92a55073f5a4e18 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 11:08:55 +0100
Subject: [PATCH 243/270] style: format combined paragraph regression

---
 crates/edit/src/tests.rs | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 64bc9e8da5..5187a2aecc 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -8539,11 +8539,7 @@ fn q_inside_a_text_object_restores_the_text_matrices() {
 #[test]
 fn wrapped_rows_keep_alignment_separate_from_hard_break_markers() {
     let mut doc = text_page("BT /F1 10 Tf 12 TL 72 700 Td (Old) Tj ET");
-    let style = text::BlockStyle {
-        width: Some(60.0),
-        aligns: vec![Some(added::Align::Left), Some(added::Align::Right)],
-        ..Default::default()
-    };
+    let style = text::BlockStyle { width: Some(60.0), aligns: vec![Some(added::Align::Left), Some(added::Align::Right)], ..Default::default() };
     text::rewrite_block(&mut doc, 0, 0, Some("One two three four five six\nTail"), &style).unwrap();
     let doc = reopen(&doc);
     let lines = text::text_lines(&doc, 0).unwrap();

From 6d7f739e3c9f360602f2fb1b702ffa839fa22d33 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 12:38:09 +0100
Subject: [PATCH 244/270] test: enforce page press routing and record
 integration regression evidence

---
 CLAUDE.md                                     |  2 +-
 .../ui-egui/src/canvas/page_pointer/tests.rs  | 81 +++++++++++++++++++
 docs/integration-20261030.md                  | 42 +++++++++-
 3 files changed, 123 insertions(+), 2 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 5bf9403c94..b6c91b1fe6 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -23,7 +23,7 @@ PdfCraft is a clean-room, open-source, Rust-native PDF application targeting Ado
 - **Layering.** Nothing below L7 depends on egui/winit/eframe/rfd (`plan/architecture.md` §3). `cos`/`filters`/`crypt`/`arlington` stay standalone.
 - **Page input.** Page modules read `PagePointer` (`crates/ui-egui/src/page_pointer.rs`), never egui's raw pointer state (`hover_pos`, `interact_pos`, `latest_pos`, `press_origin`, button reads); `page_pointer::tests::page_modules_read_the_pointer_only_through_page_pointer` enforces it.
 - **Page cursor.** Page modules claim the cursor for what is under the pointer (`view.cursor.claim(Layer::…, icon)`, `crates/ui-egui/src/canvas/page_cursor.rs`), never set it (`set_cursor_icon`, `cursor_icon =`, `on_hover_cursor`); `document_area` sets it once, from the claim on the highest layer the active tool reaches. `page_pointer::tests::page_modules_claim_the_cursor_and_never_set_it` enforces it.
-- **Page presses.** A page module decides what of its own is under a point in one hit test, which returns a `Hit` (owner, layer, cursor, tip; `crates/ui-egui/src/canvas/page_router.rs`) and gives its cursor, its tip and its press. It acts on a press only when the router says the press is its own (`view.router.owner(page)`), never by testing the press point again or by asking another module whether it wants it. Escape cancels any press the pages hold (`cancel_on_escape`), and that press is ignored until the button is up.
+- **Page presses.** A page module decides what of its own is under a point in one hit test, which returns a `Hit` (owner, layer, cursor, tip; `crates/ui-egui/src/canvas/page_router.rs`) and gives its cursor, its tip and its press. It acts on a press only when the router says the press is its own (`view.router.owner(page)`), never by testing the press point again or by asking another module whether it wants it. Escape cancels any press the pages hold (`cancel_on_escape`), and that press is ignored until the button is up. `page_modules_take_presses_from_the_router_without_repeating_hit_tests` guards the centralized hit calls and captured-owner handlers; runtime routing tests cover gesture behavior.
 - **Fidelity.** The PDF object graph is the model. Preserve unknown data. Saves are incremental unless a full rewrite is required. Never silently drop or repair data without recording it.
 - **Never panic.** Every PDF, script, MCP call, settings file and keystroke is untrusted input, and none of it may crash the app or lose the user's work. This outranks feature work. Return `Result` (the crate's error enum) and propagate with `?`, or fall back leniently and record it. In non-test code:
   - No `unwrap`/`expect`/`panic!`/`unreachable!`/`todo!` unless it is provably infallible, with a comment saying why.
diff --git a/crates/ui-egui/src/canvas/page_pointer/tests.rs b/crates/ui-egui/src/canvas/page_pointer/tests.rs
index b405832ab0..124e370207 100644
--- a/crates/ui-egui/src/canvas/page_pointer/tests.rs
+++ b/crates/ui-egui/src/canvas/page_pointer/tests.rs
@@ -361,3 +361,84 @@ fn page_modules_claim_the_cursor_and_never_set_it() {
     );
     assert!(problems.is_empty(), "{}", problems.join("\n"));
 }
+
+/// Hit producers are called only by the central routing table, not again by an input handler.
+const PAGE_HIT_CALLS: [&str; 8] = [
+    "prepare::hit(",
+    "forms_ui::hit(",
+    "comments::hit(",
+    "edit_text_ui::hit(",
+    "edit_text_ui::picture_hit(",
+    "edit_text_ui::picture_handle_hit(",
+    "object_ui::hit(",
+    "content_ui::hit(",
+];
+
+fn routed_press_handler(code: &str) -> bool {
+    let code = code.lines().filter(|line| !line.trim_start().starts_with("//")).collect::<Vec<_>>().join("\n");
+    code.contains("router.owner(")
+        && !PAGE_HIT_CALLS.iter().any(|call| code.contains(call))
+        && !uses(&code, "hit(")
+        && !uses(&code, "body_hit(")
+        && !uses(&code, "handle_hit(")
+}
+
+/// Source-level guard for the Page presses rule, alongside the raw-pointer and cursor guards.
+/// Runtime routing, capture lifetime and Escape behavior have separate behavioral tests.
+#[test]
+fn page_modules_take_presses_from_the_router_without_repeating_hit_tests() {
+    let mut problems = misuses(
+        &PAGE_HIT_CALLS,
+        &[("canvas.rs", "at", "the central PageHits table")],
+        "repeats a module hit test outside PageHits::at; use the captured router owner",
+        "no longer collects module hits",
+    );
+    problems.extend(misuses(
+        &["router.press("],
+        &[("canvas.rs", "page_tool_input", "the central press capture")],
+        "captures a page press outside the central routing path",
+        "no longer captures page presses",
+    ));
+    let src = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+    for (file, function) in [
+        ("tools/forms_ui.rs", "page_input"),
+        ("tools/prepare.rs", "page_input"),
+        ("tools/content_ui.rs", "page_input"),
+        ("tools/edit_text_ui.rs", "page_input"),
+        ("tools/edit_text_ui/image.rs", "image_input"),
+        ("tools/object_ui.rs", "input"),
+        ("tools/comments/input.rs", "select_input"),
+    ] {
+        let source = std::fs::read_to_string(src.join(file)).expect("page input module");
+        let body = source
+            .lines()
+            .skip_while(|line| declares(line) != Some(function))
+            .take_while(|line| *line != "}")
+            .collect::<Vec<_>>()
+            .join("\n");
+        // Forms reuse their hit test for hover text and to require release over the captured
+        // widget. Neither chooses the press owner. Pin both calls to the current pointer `p`,
+        // not the press origin, and reject an additional call or a changed argument.
+        let body = if file == "tools/forms_ui.rs" {
+            let call = "hit(xf, info, page, form, allowed, p)";
+            assert_eq!(body.matches(call).count(), 2, "only the existing hover and release checks are exempt");
+            body.replace(call, "hover_or_release_check")
+        } else {
+            body
+        };
+        if !routed_press_handler(&body) {
+            problems.push(format!("src/{file}: {function} must consume the captured router owner without repeating a hit test"));
+        }
+    }
+    assert!(problems.is_empty(), "{}", problems.join("\n"));
+}
+
+#[test]
+fn the_page_press_guard_rejects_missing_owners_and_second_hit_tests() {
+    assert!(routed_press_handler("let owner = view.router.owner(page);"));
+    assert!(!routed_press_handler("// view.router.owner(page)\nlet owner = None;"));
+    assert!(!routed_press_handler("let owner = view.router.owner(page);\nlet again = cx.hit(origin);"));
+    for call in PAGE_HIT_CALLS {
+        assert!(!routed_press_handler(&format!("let owner = view.router.owner(page);\n{call}origin);")), "{call}");
+    }
+}
diff --git a/docs/integration-20261030.md b/docs/integration-20261030.md
index f1d14c5c69..92b5e07127 100644
--- a/docs/integration-20261030.md
+++ b/docs/integration-20261030.md
@@ -2,7 +2,7 @@
 
 Base: 1d1cbc4ec92012767f5b48c92b451e15eb401c42
 
-Validation: pending combined GitHub CI. No fresh manual GUI pass has been performed.
+Validation: combined GitHub CI passed on bdf56209ce6a22980ef488eec92a55073f5a4e18 (Linux and Windows, run 41038860617). No fresh manual GUI pass has been performed. The subsequent architectural-guard additions require a fresh run.
 All included source heads are preserved as merge parents, retaining original authorship. No upstream PR was merged. Conflicts were resolved after the user requested inclusion despite merge conflicts.
 
 ## Included
@@ -41,3 +41,43 @@ Excluded held PRs #4648, #2877 and #3762 were not included.
 Source reviews and individual hosted CI do not establish combined-build safety; the integration gate must pass.
 
 Integration-specific changes: preserve hard/soft wrap metadata together with per-row alignment; share CCITT/JBIG2 export paths with the 32 MiB globals cap retained; keep downsampling and RGB ownership guards with JBIG2 encoding; retain all translation keys and both sets of regression tests.
+
+## Per-PR regression evidence
+
+Evidence: [Linux job 124006360624](https://github.com/FredApps/pdfcraft/actions/runs/41038860617/job/124006360624) on bdf56209ce6a22980ef488eec92a55073f5a4e18: 5,627 passed, 15 skipped. The Windows leg of the same run also passed.
+
+For each source-head diff above, the added `#[test]` function names were matched against PASS/SKIP entries in the combined Linux log. Every listed source regression was found passing, none skipped or missing. Counts overlap because stacked PRs carry their prerequisites; they must not be summed as distinct tests. This records source regression coverage, not manual feature acceptance.
+
+- #4304: 11/11 added source regression names passed; 0 missing, 0 skipped.
+- #4320: 21/21 added source regression names passed; 0 missing, 0 skipped.
+- #4325: 18/18 added source regression names passed; 0 missing, 0 skipped.
+- #4335: 19/19 added source regression names passed; 0 missing, 0 skipped.
+- #4384: 39/39 added source regression names passed; 0 missing, 0 skipped.
+- #4404: 50/50 added source regression names passed; 0 missing, 0 skipped.
+- #4805: 36/36 added source regression names passed; 0 missing, 0 skipped.
+- #5300: 18/18 added source regression names passed; 0 missing, 0 skipped.
+- #4719: 6/6 added source regression names passed; 0 missing, 0 skipped.
+- #4541: 5/5 added source regression names passed; 0 missing, 0 skipped.
+- #2815: 35/35 added source regression names passed; 0 missing, 0 skipped.
+- #4620: 1/1 added source regression names passed; 0 missing, 0 skipped.
+- #2529: 35/35 added source regression names passed; 0 missing, 0 skipped.
+- #3789: 5/5 added source regression names passed; 0 missing, 0 skipped.
+- #3779: 4/4 added source regression names passed; 0 missing, 0 skipped.
+- #2960: 1/1 added source regression names passed; 0 missing, 0 skipped.
+- #5208: 2/2 added source regression names passed; 0 missing, 0 skipped.
+- #4596: 1/1 added source regression names passed; 0 missing, 0 skipped.
+- #3636: 3/3 added source regression names passed; 0 missing, 0 skipped.
+- #4494: 4/4 added source regression names passed; 0 missing, 0 skipped.
+- #4013: 4/4 added source regression names passed; 0 missing, 0 skipped.
+- #4180: 54/54 added source regression names passed; 0 missing, 0 skipped.
+- #4179: 20/20 added source regression names passed; 0 missing, 0 skipped.
+- #5134: the source diff adds no test function. Combined gates passed; no new manual scrollbar acceptance is claimed.
+- #2133: 1/1 added source regression names passed; 0 missing, 0 skipped.
+- #2635: 6/6 added source regression names passed; 0 missing, 0 skipped.
+- #1952: 6/6 added source regression names passed; 0 missing, 0 skipped.
+
+The conflict-specific tests `wrapped_rows_keep_alignment_separate_from_hard_break_markers` and `black_and_white_images_become_jbig2` (including the CCITT-to-JBIG2 conversion/render assertions) passed in that same run. Source tests for alignment/history, paragraph boundaries, field calculations and button export values remain present and passed.
+
+## Protect dependency check
+
+The integration base main commit 1d1cbc4ec92012767f5b48c92b451e15eb401c42 already locks registry `getrandom` 0.4.3 (checksum 300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099). #4013 makes it a direct engine dependency rather than introducing an unrecorded package. The combined dependency-policy and asset gates passed. The fail-closed randomness regression also passed.

From ee71348bc8623d52046b3a202de12a92b15336cc Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 12:47:37 +0100
Subject: [PATCH 245/270] fix: bound soft-wrap metadata and preserve unknown
 backdrop content

---
 crates/edit/src/backdrop.rs                   |  2 +-
 crates/edit/src/backdrop_tests.rs             | 13 ++++++++++
 crates/edit/src/tests.rs                      | 25 +++++++++++++++++++
 crates/edit/src/text/interp.rs                |  7 ++++++
 crates/filters/README.md                      |  6 ++---
 crates/optimize/README.md                     |  8 +++---
 crates/ui-egui/src/canvas.rs                  |  5 ++++
 .../ui-egui/src/canvas/page_pointer/tests.rs  |  7 +-----
 crates/ui-egui/tests/it/view.rs               | 19 ++++++++++++++
 docs/pdf-spec-parity.md                       | 16 +++---------
 docs/target-app-parity.md                     | 16 +++---------
 11 files changed, 83 insertions(+), 41 deletions(-)

diff --git a/crates/edit/src/backdrop.rs b/crates/edit/src/backdrop.rs
index 156501d95e..a7973d887a 100644
--- a/crates/edit/src/backdrop.rs
+++ b/crates/edit/src/backdrop.rs
@@ -379,7 +379,7 @@ fn scan(doc: &Document, p: &pdfcraft_model::Page, swap: Option<(ObjRef, &[u8])>)
         }
         let bytes = match swap {
             Some((with, b)) if with == *r => b.to_vec(),
-            _ => s.decoded().unwrap_or_default(),
+            _ => s.decoded().ok()?,
         };
         starts.push(total);
         total = total.saturating_add(bytes.len()).saturating_add(1);
diff --git a/crates/edit/src/backdrop_tests.rs b/crates/edit/src/backdrop_tests.rs
index 6ca100adcb..98578da577 100644
--- a/crates/edit/src/backdrop_tests.rs
+++ b/crates/edit/src/backdrop_tests.rs
@@ -556,3 +556,16 @@ fn graphics_state_set_back_before_the_fill_still_finds_the_backdrop() {
         assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Fill), "{state}");
     }
 }
+
+#[test]
+fn an_undecodable_stream_before_a_white_fill_keeps_the_backdrop_unknown() {
+    let objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents [4 0 R 5 0 R] >>".into(),
+        stream("/Filter /FlateDecode", "not a deflate stream"),
+        stream("", &format!("1 g 0 0 300 200 re f {TEXT}")),
+    ];
+    let doc = build(&objs);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), None, "unknown earlier paint must not be treated as an empty stream");
+}
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 5187a2aecc..3650ffd0b3 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -8552,3 +8552,28 @@ fn wrapped_rows_keep_alignment_separate_from_hard_break_markers() {
     let content = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
     assert!(content.contains("/PCSoft") && content.contains("/PCHard"), "both break kinds survive: {content}");
 }
+
+#[test]
+fn hostile_soft_wrap_counts_fail_before_reflow_allocates() {
+    for marker in [
+        "/PCSoft << /N 9223372036854775807 >> BDC EMC",
+        "/PCSoft << /N 16777217 >> BDC EMC",
+        "/PCSoft << /N 8388608 >> BDC EMC /PCSoft << /N 8388609 >> BDC EMC",
+    ] {
+        let doc = text_page(&format!("BT /F1 12 Tf 20 700 Td (First) Tj {marker} 0 -14 Td (Second) Tj ET"));
+        let error = text::text_lines(&doc, 0).unwrap_err();
+        assert!(error.to_string().contains("too large"), "{marker}: {error}");
+    }
+}
+
+#[test]
+fn ordinary_soft_wrap_counts_keep_their_spaces() {
+    for gap in [0, 1, 2, 8] {
+        let doc = text_page(&format!("BT /F1 12 Tf 20 700 Td (First) Tj /PCSoft << /N {gap} >> BDC EMC 0 -14 Td (Second) Tj ET"));
+        let lines = text::text_lines(&doc, 0).unwrap();
+        assert_eq!(lines.len(), 2);
+        let blocks = text::text_blocks(&doc, 0).unwrap();
+        assert_eq!(blocks.len(), 1);
+        assert_eq!(blocks[0].reflow_text, format!("First{}Second", " ".repeat(gap)));
+    }
+}
diff --git a/crates/edit/src/text/interp.rs b/crates/edit/src/text/interp.rs
index 73ca1b1424..af9a51f0dc 100644
--- a/crates/edit/src/text/interp.rs
+++ b/crates/edit/src/text/interp.rs
@@ -807,6 +807,13 @@ pub(super) fn interpret(
                         .and_then(Object::as_int)
                         .and_then(|n| usize::try_from(n).ok())
                         .unwrap_or(1);
+                    // The marker is untrusted and later expands into spaces during reflow.
+                    // Charge it to the same page-wide budget as glyph text, so many individually
+                    // small markers cannot multiply the allocation past the limit either.
+                    carry.text_left = carry
+                        .text_left
+                        .checked_sub(soft_gap)
+                        .ok_or_else(|| EditError::Invalid("the page's text is too large to read".into()))?;
                 } else if op.name(0) == Some(b"PCHard") {
                     hard_break = true;
                     soft_break = false;
diff --git a/crates/filters/README.md b/crates/filters/README.md
index e52a6cb335..0c34857c43 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -5,7 +5,6 @@ PDF stream filters: the decoders and encoders behind `/Filter` and `/DecodeParms
 - **Layer:** L0, standalone. No dependency on any other PdfCraft crate. `cos` depends on it (architecture §3 rule 3).
 - **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder; CCITT decoding (T.4 and T.6) is the `hayro-ccitt` crate's (MIT OR Apache-2.0, already in the tree through hayro), bounded here. JBIG2 generic region encoding is written from the public ISO/IEC 14492 Final Committee Draft (WG1 N1359, 1999); Annex H.2 checks the arithmetic coder byte for byte.
 
-Lossless symbol coding is also implemented: exact-copy dictionaries/text regions, bounded by the encoder; no approximate or lossy symbol substitution.
 - `#![forbid(unsafe_code)]`. Builds for `wasm32-unknown-unknown`.
 
 ## API
@@ -29,7 +28,6 @@ pub struct CcittParams { k, columns, rows, end_of_line, encoded_byte_align, end_
 decode_ccitt(data, &params, max_rows) -> Result<Vec<u8>, FilterError>   // CCITT fax as CCITTFaxDecode gives it; columns <= MAX_CCITT_COLUMNS
 encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as lossless JBIG2 for JBIG2Decode; columns <= MAX_JBIG2_COLUMNS
 encode_jbig2(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as lossless JBIG2 for JBIG2Decode, symbol coded when that is smaller; columns <= MAX_JBIG2_COLUMNS
-encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // the same as one generic region
 ```
 
 - `chain` is applied first to last, as in a `/Filter` array.
@@ -49,7 +47,6 @@ encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // t
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
 | CCITTFaxDecode | not in a chain (`Unsupported`); `decode_ccitt` decodes Group 3 and Group 4 on its own, as rows of 1-bit samples each on a new byte, black 0 unless `black_is_1`, at most `max_rows` rows (fewer with `/Rows`), the rows before any damage, up to 1,048,576 samples a row; Group 3 rows on bytes are read by their end-of-line codes when the data starts with one and on bytes otherwise, whatever `end_of_line` says, so data with codes but none before the first row (not as T.4 sends them) is read on bytes, as the renderer draws it, and at `k` 0 may come out as other rows (`pdfcraft_cos::Document::decoded_image` calls it for a fax image, after the filters before it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
-| JBIG2Decode | not here (`Unsupported`; the renderer and image export decode it with `hayro-jbig2`) | `encode_jbig2_generic`: the embedded organisation (D.3) with a page information segment and an immediate lossless generic region (7.4.6), no `/JBIG2Globals`; template 0 with its nominal AT pixels and typical prediction (6.2.5), coded with the MQ arithmetic coder (Annex E, Table E.1) and ended by its 0xFF 0xAC marker. A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, so the stream decodes to the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 1,048,576 samples a row; no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
 | JBIG2Decode | not here (`Unsupported`; the renderer and image export decode it with `hayro-jbig2`) | `encode_jbig2_generic`: the embedded organisation (D.3) with a page information segment and an immediate lossless generic region (7.4.6), no `/JBIG2Globals`; template 0 with its nominal AT pixels and typical prediction (6.2.5), coded with the MQ arithmetic coder (Annex E, Table E.1) and ended by its 0xFF 0xAC marker. A 0 sample is coded as a JBIG2 1 (black), since `JBIG2Decode` gives black as 0, so the stream decodes to the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 1,048,576 samples a row; no rows or columns, or too wide → Unsupported, too few bytes → Corrupt. `encode_jbig2`: the smaller of that and symbol coding (`jbig2/symbols.rs`): each distinct mark (8-connected black pixels, at most 256 a side) stored once in a symbol dictionary (7.4.2; arithmetic coded, each bitmap a template 0 generic region without typical prediction, the bitmaps sharing their contexts) and placed by immediate lossless text regions referring to it (7.4.3; bottom-left reference corner, strips of 1, 2, 4 or 8 rows, whichever is smallest), each of at most 10,000 instances over a band of rows, as the decoder PdfCraft renders with (`hayro-jbig2`) takes no more in one region, with larger marks, and in a second plan marks that occur once, in a generic region over their box. Only exact copies share a symbol (no refinement), so the stream decodes to the same bits; fewer than two symbols, more than 2^20 black runs, 65,536 distinct marks or 16 MiB of their pixels, or more than 2^24 rows, and the generic coding is used; a plan of more than 32,767 symbols (that decoder refuses more) isn't made |
 
 ## Tests
@@ -65,6 +62,7 @@ encode_jbig2_generic(data, columns, rows) -> Result<Vec<u8>, FilterError>   // t
 
 ## Status
 
-M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image codecs (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2, DCT encode), CCITT Group 3 encoding and Flate encode levels other than 6.
+M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image decoders (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2), DCT encoding, CCITT Group 3 encoding and Flate encode levels other than 6.
+
 
 Lossless symbol coding is also implemented: exact-copy dictionaries/text regions, bounded by the encoder; no approximate or lossy symbol substitution.
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 388345be71..9f96b17218 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -80,13 +80,13 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
     space, decode array and `/Mask` stay, but for packed RGB, which becomes grey with one decode
     pair. Group 4 wins on scans, whose ragged edges defeat Flate; on clean computer-drawn 1-bit
-    art Flate can be smaller. Not yet: JBIG2, inline images, an image's own `/SMask` or `/Mask`
+    art Flate can be smaller. Not yet: inline images, an image's own `/SMask` or `/Mask`
     image (only images drawn on a page are visited), and Group 4 for rows wider than 32,767
     samples.
 
-Lossless JBIG2 is also available as Monochrome Images compression, with a bounded generic-region encoder and no symbol substitution. Export reads its embedded images and bounded shared globals.
-
-The JBIG2 choice now uses a bounded exact-copy symbol dictionary when smaller than the generic-region result; lossy symbol substitution is not used.
+  - Lossless JBIG2 uses bounded generic-region encoding or exact-copy symbol dictionaries when
+    smaller. No lossy symbol substitution is used. Export reads embedded images and bounded
+    shared globals.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 3bbc91ef20..8b280ba75d 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -2019,6 +2019,11 @@ fn draw_pages(
     // its owner; in the gap between pages it has none).
     if ptr.pressed().is_some() {
         view.router.cancel();
+        // The page widget is not focusable. Explicitly return keyboard ownership from Pages
+        // when the user presses the document, without stealing focus through a modal.
+        if let Some(id) = view.pages_focus_id {
+            ui.memory_mut(|m| m.surrender_focus(id));
+        }
     }
     let pointer = ptr.pos;
     // A press on a page makes it the current one (as in Acrobat), so a page command with
diff --git a/crates/ui-egui/src/canvas/page_pointer/tests.rs b/crates/ui-egui/src/canvas/page_pointer/tests.rs
index 124e370207..2cbde2b995 100644
--- a/crates/ui-egui/src/canvas/page_pointer/tests.rs
+++ b/crates/ui-egui/src/canvas/page_pointer/tests.rs
@@ -410,12 +410,7 @@ fn page_modules_take_presses_from_the_router_without_repeating_hit_tests() {
         ("tools/comments/input.rs", "select_input"),
     ] {
         let source = std::fs::read_to_string(src.join(file)).expect("page input module");
-        let body = source
-            .lines()
-            .skip_while(|line| declares(line) != Some(function))
-            .take_while(|line| *line != "}")
-            .collect::<Vec<_>>()
-            .join("\n");
+        let body = source.lines().skip_while(|line| declares(line) != Some(function)).take_while(|line| *line != "}").collect::<Vec<_>>().join("\n");
         // Forms reuse their hit test for hover text and to require release over the captured
         // widget. Neither chooses the press owner. Pin both calls to the current pointer `p`,
         // not the press origin, and reject an additional call or a changed argument.
diff --git a/crates/ui-egui/tests/it/view.rs b/crates/ui-egui/tests/it/view.rs
index b9a01f408f..aef5ddae73 100644
--- a/crates/ui-egui/tests/it/view.rs
+++ b/crates/ui-egui/tests/it/view.rs
@@ -2310,3 +2310,22 @@ fn the_pages_panel_tools_are_off_without_page_editing_permission() {
     assert!(h.query_by_label("Delete the selected pages").is_none(), "its menu doesn't open");
     assert_eq!(h.state().session.get(id).unwrap().info.pages.len(), 3);
 }
+
+#[test]
+fn a_document_press_releases_pages_keyboard_focus_without_escape() {
+    let mut h = harness(&[("panel", "pages")]);
+    h.get_by_label("Page 2").click();
+    h.run_steps(3);
+    let focused = h.ctx.memory(|m| m.focused());
+    assert!(focused.is_some(), "the thumbnail owns keyboard input");
+    let pos = rect(&h, 1).unwrap().center();
+    h.event(egui::Event::PointerMoved(pos));
+    for pressed in [true, false] {
+        h.event(egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.run_steps(1);
+    }
+    h.run_steps(2);
+    assert_ne!(h.ctx.memory(|m| m.focused()), focused, "pressing the document relinquishes Pages focus without Escape");
+    sidebar_key(&mut h, Key::A, Modifiers::COMMAND);
+    assert!(h.state().views[0].selected.is_empty(), "Ctrl+A now belongs to the viewer, not page thumbnails");
+}
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index e34a931271..b62ecbc171 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,11 +1,9 @@
 # PDF specification and standards parity
 
+> Integration update 2026-10-30: lossless JBIG2 generic and exact-copy symbol coding are included; no lossy substitution. Combined tests passed at bdf5620; the subsequent review fixes require fresh CI.
+
 > **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: redaction decodes CCITT fax images, Group 3 on bytes aside; earlier, §7.4: CCITT decoding in `pdfcraft-filters`) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
-Lossless JBIG2 encoding and image export are included alongside CCITT decoding and monochrome downsampling; combined validation is pending.
-
-JBIG2 exact-copy symbol dictionaries and text regions are included; lossy substitution is not supported.
-
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
 the parts of the format users never see named but always feel. Feature-level detail is in
@@ -25,11 +23,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 |---|---|---|---|---|
 | §7.2–7.5 | Syntax, objects, file structure, xref tables and streams, object streams, hybrid files, incremental updates | full | **own**, tolerant, repairs damaged files | `crates/cos`; corpus 958 files; fuzzed nightly |
 | §7.4 | Stream filters: Flate, LZW, ASCII85, ASCIIHex, RunLength, predictors | full | **own** | `crates/filters` |
-| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; CCITT decoding in `pdfcraft-filters` (`decode_ccitt`, through `hayro-ccitt`) for export, redaction and the Optimizer, which encodes Group 4 (`optimize.mono-compression`); no JBIG2 encoding |
-
-Lossless JBIG2 encoding and image export are included alongside CCITT decoding and monochrome downsampling; combined validation is pending.
-
-JBIG2 exact-copy symbol dictionaries and text regions are included; lossy substitution is not supported.
+| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 and lossless JBIG2 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; CCITT decoding in `pdfcraft-filters` (`decode_ccitt`, through `hayro-ccitt`) for export, redaction and the Optimizer, which encodes Group 4 (`optimize.mono-compression`); lossless JBIG2 generic-region or exact-copy symbol encoding and image export; no lossy substitution |
 | §7.5.8 | Linearization | R W | R only | `core.linearization` planned |
 | §7.6.4 | Standard security handler R2–R6 (RC4 40/128, AES-128, AES-256), crypt filters, `/EncryptMetadata`, SASLprep | full | **own**, read and write | `crates/crypt`; written files open in Acrobat DC since #836 (#774: Acrobat needs the catalog outside object streams) |
 | §7.6.5 | Public-key security handler | full | none | `core.open-public-key`, `protect.certificate-encryption` planned |
@@ -140,10 +134,6 @@ JBIG2 exact-copy symbol dictionaries and text regions are included; lossy substi
 |---|---|---|
 | 2026-10-26 | minor | §7.4: redaction clears pixels in CCITT fax images through the CCITT decoder, instead of removing them whole (Group 4 and Group 3 off bytes; Group 3 on bytes is still removed whole, as the bootstrap renderer may draw it as other rows than the decoder reads) |
 | 2026-10-26 | minor | §7.4: CCITT decoding (`hayro-ccitt`) in `pdfcraft-filters`, for export and the Optimizer |
-
-Lossless JBIG2 encoding and image export are included alongside CCITT decoding and monochrome downsampling; combined validation is pending.
-
-JBIG2 exact-copy symbol dictionaries and text regions are included; lossy substitution is not supported.
 | 2026-10-26 | minor | §7.4: CCITT Group 4 encoding (`fax`) in the Optimizer |
 | 2026-10-14 | minor | §12.4.4: `/Trans` and `/Dur` read into `DocInfo::transitions` and reported by `doc_info` |
 | 2026-10-11 | minor | §7.6.4: encrypted files we write open in Acrobat (#774, fixed by #836) |
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index cd018f0482..46767848cc 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,10 +1,8 @@
 # PdfCraft parity with Adobe Acrobat Pro
 
+> Integration update 2026-10-30: lossless JBIG2 generic and exact-copy symbol coding are included; no lossy substitution. Combined tests passed at bdf5620; the subsequent review fixes require fresh CI.
+
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-26 · **Change:** minor (K Optimize and standards no longer lists monochrome downsampling as missing; scores and estimates unchanged)
-
-Lossless JBIG2 encoding and image export are included alongside CCITT decoding and monochrome downsampling; combined validation is pending.
-
-JBIG2 exact-copy symbol dictionaries and text regions are included; lossy substitution is not supported.
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-26 · **Change:** minor (`optimize.mono-compression` partial (CCITT Group 4): K Optimize and standards 15 shipped and 11 partial of 58, 35.3%; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497); estimates unchanged)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-25 · **Change:** minor (localization current state: Arabic logical catalog, explicit RTL direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite. Scores and estimates unchanged)
 
@@ -214,11 +212,7 @@ full parity in that area.
 | H Digital signatures | 45 | 23 | 10 | 62.2% | 45% | 40–70 | PAdES B-B signing and validation (PKCS #12, macOS Keychain, Windows store with PIN prompts), certification, encrypted documents, certificate usage checks; B-T, LTV, OCSP/CRL with caller-supplied evidence. Missing: PKCS #11 and smart cards outside Windows, timestamp-server preferences, online revocation fetching, FieldMDP and field locking, OS trust store, EU Trusted Lists, compare signed version |
 | I Scan and OCR | 26 | 5 | 2 | 23.1% | 15% | 40–75 | Searchable image (ocrs, Latin script without accents) on pages, ranges and many files. Missing: every other language (#744 Dutch; accents, CJK, Cyrillic, Arabic), editable-text output, deskew, rotation, despeckle, camera images beyond straightening (found or placed corners): orientation, clean-up, MRC compression, scanners |
 | J Create and export | 34 | 12 | 3 | 39.7% | 25% | 55–100 | Create from images, multipage TIFF, text, clipboard, blank, many files at once; export PNG/JPEG/TIFF, text, RTF; Word and HTML partial. Missing: Office/HTML/web/PostScript to PDF, Excel and PowerPoint export, Word layout fidelity (#773), SVG/XML/EPS/PS/JPEG 2000 export, accessible text |
-| K Optimize and standards | 58 | 15 | 11 | 35.3% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2 |
-
-Lossless JBIG2 encoding and image export are included alongside CCITT decoding and monochrome downsampling; combined validation is pending.
-
-JBIG2 exact-copy symbol dictionaries and text regions are included; lossy substitution is not supported.
+| K Optimize and standards | 58 | 15 | 11 | 35.3% | 20% | 65–115 | Reduce File Size and the Optimizer (images, CCITT and lossless JBIG2 monochrome compression, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, lossy/refinement JBIG2 |
 | L Print | 39 | 15 | 1 | 39.7% | 35% | 30–55 | Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, print-ready PDF, CUPS on macOS/Linux, the Windows spooler (#756) and the browser's print dialog on the web. Missing: print as image, PostScript, all print-production tools (output preview, separations, ink manager, printer marks, colour conversion) |
 | M Accessibility | 61 | 38 | 1 | 63.1% | 30% | 40–70 | Accessibility Checker (all 32 rules, report, fixes), alternate text, title and language. Missing: autotag, Tags/Order/Content panels, Reading Order tool, artifact marking, table editor, Read Out Loud, full keyboard operation of the app, screen-reader audit |
 | N Automation, preferences, misc | 75 | 20 | 5 | 30.0% | 35% | 25–45 | CLI, MCP, UI control channel, 141 automation tools, Action Wizard (run, create), compare (text, visual, report, side by side, Text/Visual filter). Missing: most Preferences pages, Acrobat's finer compare filters, Action Wizard management, custom commands, AI providers, rich media/3D, hosted web app |
@@ -305,10 +299,6 @@ licensed OCR or AI model.
 | Date | Change | Summary |
 |---|---|---|
 | 2026-10-26 | minor | K Optimize and standards no longer lists monochrome downsampling as missing (black-and-white images above 450 ppi are averaged down to 300). Scores and estimates unchanged. |
-
-Lossless JBIG2 encoding and image export are included alongside CCITT decoding and monochrome downsampling; combined validation is pending.
-
-JBIG2 exact-copy symbol dictionaries and text regions are included; lossy substitution is not supported.
 | 2026-10-26 | minor | `optimize.mono-compression` became partial (CCITT Group 4), counted on the table's own measurement: K Optimize and standards 15 shipped and 11 partial of 58 (35.3%), no longer listing CCITT as missing; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497). Estimates unchanged. |
 | 2026-10-25 | minor | Localization current state: Arabic catalogs stay logical, Arabic/Kurdish labels take an explicit RTL direction, and stock chrome mirrors; native/browser RTL input, IME and complex workflows remain unqualified. Native Simplified Chinese uses LXGW WenKai Lite; the web build has no Hans face. Scores and estimates unchanged. |
 | 2026-10-20 | minor | M12 #3673: the Character encoding rule accepts Identity-H/V fonts with Adobe CJK collections, or a predefined non-Identity CMap, while rejecting unknown names and foreign registries. Synthetic checker and read-only automation regressions passed after failing before the fix; per-glyph mapping validation and embedded-font extraction remain separate. Breadth, readiness and hours unchanged. |

From 25f3d12960f85c2222a69919935a975d93a1fd94 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 12:54:56 +0100
Subject: [PATCH 246/270] style: format checked soft-wrap budget assignment

---
 crates/edit/src/text/interp.rs | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/crates/edit/src/text/interp.rs b/crates/edit/src/text/interp.rs
index af9a51f0dc..2b55e51ef8 100644
--- a/crates/edit/src/text/interp.rs
+++ b/crates/edit/src/text/interp.rs
@@ -810,10 +810,8 @@ pub(super) fn interpret(
                     // The marker is untrusted and later expands into spaces during reflow.
                     // Charge it to the same page-wide budget as glyph text, so many individually
                     // small markers cannot multiply the allocation past the limit either.
-                    carry.text_left = carry
-                        .text_left
-                        .checked_sub(soft_gap)
-                        .ok_or_else(|| EditError::Invalid("the page's text is too large to read".into()))?;
+                    carry.text_left =
+                        carry.text_left.checked_sub(soft_gap).ok_or_else(|| EditError::Invalid("the page's text is too large to read".into()))?;
                 } else if op.name(0) == Some(b"PCHard") {
                     hard_break = true;
                     soft_break = false;

From 673178b70c5a78a95b19029ad0cfab2da9a6ce2c Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 13:21:04 +0100
Subject: [PATCH 247/270] fix(edit): require intact streams when identifying
 page backdrops

---
 crates/edit/src/backdrop.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/crates/edit/src/backdrop.rs b/crates/edit/src/backdrop.rs
index a7973d887a..cc0092174a 100644
--- a/crates/edit/src/backdrop.rs
+++ b/crates/edit/src/backdrop.rs
@@ -379,7 +379,9 @@ fn scan(doc: &Document, p: &pdfcraft_model::Page, swap: Option<(ObjRef, &[u8])>)
         }
         let bytes = match swap {
             Some((with, b)) if with == *r => b.to_vec(),
-            _ => s.decoded().ok()?,
+            // Tolerant decoding can return an empty or partial stream after corruption.
+            // That cannot prove which paint preceded the candidate backdrop.
+            _ => s.decoded_strict().ok()?,
         };
         starts.push(total);
         total = total.saturating_add(bytes.len()).saturating_add(1);

From d7f3e67141ef9335147761fd5238c9c0540e589f Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 14:45:50 +0100
Subject: [PATCH 248/270] fix: bound backdrop edits and withhold unsafe
 integration behavior

---
 crates/edit/src/backdrop.rs                 |  37 +++--
 crates/edit/src/backdrop_tests.rs           |  40 ++++-
 crates/edit/src/tests.rs                    | 123 ++++++++--------
 crates/edit/src/text/rewrite.rs             |  10 ++
 crates/engine/src/tests.rs                  |  51 +++++++
 crates/optimize/src/images.rs               |  78 ++++++----
 crates/optimize/tests/optimize.rs           |  84 +++++++++++
 crates/ui-egui/src/panels/format_text_ui.rs |   9 +-
 crates/ui-egui/tests/it/editing.rs          | 153 ++++----------------
 docs/integration-20261030.md                |  12 +-
 parity/acrobat-features.toml                |   4 +-
 11 files changed, 371 insertions(+), 230 deletions(-)

diff --git a/crates/edit/src/backdrop.rs b/crates/edit/src/backdrop.rs
index cc0092174a..43e16b40ec 100644
--- a/crates/edit/src/backdrop.rs
+++ b/crates/edit/src/backdrop.rs
@@ -26,7 +26,7 @@
 //! Anything else is real content and stays.
 
 use pdfcraft_content::{Matrix, Op, Pieces};
-use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
+use pdfcraft_cos::{DecodeBudget, Dict, Document, ObjRef, Object, PdfString, Stream};
 use sha2::{Digest, Sha256};
 
 use crate::{EditError, MarkKind};
@@ -174,8 +174,8 @@ pub(crate) fn replace(doc: &mut Document, page: &pdfcraft_model::Page) -> Result
     }
     dict.set(TAG.to_vec(), Object::Dict(note));
     let copy = doc.add(Object::Stream(Stream::flate(dict, bytes)));
-    // Every slot that draws the original: a page may list the same stream twice, and a second
-    // copy of the fill would cover the background again.
+    // scan accepts only one execution of this stream on the page. Other pages keep the
+    // original stream; ambiguous repeated executions are never rewritten.
     let mut list = crate::place::contents(doc, page)?;
     let mut replaced = false;
     for entry in list.iter_mut().filter(|o| matches!(o, Object::Ref(r) if *r == original)) {
@@ -208,7 +208,7 @@ pub(crate) fn restore(doc: &mut Document, page: &pdfcraft_model::Page) -> Result
                     let same = |w: &ObjRef| match &*doc.get(*w) {
                         Object::Stream(s) => {
                             [TAG, &b"PCMark"[..], b"Subtype"].iter().all(|k| s.dict.get(k).is_none())
-                                && s.decoded().ok().as_deref() == Some(bytes.as_slice())
+                                && DecodeBudget::new(SCAN_BYTES, 0).decode_strict(s).ok().as_deref() == Some(bytes.as_slice())
                         }
                         _ => false,
                     };
@@ -248,7 +248,7 @@ fn restored_copy(doc: &Document, page: &pdfcraft_model::Page, copy: ObjRef) -> O
         return None;
     }
     let hash = note.get(b"Before")?.as_string()?;
-    let bytes = s.decoded().ok()?;
+    let bytes = DecodeBudget::new(SCAN_BYTES, 0).decode_strict(s).ok()?;
     let parsed = pdfcraft_content::parse(head(&bytes));
     // The `n` standing in for the fill, after exactly the operators that came before it.
     let fill = parsed.ops.get(index)?;
@@ -354,7 +354,8 @@ fn scan(doc: &Document, p: &pdfcraft_model::Page, swap: Option<(ObjRef, &[u8])>)
     let crop = p.crop(doc);
     let c = p.dict.get(b"Contents")?;
     let list: Vec<Object> = match &*doc.resolve(c) {
-        Object::Array(a) => a.clone(),
+        Object::Array(a) if a.len() <= SCAN_OPS => a.clone(),
+        Object::Array(_) => return None,
         _ => vec![c.clone()],
     };
     // The page's own content: untagged streams (marks and the q/Q wrapper carry /PCMark). Read
@@ -363,6 +364,7 @@ fn scan(doc: &Document, p: &pdfcraft_model::Page, swap: Option<(ObjRef, &[u8])>)
     let mut data = Vec::new();
     let mut starts = Vec::new();
     let mut total = 0usize;
+    let mut budget = DecodeBudget::new(SCAN_BYTES, 0);
     for (slot, o) in list.iter().enumerate() {
         if total >= SCAN_BYTES {
             break;
@@ -378,13 +380,21 @@ fn scan(doc: &Document, p: &pdfcraft_model::Page, swap: Option<(ObjRef, &[u8])>)
             return None;
         }
         let bytes = match swap {
-            Some((with, b)) if with == *r => b.to_vec(),
+            Some((with, b)) if with == *r => {
+                if b.len() > SCAN_BYTES.saturating_sub(total) {
+                    return None;
+                }
+                budget.decode_strict(&Stream::from_raw(Dict::new(), b.to_vec())).ok()?
+            }
             // Tolerant decoding can return an empty or partial stream after corruption.
             // That cannot prove which paint preceded the candidate backdrop.
-            _ => s.decoded_strict().ok()?,
+            _ => budget.decode_strict(s).ok()?,
         };
+        if bytes.len() > SCAN_BYTES.saturating_sub(total).saturating_sub(1) {
+            return None;
+        }
         starts.push(total);
-        total = total.saturating_add(bytes.len()).saturating_add(1);
+        total += bytes.len() + 1;
         refs.push((slot, *r));
         data.push(bytes);
     }
@@ -392,6 +402,15 @@ fn scan(doc: &Document, p: &pdfcraft_model::Page, swap: Option<(ObjRef, &[u8])>)
     let parsed = pdfcraft_content::parse(head(pieces.data()));
     let res = resources(doc, &p.dict);
     let found = walk(doc, &res, crop, &parsed.ops);
+    // A match proves the graphics state for one execution only. Repeated references may
+    // paint real artwork under a different color or transform: leave them untouched.
+    if let Some((Backdrop::Fill, Some(op))) = &found {
+        let piece = pieces.piece_of(op.start);
+        let (_, reference) = refs.get(piece)?;
+        if list.iter().filter(|o| matches!(o, Object::Ref(r) if r == reference)).count() != 1 {
+            return None;
+        }
+    }
     found.map(|(b, op)| match (b, op) {
         (Backdrop::Fill, Some(op)) => (b, Some(Found { refs, pieces, starts, op })),
         _ => (b, None),
diff --git a/crates/edit/src/backdrop_tests.rs b/crates/edit/src/backdrop_tests.rs
index 98578da577..30bc2ef8b1 100644
--- a/crates/edit/src/backdrop_tests.rs
+++ b/crates/edit/src/backdrop_tests.rs
@@ -497,7 +497,7 @@ fn the_backdrop_copy_keeps_the_original_dictionary_less_its_old_encoding() {
 }
 
 #[test]
-fn a_stream_listed_twice_is_replaced_in_both_slots_and_restored_in_both() {
+fn a_stream_listed_twice_is_left_untouched_as_ambiguous() {
     let mut doc = build(&[
         "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
         "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".into(),
@@ -508,7 +508,7 @@ fn a_stream_listed_twice_is_replaced_in_both_slots_and_restored_in_both() {
     add_background(&mut doc, &[0], &red(), false).unwrap();
     let s = streams(&doc);
     assert_eq!(s.len(), 3, "{s:?}");
-    assert!(s[1..].iter().all(|c| c.contains("re n") && !c.contains("re f")), "no slot still paints the white fill: {s:?}");
+    assert_eq!(s[1..], original[..], "repeated executions are not qualified independently");
     remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
     assert_eq!(streams(&doc), original);
 }
@@ -569,3 +569,39 @@ fn an_undecodable_stream_before_a_white_fill_keeps_the_backdrop_unknown() {
     let doc = build(&objs);
     assert_eq!(page_backdrop(&doc, 0).unwrap(), None, "unknown earlier paint must not be treated as an empty stream");
 }
+
+#[test]
+fn shared_fill_used_as_later_artwork_is_not_rewritten() {
+    let mut doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents [4 0 R 5 0 R 6 0 R 5 0 R 7 0 R] >>".into(),
+        stream("", "1 g"),
+        stream("", "0 0 300 200 re f"),
+        stream("", "q 0 g 0.25 0 0 0.25 20 20 cm"),
+        stream("", "Q"),
+    ]);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), None);
+    let original = streams(&doc);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    assert_eq!(streams(&doc)[1..], original[..], "the later black artwork keeps its fill");
+    let mut saved = reopen(&doc);
+    assert_eq!(streams(&saved)[1..], original[..]);
+    remove_marks(&mut saved, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&saved), original);
+    assert_eq!(streams(&reopen(&saved)), original);
+}
+
+#[test]
+fn compressed_backdrop_content_is_refused_before_expanding_past_the_scan_budget() {
+    let mut doc = page(&["1 g 0 0 300 200 re f"]);
+    let mut bytes = b"1 g 0 0 300 200 re f\n".to_vec();
+    bytes.resize(2 * 1024 * 1024, b' ');
+    let source = doc.add(Object::Stream(Stream::flate(Dict::new(), &bytes)));
+    let page = pdfcraft_model::pages(&doc)[0].obj;
+    doc.update_dict(page, |d| d.set(b"Contents".to_vec(), Object::Ref(source))).unwrap();
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), None);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    let Object::Stream(unchanged) = &*doc.get(source) else { panic!("stream") };
+    assert_eq!(unchanged.decoded_strict().unwrap(), bytes, "refusal preserves the source");
+}
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 3650ffd0b3..d45e983a2e 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -7758,62 +7758,49 @@ fn a_flatten_refused_on_a_later_page_changes_nothing() {
     assert_eq!((*doc.get(first)).clone(), before, "the first page keeps its comment and content");
 }
 
-/// One row of an edited paragraph aligned on its own (#A: highlighting a line and aligning it):
-/// the other rows stay where they were.
+/// Existing-row alignment is explicitly refused without mutating the paragraph.
 #[test]
-fn one_row_of_a_paragraph_takes_its_own_alignment() {
-    let mut doc = text_page("BT /F1 10 Tf 12 TL 100 700 Td (One two three four five six seven) Tj T* (eight nine ten eleven twelve) Tj ET");
-    let block = text::text_blocks(&doc, 0).unwrap()[0].clone();
-    assert_eq!(block.editor_text, "One two three four five six seven\neight nine ten eleven twelve");
-    let style = text::BlockStyle { aligns: vec![None, Some(added::Align::Right)], ..Default::default() };
-    text::rewrite_block(&mut doc, 0, 0, Some(&block.editor_text), &style).unwrap();
-    let lines = text::text_lines(&doc, 0).unwrap();
-    let row = |t: &str| lines.iter().find(|l| l.text.starts_with(t)).unwrap().rect;
-    assert!((row("One")[0] - block.rect[0]).abs() < 0.5, "the first row stays at the left: {:?}", row("One"));
-    assert!((row("eight")[2] - block.rect[2]).abs() < 1.0, "the second row ends at the right edge: {:?} vs {}", row("eight"), block.rect[2]);
+fn one_row_of_a_paragraph_takes_its_own_alignment_is_refused_without_changing_the_document() {
+    for align in [added::Align::Left, added::Align::Center, added::Align::Right, added::Align::Justify] {
+        let mut doc = text_page("BT /F1 10 Tf 12 TL 72 700 Td (First row) Tj T* (Second row) Tj ET");
+        let before = page_content_bytes(&doc, 0);
+        let blocks = text::text_blocks(&doc, 0).unwrap();
+        let style = text::BlockStyle { aligns: vec![None, Some(align)], ..Default::default() };
+        let error = text::rewrite_block(&mut doc, 0, 0, Some(&blocks[0].editor_text), &style).unwrap_err();
+        assert!(error.to_string().contains("selected-row alignment"));
+        assert_eq!(page_content_bytes(&doc, 0), before);
+        assert_eq!(page_content_bytes(&reopen(&doc), 0), before);
+    }
 }
 
-/// Only a row given an alignment of its own is rewritten. The others keep their source operators,
-/// `TJ` word gaps included, so their words stay exactly where they were: rebuilt from the text,
-/// the first row's words moved by about a point and a half while its outer width stayed the same.
+/// Refusal preserves all existing rows and their saved content stream.
 #[test]
-fn rows_without_their_own_alignment_keep_their_operators() {
-    let first = "[(One) -250 (two) -250 (three) -250 (four)] TJ";
-    let mut doc = text_page(&format!("BT /F1 10 Tf 12 TL 72 700 Td {first} T* [(five) -250 (six) -250 (seven) -250 (eight)] TJ T* (nine ten) Tj ET"));
-    let block = text::text_blocks(&doc, 0).unwrap()[0].clone();
-    assert_eq!(block.editor_text.matches('\n').count(), 2, "one paragraph of three rows: {:?}", block.editor_text);
-    let row = |doc: &Document, starts: &str| text::text_lines(doc, 0).unwrap().into_iter().find(|l| l.text.starts_with(starts)).expect("the row");
-    let ink = row(&doc, "One").ink;
-    let style = text::BlockStyle { aligns: vec![None, None, Some(added::Align::Right)], ..Default::default() };
-    text::rewrite_block(&mut doc, 0, 0, Some(&block.editor_text), &style).unwrap();
-    let doc = reopen(&doc);
-    assert_eq!(row(&doc, "One").ink, ink, "the first row's words stay where they were");
-    let content = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
-    assert!(content.contains(first), "the first row keeps its operator: {content}");
-    assert!((row(&doc, "nine").rect[2] - block.rect[2]).abs() < 1.0, "the last row is right-aligned: {:?}", row(&doc, "nine").rect);
+fn rows_without_their_own_alignment_keep_their_operators_is_refused_without_changing_the_document() {
+    for align in [added::Align::Left, added::Align::Center, added::Align::Right, added::Align::Justify] {
+        let mut doc = text_page("BT /F1 10 Tf 12 TL 72 700 Td (First row) Tj T* (Second row) Tj ET");
+        let before = page_content_bytes(&doc, 0);
+        let blocks = text::text_blocks(&doc, 0).unwrap();
+        let style = text::BlockStyle { aligns: vec![None, Some(align)], ..Default::default() };
+        let error = text::rewrite_block(&mut doc, 0, 0, Some(&blocks[0].editor_text), &style).unwrap_err();
+        assert!(error.to_string().contains("selected-row alignment"));
+        assert_eq!(page_content_bytes(&doc, 0), before);
+        assert_eq!(page_content_bytes(&reopen(&doc), 0), before);
+    }
 }
 
-/// The same in a region of several styles: only the short first row is centred.
+/// Mixed-style rows also refuse unsupported per-row intent before writing.
 #[test]
-fn one_row_of_a_styled_region_takes_its_own_alignment() {
-    let mut doc = mixed_region_page();
-    let block = text::text_blocks(&doc, 0).unwrap()[1].clone();
-    assert_eq!(
-        block.editor_text,
-        "About
-Plain bold text.
-Italic footer"
-    );
-    let row = |lines: &[text::TextLine], t: &str| lines.iter().find(|l| l.text.starts_with(t)).unwrap().rect;
-    let before = text::text_lines(&doc, 0).unwrap();
-    let style = text::BlockStyle { aligns: vec![Some(added::Align::Center)], ..Default::default() };
-    text::rewrite_block(&mut doc, 0, 1, Some(&block.editor_text), &style).unwrap();
-    let lines = text::text_lines(&doc, 0).unwrap();
-    assert!((row(&lines, "Italic")[0] - row(&before, "Italic")[0]).abs() < 0.5, "the last row stays put");
-    assert!((row(&lines, "Plain")[0] - row(&before, "Plain")[0]).abs() < 0.5, "the middle row stays put");
-    let about = row(&lines, "About");
-    let (mid, centre) = ((about[0] + about[2]) / 2.0, (block.rect[0] + block.rect[2]) / 2.0);
-    assert!(about[0] > row(&before, "About")[0] + 5.0 && (mid - centre).abs() < 1.5, "the first row is centred: {mid} vs {centre}");
+fn one_row_of_a_styled_region_takes_its_own_alignment_is_refused_without_changing_the_document() {
+    for align in [added::Align::Left, added::Align::Center, added::Align::Right, added::Align::Justify] {
+        let mut doc = mixed_region_page();
+        let before = page_content_bytes(&doc, 0);
+        let blocks = text::text_blocks(&doc, 0).unwrap();
+        let style = text::BlockStyle { aligns: vec![None, Some(align)], ..Default::default() };
+        let error = text::rewrite_block(&mut doc, 0, 1, Some(&blocks[1].editor_text), &style).unwrap_err();
+        assert!(error.to_string().contains("selected-row alignment"));
+        assert_eq!(page_content_bytes(&doc, 0), before);
+        assert_eq!(page_content_bytes(&reopen(&doc), 0), before);
+    }
 }
 
 /// Added text: each paragraph is laid out with its own alignment, a justified paragraph's last
@@ -7896,7 +7883,7 @@ fn a_lone_row_aligns_across_the_column_it_sits_in() {
         let blocks = text::text_blocks(doc, 0).unwrap();
         let (index, block) = blocks.iter().enumerate().find(|(_, b)| b.lines.contains(&line)).unwrap();
         // The title is the paragraph's first row.
-        let style = text::BlockStyle { aligns: vec![Some(a)], ..Default::default() };
+        let style = text::BlockStyle { align: Some(a), ..Default::default() };
         text::rewrite_block(doc, 0, index, Some(&block.editor_text), &style).unwrap();
     };
     align(&mut doc, added::Align::Center);
@@ -7939,7 +7926,7 @@ fn a_title_moves_to_its_column_only_for_an_alignment_of_its_own() {
     for draft in ["Title", "Title\nSub"] {
         let mut doc = text_page(page);
         let style = text::BlockStyle { aligns: vec![None, Some(added::Align::Right)], ..Default::default() };
-        text::rewrite_block(&mut doc, 0, 0, Some(draft), &style).unwrap();
+        assert!(text::rewrite_block(&mut doc, 0, 0, Some(draft), &style).is_err());
         assert!((title(&doc)[0] - before[0]).abs() < 0.5, "{draft:?}: the title stays put, {:?} vs {before:?}", title(&doc));
     }
 }
@@ -7958,7 +7945,7 @@ fn a_column_is_measured_by_its_whole_rows_not_its_first_runs() {
         body.rows.iter().filter_map(|row| row.iter().filter_map(|i| lines.get(*i)).map(|l| l.rect[2]).reduce(f64::max)).fold(f64::MIN, f64::max);
     let mut doc = text_page(page);
     let index = blocks.iter().position(|b| b.text == "A longer title").expect("the title is a block of its own");
-    let style = text::BlockStyle { aligns: vec![Some(added::Align::Right)], ..Default::default() };
+    let style = text::BlockStyle { align: Some(added::Align::Right), ..Default::default() };
     text::rewrite_block(&mut doc, 0, index, Some("A longer title"), &style).unwrap();
     let title = text::text_lines(&doc, 0).unwrap().into_iter().find(|l| l.text == "A longer title").unwrap().rect;
     assert!((title[2] - column_right).abs() < 1.0, "right: on the whole row's right edge, {title:?} vs {column_right}");
@@ -7972,7 +7959,7 @@ fn an_isolated_row_edited_with_an_alignment_does_not_wrap_at_its_old_width() {
     for align in [added::Align::Center, added::Align::Right] {
         let mut doc = text_page("BT /F1 18 Tf 1 0 0 1 100 700 Tm (Title) Tj ET");
         let longer = "A much longer title for the page";
-        let style = text::BlockStyle { aligns: vec![Some(align)], ..Default::default() };
+        let style = text::BlockStyle { align: Some(align), ..Default::default() };
         text::rewrite_block(&mut doc, 0, 0, Some(longer), &style).unwrap();
         let lines = text::text_lines(&doc, 0).unwrap();
         assert_eq!(lines.iter().map(|l| l.text.as_str()).collect::<Vec<_>>(), [longer], "{align:?}: the title stays on one row");
@@ -7996,7 +7983,7 @@ fn a_lone_row_aligns_in_its_own_column_not_a_closer_full_width_heading() {
         let mut doc = text_page(page);
         let blocks = text::text_blocks(&doc, 0).unwrap();
         let index = blocks.iter().position(|b| b.text == "Title").unwrap();
-        let style = text::BlockStyle { aligns: vec![Some(align)], ..Default::default() };
+        let style = text::BlockStyle { align: Some(align), ..Default::default() };
         text::rewrite_block(&mut doc, 0, index, Some("Title"), &style).unwrap();
         text::text_lines(&doc, 0).unwrap().into_iter().find(|l| l.text == "Title").unwrap().rect
     };
@@ -8018,7 +8005,7 @@ fn a_lone_row_aligns_across_its_own_column_of_two() {
     let blocks = text::text_blocks(&doc, 0).unwrap();
     let column = blocks.iter().find(|b| b.text.starts_with("The first")).unwrap().rect;
     let index = blocks.iter().position(|b| b.text == "Title").unwrap();
-    let style = text::BlockStyle { aligns: vec![Some(added::Align::Left)], ..Default::default() };
+    let style = text::BlockStyle { align: Some(added::Align::Left), ..Default::default() };
     text::rewrite_block(&mut doc, 0, index, Some("Title"), &style).unwrap();
     let title = text::text_lines(&doc, 0).unwrap().into_iter().find(|l| l.text == "Title").unwrap().rect;
     assert!((title[0] - column[0]).abs() < 0.5, "left: on the first column's edge, {title:?} vs {column:?}");
@@ -8043,7 +8030,7 @@ fn a_lone_row_of_two_styles_aligns_across_its_column() {
     let centre = |doc: &mut Document| {
         let blocks = text::text_blocks(doc, 0).unwrap();
         let (index, block) = blocks.iter().enumerate().find(|(_, b)| b.text == "Big Title").unwrap();
-        let style = text::BlockStyle { aligns: vec![Some(added::Align::Center)], ..Default::default() };
+        let style = text::BlockStyle { align: Some(added::Align::Center), ..Default::default() };
         text::rewrite_block(doc, 0, index, Some(&block.editor_text), &style).unwrap();
     };
     centre(&mut doc);
@@ -8078,7 +8065,7 @@ fn a_titles_column_ignores_distant_full_width_headers_and_footers() {
                 for align in [added::Align::Center, added::Align::Center, added::Align::Right, added::Align::Left] {
                     let blocks = text::text_blocks(&doc, 0).unwrap();
                     let (index, block) = blocks.iter().enumerate().find(|(_, b)| b.text == name).unwrap();
-                    let style = text::BlockStyle { aligns: vec![Some(align)], ..Default::default() };
+                    let style = text::BlockStyle { align: Some(align), ..Default::default() };
                     text::rewrite_block(&mut doc, 0, index, Some(&block.editor_text), &style).unwrap();
                     doc = reopen(&doc);
                     let title = rect(&doc, name);
@@ -8534,18 +8521,18 @@ fn q_inside_a_text_object_restores_the_text_matrices() {
     }
 }
 
-/// Integration of #4180 and #2529: soft wraps retain the source paragraph's alignment,
-/// while a typed newline advances to the next alignment and survives a save/reopen.
+/// Whole-paragraph alignment retains both soft wraps and typed hard breaks after save/reopen.
+/// Selected-row alignment for existing PDF content is withheld until it can persist safely.
 #[test]
-fn wrapped_rows_keep_alignment_separate_from_hard_break_markers() {
+fn wrapped_rows_keep_whole_paragraph_alignment_and_hard_break_markers() {
     let mut doc = text_page("BT /F1 10 Tf 12 TL 72 700 Td (Old) Tj ET");
-    let style = text::BlockStyle { width: Some(60.0), aligns: vec![Some(added::Align::Left), Some(added::Align::Right)], ..Default::default() };
+    let style = text::BlockStyle { width: Some(60.0), align: Some(added::Align::Left), ..Default::default() };
     text::rewrite_block(&mut doc, 0, 0, Some("One two three four five six\nTail"), &style).unwrap();
     let doc = reopen(&doc);
     let lines = text::text_lines(&doc, 0).unwrap();
     assert!(lines.len() > 2, "the first logical row must wrap");
     let tail = lines.iter().find(|line| line.text == "Tail").unwrap();
-    assert!((tail.rect[2] - 132.0).abs() < 1.0, "the second logical row stays right-aligned: {:?}", tail.rect);
+    assert!((tail.rect[0] - 72.0).abs() < 1.0, "the second logical row keeps the paragraph alignment: {:?}", tail.rect);
     for line in lines.iter().filter(|line| line.text != "Tail") {
         assert!((line.rect[0] - 72.0).abs() < 1.0, "soft-wrapped rows stay left-aligned: {:?}", line.rect);
     }
@@ -8577,3 +8564,15 @@ fn ordinary_soft_wrap_counts_keep_their_spaces() {
         assert_eq!(blocks[0].reflow_text, format!("First{}Second", " ".repeat(gap)));
     }
 }
+
+#[test]
+fn styled_existing_justification_is_refused_instead_of_silently_left_aligning() {
+    let mut doc = mixed_region_page();
+    let before = page_content_bytes(&doc, 0);
+    let blocks = text::text_blocks(&doc, 0).unwrap();
+    let style = text::BlockStyle { align: Some(added::Align::Justify), ..Default::default() };
+    let error = text::rewrite_block(&mut doc, 0, 1, Some(&blocks[1].editor_text), &style).unwrap_err();
+    assert!(error.to_string().contains("justification"));
+    assert_eq!(page_content_bytes(&doc, 0), before);
+    assert_eq!(page_content_bytes(&reopen(&doc), 0), before);
+}
diff --git a/crates/edit/src/text/rewrite.rs b/crates/edit/src/text/rewrite.rs
index 976f8a1b16..ec2fac984c 100644
--- a/crates/edit/src/text/rewrite.rs
+++ b/crates/edit/src/text/rewrite.rs
@@ -791,6 +791,13 @@ pub(crate) fn rewrite_block_from(
 ) -> Result<LineEdit, EditError> {
     let blocks = group_blocks(&lines);
     let b = blocks.get(block).cloned().ok_or_else(|| EditError::Invalid(format!("page {} has no paragraph {}", page + 1, block + 1)))?;
+    // Existing PDF paragraphs do not yet persist selected-row alignment intent. Refuse
+    // that operation before writing anything; whole-paragraph `align` remains supported.
+    if style.aligns.iter().any(Option::is_some) {
+        return Err(EditError::Invalid(
+            "selected-row alignment of existing paragraphs is not supported until it can be preserved across editing sessions".into(),
+        ));
+    }
     // An alignment for a one-row paragraph is laid out across the column it sits in, as a
     // paragraph of that width moved to its left edge.
     let framed;
@@ -812,6 +819,9 @@ pub(crate) fn rewrite_block_from(
     let mut res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
     let mut fonts_res = res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
     let dispatch = choose_rewrite_path(doc, &fonts_res, &b, &members, first, text, style)?;
+    if dispatch.use_styled_path && style.align == Some(crate::added::Align::Justify) {
+        return Err(EditError::Invalid("justification of mixed-style existing paragraphs is not supported".into()));
+    }
     if dispatch.use_styled_path {
         return rewrite_styled_block(doc, page, &b, &lines, text, style, max_glyphs);
     }
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 7147af2d42..692ba47a08 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -9280,3 +9280,54 @@ fn need_appearances_buttons_are_displayed_from_their_captions() {
         assert!(ink(&shown, inside(x, 100)) > 700, "the file's square at {x}");
     }
 }
+
+#[test]
+fn repeated_backdrop_artwork_survives_background_undo_redo_and_both_save_modes() {
+    let white = "1 g";
+    let rectangle = "0 0 100 100 re f";
+    let artwork = "q 0 g 0.25 0 0 0.25 20 20 cm";
+    let raw = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+         2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+         3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents [4 0 R 5 0 R 6 0 R 5 0 R 7 0 R] >> endobj\n\
+         4 0 obj << /Length {} >> stream\n{white}\nendstream endobj\n\
+         5 0 obj << /Length {} >> stream\n{rectangle}\nendstream endobj\n\
+         6 0 obj << /Length {} >> stream\n{artwork}\nendstream endobj\n\
+         7 0 obj << /Length 1 >> stream\nQ\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
+        white.len(), rectangle.len(), artwork.len()
+    );
+    // Start with a conventional xref, so the first save can exercise incremental output.
+    let source = pdfcraft_cos::Document::open(Arc::new(raw.into_bytes())).unwrap();
+    let bytes = pdfcraft_cos::write_full(&source, &pdfcraft_cos::SaveOptions::default()).unwrap();
+    let mut s = Session::new();
+    let id = s.open("shared-backdrop.pdf", None, Arc::new(bytes), None).unwrap();
+    let black = |s: &Session, id| {
+        let rgba = pixel(s, id, 0, 30, 70);
+        assert!(rgba[0] < 20 && rgba[1] < 20 && rgba[2] < 20, "later artwork survives: {rgba:?}");
+    };
+    black(&s, id);
+    s.apply(
+        id,
+        Edit::AddBackground {
+            pages: vec![0],
+            settings: Background { color: [1.0, 0.0, 0.0], ..Background::default() },
+            replace: false,
+            file: None,
+        },
+    )
+    .unwrap();
+    black(&s, id);
+    s.undo(id).unwrap();
+    black(&s, id);
+    s.redo(id).unwrap();
+    black(&s, id);
+    let saved = s.save_bytes(id).unwrap();
+    let reopened = s.open("incremental.pdf", None, saved.clone(), None).unwrap();
+    black(&s, reopened);
+    let doc = pdfcraft_cos::Document::open(saved).unwrap();
+    let full = pdfcraft_cos::write_full(&doc, &pdfcraft_cos::SaveOptions::default()).unwrap();
+    let rewritten = s.open("full.pdf", None, Arc::new(full), None).unwrap();
+    black(&s, rewritten);
+    s.apply(rewritten, Edit::RemoveMarks { kind: MarkKind::Background }).unwrap();
+    black(&s, rewritten);
+}
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 65cecfffd5..9338061978 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -908,27 +908,24 @@ fn packed_rows(samples: &[u8], row_len: usize, w: usize, h: usize, (n, bpc, whit
     Some(out)
 }
 
-/// Whether sample 1 is the dark one of the 1-bit image `d` describes, after its decode array
-/// (`[0 1]` when it has none of two numbers): the painted part of an image mask and black in grey
-/// decode to 0, and full ink in a separation (or a DeviceN of one colourant) to 1. An indexed image
-/// says the sample that decodes to entry 0 (its decode array maps samples to entries, ISO 32000-2
-/// §8.9.5.2): its palette says which entry is darker, and the palette isn't read yet, so a tie goes
-/// to entry 0 whatever its colour.
-fn dark_is_one(doc: &Document, d: &Dict) -> bool {
-    let number = |v: Option<&Object>| v.and_then(|v| doc.resolve(v).as_f64());
+/// Resolve polarity only for explicitly understood samples. Indexed palettes and custom
+/// colour spaces stay at their original resolution rather than guessing which entry is dark.
+fn dark_is_one(doc: &Document, d: &Dict) -> Option<bool> {
+    let number = |v: Option<&Object>| v.and_then(|v| doc.resolve(v).as_f64()).filter(|v| v.is_finite());
     let (d0, d1) = match d.get(b"Decode").map(|v| doc.resolve(v)).as_deref() {
-        Some(Object::Array(a)) => number(a.first()).zip(number(a.get(1))).unwrap_or((0.0, 1.0)),
-        _ => (0.0, 1.0),
+        Some(Object::Array(a)) if a.len() == 2 => number(a.first()).zip(number(a.get(1)))?,
+        None => (0.0, 1.0),
+        _ => return None,
     };
+    if d0 == d1 {
+        return None;
+    }
     if matches!(d.get(b"ImageMask"), Some(Object::Bool(true))) {
-        return d1 < d0;
+        return Some(d1 < d0);
     }
     match d.get(b"ColorSpace").map(|cs| doc.resolve(cs)).as_deref() {
-        Some(Object::Array(a)) => match a.first().and_then(Object::as_name) {
-            Some(b"Separation" | b"DeviceN") => d1 > d0,
-            _ => d1 < d0,
-        },
-        _ => d1 < d0,
+        Some(Object::Name(n)) if matches!(n.as_slice(), b"DeviceGray" | b"G") => Some(d1 < d0),
+        _ => None,
     }
 }
 
@@ -937,7 +934,12 @@ fn dark_is_one(doc: &Document, d: &Dict) -> bool {
 /// (1 if `dark_is_one`, see [`dark_is_one`]), so a dark line half a new pixel wide stays. `None`
 /// when the rows are short or the new size isn't smaller in both directions or empty. Also says
 /// how many new pixels cover both samples.
+#[cfg(test)]
 pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dark_is_one: bool) -> Option<(Vec<u8>, u64)> {
+    downsample_bits_checked(data, w, h, nw, nh, dark_is_one).map(|(out, mixed, _)| (out, mixed))
+}
+
+fn downsample_bits_checked(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dark_is_one: bool) -> Option<(Vec<u8>, u64, bool)> {
     if nw == 0 || nh == 0 || nw > w || nh > h {
         return None;
     }
@@ -951,7 +953,11 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
     // Per source column, the area its 1 samples cover in the new row.
     let mut ones = vec![0u64; usize::try_from(w).ok()?];
     let mut mixed = 0u64;
+    let mut previous_mixed = vec![false; usize::try_from(nw).ok()?];
+    let mut local_tone = false;
     for j in 0..nh {
+        let mut left_mixed = false;
+        let mut above_left_mixed = false;
         ones.fill(0);
         let (y0, y1) = (j * h, (j + 1) * h);
         for y in y0 / nh..y1.div_ceil(nh).min(h) {
@@ -972,21 +978,28 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
             // Against what the 0 samples cover: covered is at most w·h, which can't overflow
             // (w·h < 2^64 for u32 sizes).
             let zeros = w * h - covered;
-            mixed += u64::from(covered > 0 && zeros > 0);
+            let is_mixed = covered > 0 && zeros > 0;
+            mixed += u64::from(is_mixed);
+            let column = usize::try_from(i).ok()?;
+            let above = *previous_mixed.get(column)?;
+            local_tone |= is_mixed && left_mixed && above && above_left_mixed;
+            *previous_mixed.get_mut(column)? = is_mixed;
+            left_mixed = is_mixed;
+            above_left_mixed = above;
             if covered > zeros || (dark_is_one && covered == zeros) {
                 let i = usize::try_from(i).ok()?;
                 *out_row.get_mut(i / 8)? |= 0x80 >> (i % 8);
             }
         }
     }
-    Some((out, mixed))
+    Some((out, mixed, local_tone))
 }
 
 /// A black-and-white image (see [`one_bit`]) resampled and stored again per `settings`, if that is
 /// smaller as stored; `ppi` is its effective resolution, and `defaults` says it is drawn where
 /// `/DefaultGray` or `/DefaultRGB` is or may be in force. Also says whether it was resampled.
 ///
-/// - **Resampled** ([`downsample_bits`]) when its resolution is above `above_ppi`, to `target_ppi`,
+/// - **Resampled** ([`downsample_bits_checked`]) when its resolution is above `above_ppi`, to `target_ppi`,
 ///   unless it has a soft mask, whose own size would then have to follow, or is a halftone or a
 ///   dither: most of its new pixels would cover both black and white, and taking the sample that
 ///   covers more would turn its tones solid (a 50% screen black, a 25% one white).
@@ -1025,12 +1038,15 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, defaults: bool, settings: &MonoSet
     } else {
         (w, h)
     };
-    let averaged = if (nw, nh) != (w, h) {
+    let polarity = if defaults { None } else { dark_is_one(doc, packed.as_ref().unwrap_or(d)) };
+    let averaged = if (nw, nh) != (w, h) && polarity.is_some() {
         // The dark sample of the image as it ends up: packed RGB is grey, with grey's decode pair.
-        let (out, mixed) = downsample_bits(&data, w, h, nw, nh, dark_is_one(doc, packed.as_ref().unwrap_or(d)))?;
+        let (out, mixed, local_tone) = downsample_bits_checked(&data, w, h, nw, nh, polarity?)?;
         // A halftone or dither: most new pixels cover both samples. Text covers both only along
         // its edges.
-        (mixed.saturating_mul(2) <= u64::from(nw) * u64::from(nh)).then_some(out)
+        // A dense 2x2 patch of mixed output samples can encode a local photo even when
+        // white margins dominate the page. Conservatively retain the original image.
+        (!local_tone && mixed.saturating_mul(2) <= u64::from(nw) * u64::from(nh)).then_some(out)
     } else {
         None
     };
@@ -1310,15 +1326,15 @@ mod downsample_tests {
             ("ColorSpace", Object::Array(vec![Object::name("Separation"), Object::name("Spot"), Object::name("DeviceCMYK"), Object::Null]));
         let indexed = ("ColorSpace", Object::Array(vec![Object::name("Indexed"), Object::name("DeviceGray"), 1.into(), Object::Null]));
         for (entries, dark_one) in [
-            (vec![grey.clone()], false),
-            (vec![grey, inverted.clone()], true),
-            (vec![mask.clone()], false),
-            (vec![mask, inverted.clone()], true),
-            (vec![separation.clone()], true),
-            (vec![separation, inverted.clone()], false),
-            (vec![indexed.clone()], false),
-            (vec![indexed, inverted], true),
-            (vec![("ColorSpace", Object::name("DeviceGray")), ("Decode", Object::Array(vec![Object::name("x"), 0.into()]))], false),
+            (vec![grey.clone()], Some(false)),
+            (vec![grey, inverted.clone()], Some(true)),
+            (vec![mask.clone()], Some(false)),
+            (vec![mask, inverted.clone()], Some(true)),
+            (vec![separation.clone()], None),
+            (vec![separation, inverted.clone()], None),
+            (vec![indexed.clone()], None),
+            (vec![indexed, inverted], None),
+            (vec![("ColorSpace", Object::name("DeviceGray")), ("Decode", Object::Array(vec![Object::name("x"), 0.into()]))], None),
         ] {
             assert_eq!(dark_is_one(&doc, &image(&entries)), dark_one, "{entries:?}");
         }
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 3e8b5b9b11..a01def0693 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -3413,3 +3413,87 @@ fn lzw_streams_that_cannot_be_read_or_are_not_asked_for_stay_unchanged() {
     assert_eq!(optimize(&mut doc, &Settings::default()).unwrap().lzw_streams, 1);
     assert_eq!(stream(&doc, c).decoded_strict().unwrap(), ops);
 }
+
+/// Unknown palette polarity is never guessed. Both palette orders and Decode directions
+/// retain the original thin rule and exact samples through a full save and render.
+#[test]
+fn indexed_thin_rules_keep_their_samples_for_both_palette_orders_and_decodes() {
+    let (w, h) = (1200u32, 480u32);
+    let stride = (w as usize).div_ceil(8);
+    let mut gray_data = vec![0xFF; stride * h as usize];
+    for y in 0..h as usize {
+        gray_data[y * stride + 101 / 8] &= !(0x80 >> (101 % 8));
+    }
+    let mut gray = Document::new_empty();
+    let gray_image = mono_image(&mut gray, w, h, &gray_data, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    page(&mut gray, &[("Im", gray_image)], "q 144 0 0 57.6 20 600 cm /Im Do Q");
+    let gray_render = render(&gray);
+    optimize(&mut gray, &Settings::default()).unwrap();
+    let gray_stream = stream(&gray, gray_image);
+    let gray_samples = gray.decoded_image(&gray_stream).unwrap();
+    assert!(gray_samples.iter().any(|b| *b != 0xFF), "the DeviceGray thin rule survives");
+    for white_first in [false, true] {
+        for inverted in [false, true] {
+            let mut data = vec![0xFF; stride * h as usize];
+            for y in 0..h as usize {
+                data[y * stride + 101 / 8] &= !(0x80 >> (101 % 8));
+            }
+            if white_first != inverted {
+                data.iter_mut().for_each(|b| *b = !*b);
+            }
+            let palette = if white_first { vec![255, 0] } else { vec![0, 255] };
+            let cs = Object::Array(vec![
+                Object::name("Indexed"),
+                Object::name("DeviceGray"),
+                1.into(),
+                Object::String(pdfcraft_cos::PdfString::literal(palette)),
+            ]);
+            let mut entries = vec![("BitsPerComponent", 1.into()), ("ColorSpace", cs)];
+            if inverted {
+                entries.push(("Decode", Object::Array(vec![1.into(), 0.into()])));
+            }
+            let mut doc = Document::new_empty();
+            let image = mono_image(&mut doc, w, h, &data, None, &entries);
+            page(&mut doc, &[("Im", image)], "q 144 0 0 57.6 20 600 cm /Im Do Q");
+            let before = render(&doc);
+            assert_eq!(before, gray_render, "the palette image is visually identical to DeviceGray");
+            optimize(&mut doc, &Settings::default()).unwrap();
+            let s = stream(&doc, image);
+            assert_eq!((s.dict.int(b"Width"), s.dict.int(b"Height")), (Some(w.into()), Some(h.into())));
+            assert_eq!(doc.decoded_image(&s).unwrap(), data);
+            let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+            assert_eq!(render(&saved), before, "palette white-first={white_first}, inverted={inverted}");
+        }
+    }
+}
+
+/// White margins must not hide a small screened photograph from the tone guard.
+#[test]
+fn mixed_text_and_small_halftone_regions_keep_their_tones_with_wide_white_margins() {
+    let (w, h) = (1200u32, 480u32);
+    let stride = (w as usize).div_ceil(8);
+    for side in [8usize, 40, 300] {
+        let mut data = vec![0xFF; stride * h as usize];
+        for y in 40..40 + side {
+            for x in 100..100 + side {
+                if (x + y) % 2 == 0 {
+                    data[y * stride + x / 8] &= !(0x80 >> (x % 8));
+                }
+            }
+        }
+        // A separate one-pixel text/rule stroke makes this a mixed-content scan.
+        for y in 380..420 {
+            data[y * stride + 801 / 8] &= !(0x80 >> (801 % 8));
+        }
+        let mut doc = Document::new_empty();
+        let image = mono_image(&mut doc, w, h, &data, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+        page(&mut doc, &[("Im", image)], "q 144 0 0 57.6 20 600 cm /Im Do Q");
+        let before = render(&doc);
+        optimize(&mut doc, &Settings::default()).unwrap();
+        let s = stream(&doc, image);
+        assert_eq!((s.dict.int(b"Width"), s.dict.int(b"Height")), (Some(w.into()), Some(h.into())));
+        assert_eq!(doc.decoded_image(&s).unwrap(), data, "screened samples survive, not a solid patch");
+        let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+        assert_eq!(render(&saved), before, "local halftone {side}x{side}");
+    }
+}
diff --git a/crates/ui-egui/src/panels/format_text_ui.rs b/crates/ui-egui/src/panels/format_text_ui.rs
index 0a8ac6af8f..eccef2aa79 100644
--- a/crates/ui-egui/src/panels/format_text_ui.rs
+++ b/crates/ui-egui/src/panels/format_text_ui.rs
@@ -65,6 +65,9 @@ impl Paragraphs<'_> {
 
     /// `align` picked: for the selected paragraphs, or the whole box (dropping theirs).
     fn choose(&self, look: &mut AddedText, align: TextAlign) {
+        if !self.tidy && self.selected().is_some() {
+            return;
+        }
         match self.selected() {
             Some(which) => {
                 let count = pdfcraft_engine::paragraph_align::count(self.text);
@@ -192,7 +195,11 @@ pub(crate) fn panel(
             TextAlign::Right => "align-right",
             TextAlign::Justify => "align-justify",
         };
-        let align = icons::button(ui, current, 30.0, false, tl!("Alignment"));
+        let supported = paragraphs.as_ref().is_none_or(|p| p.tidy || p.selected().is_none());
+        let align = ui
+            .add_enabled_ui(supported, |ui| icons::button(ui, current, 30.0, false, tl!("Alignment")))
+            .inner
+            .on_disabled_hover_text(format!("{} — {}", tl!("Alignment"), tl!("Planned")));
         let align = flyout(ui, t, align);
         egui::Popup::menu(&align).show(|ui| {
             ui.horizontal(|ui| {
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 4f4bbf06be..0eb5ccb7fe 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -7114,99 +7114,49 @@ fn row_rect(h: &Harness<'static, PdfCraftApp>, starts: &str) -> [f64; 4] {
     s.session.get(s.views[0].id).unwrap().text_lines(0).into_iter().find(|l| l.text.starts_with(starts)).expect("the row").rect
 }
 
-/// Bug A: with one row of a paragraph selected, an alignment applies to that row only.
-/// Bug C: Undo then puts the paragraph back and closes the editor, instead of leaving it open on
-/// a text the page no longer has.
+/// Existing-row alignment stays disabled until intent survives reopening; cancellation keeps all rows.
 #[test]
-fn aligning_a_selected_row_aligns_only_that_row_and_undo_puts_it_back() {
+fn selected_existing_rows_keep_alignment_disabled_and_the_complete_paragraph() {
     let mut h = three_row_paragraph();
+    let before = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
     let first = row_rect(&h, "One");
-    let wide = row_rect(&h, "three");
     let last = row_rect(&h, "nine");
-    // Select the last row.
     h.key_press_modifiers(Modifiers::COMMAND, Key::End);
     h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
     h.run_steps(2);
+    assert!(h.get_by_label("Alignment").accesskit_node().is_disabled());
+    let button = h.get_by_label("Alignment").rect().center();
+    click_at(&mut h, button);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, before);
+    assert_eq!(row_rect(&h, "One"), first);
+    assert_eq!(row_rect(&h, "nine"), last);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), None);
+    h.key_press(Key::Escape);
+    h.run_steps(3);
+    assert_eq!(row_rect(&h, "One"), first);
+    assert_eq!(row_rect(&h, "nine"), last);
+}
+
+
+/// Clearing the selection restores ordinary whole-paragraph alignment and its undo step.
+#[test]
+fn whole_paragraph_alignment_stays_available_without_a_row_selection() {
+    let mut h = three_row_paragraph();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
+    h.run_steps(2);
+    assert!(h.get_by_label("Alignment").accesskit_node().is_disabled());
+    h.key_press(Key::End);
+    h.run_steps(2);
+    assert!(!h.get_by_label("Alignment").accesskit_node().is_disabled());
     align_by_pointer(&mut h, "Align right");
-    {
-        let s = h.state();
-        assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), Some("Edit text"));
-        assert!(s.views[0].line_editor.is_some(), "the paragraph stays open");
-    }
-    let moved = row_rect(&h, "nine");
-    assert!((row_rect(&h, "One")[0] - first[0]).abs() < 0.5, "the first row stays put");
-    assert!((moved[2] - wide[2]).abs() < 1.0 && moved[0] > last[0] + 20.0, "the last row is right-aligned: {moved:?}");
+    assert!(h.state().views[0].line_editor.is_some());
     h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
-    h.run_steps(4);
-    let s = h.state();
-    assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), None, "the alignment is undone");
-    assert!(s.views[0].line_editor.is_none(), "the editor closed with the step it showed");
-    assert!((row_rect(&h, "nine")[0] - last[0]).abs() < 0.5, "the last row is back");
-}
-
-/// Format text's alignment flyout by keyboard or screen reader: each control is focused, then
-/// pressed, with no pointer anywhere.
-fn align_by_focus(h: &mut Harness<'static, PdfCraftApp>, choice: &str) {
-    for label in ["Alignment", choice] {
-        h.get_by_label(label).focus();
-        h.run_steps(2);
-        h.get_by_label(label).click();
-        h.run_steps(3);
-    }
-}
-
-/// The same as by pointer, with the alignment controls reached by keyboard or a screen reader:
-/// the paragraph stays open when the focus leaves it for the Format text panel, the selected row
-/// takes the alignment, and a second choice is for that row again.
-#[test]
-fn aligning_a_selected_row_by_keyboard_keeps_the_paragraph_open() {
-    let mut h = three_row_paragraph();
-    let first = row_rect(&h, "One");
-    let wide = row_rect(&h, "three");
-    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
-    h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
-    h.run_steps(2);
-    align_by_focus(&mut h, "Align right");
-    assert!(h.state().views[0].line_editor.is_some(), "the paragraph stays open");
-    let moved = row_rect(&h, "nine");
-    assert!((moved[2] - wide[2]).abs() < 1.0, "the last row is right-aligned: {moved:?}");
-    align_by_focus(&mut h, "Centre");
-    assert!(h.state().views[0].line_editor.is_some(), "the paragraph is still open");
-    assert!((row_rect(&h, "One")[0] - first[0]).abs() < 0.5, "the first row stays put: {:?}", row_rect(&h, "One"));
-    let last = row_rect(&h, "nine");
-    assert!((((last[0] + last[2]) - (wide[0] + wide[2])) / 2.0).abs() < 1.0, "the last row is centred: {last:?} in {wide:?}");
-}
-
-/// A row aligned on its own, deleted by typing, then brought back with Undo from the menu: it
-/// comes back with its alignment, and Redo deletes it again. The box's history keeps only text,
-/// so the restored row took the alignment of the row before it.
-#[test]
-fn undo_brings_a_deleted_row_back_with_its_alignment() {
-    let mut h = three_row_paragraph();
-    // Right-align the last row on its own.
-    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
-    h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
-    h.run_steps(2);
-    align_by_pointer(&mut h, "Align right");
-    let ed = |h: &Harness<'static, PdfCraftApp>| h.state().views[0].line_editor.clone().expect("the paragraph stays open");
-    let (three_rows, aligned) = (ed(&h).text, ed(&h).look.aligns);
-    assert_eq!(aligned.last(), Some(&Some(pdfcraft_engine::TextAlign::Right)), "{aligned:?}");
-    // Delete the last row with the line break before it.
-    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
-    h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
-    h.key_press_modifiers(Modifiers::SHIFT, Key::ArrowLeft);
-    h.key_press(Key::Backspace);
-    h.run_steps(2);
-    let (two_rows, after_delete) = (ed(&h).text, ed(&h).look.aligns);
-    assert_eq!(pdfcraft_engine::paragraph_align::count(&two_rows), 2, "{two_rows:?}");
-    assert!(h.state_mut().execute("edit.undo"));
     h.run_steps(3);
-    assert_eq!((ed(&h).text, ed(&h).look.aligns), (three_rows, aligned), "Undo brings the row back right-aligned");
-    assert!(h.state_mut().execute("edit.redo"));
-    h.run_steps(3);
-    assert_eq!((ed(&h).text, ed(&h).look.aligns), (two_rows, after_delete), "Redo deletes it again");
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), None);
 }
 
+
 /// Redo after Undo in the box puts the typing back, in the box: it doesn't reach the document,
 /// whose own Redo (a formatting change waiting here) must stay waiting.
 #[test]
@@ -7239,47 +7189,6 @@ fn redo_after_undoing_typing_puts_the_typing_back() {
     assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
 }
 
-/// A row aligned on its own keeps its alignment when the whole paragraph is then made bold: the
-/// rewrite for the bold carries the rows' alignments too, as nothing in the page records them.
-#[test]
-fn a_row_aligned_on_its_own_keeps_it_through_more_formatting() {
-    let mut h = three_row_paragraph();
-    let wide = row_rect(&h, "three");
-    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
-    h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
-    h.run_steps(2);
-    align_by_pointer(&mut h, "Align right");
-    // Nothing selected: the bold is for the whole paragraph.
-    h.key_press(Key::End);
-    h.run_steps(2);
-    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().selection, None);
-    h.get_by_label("Bold").click();
-    h.run_steps(4);
-    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().text_blocks(0)[0].base_font, "Helvetica-Bold");
-    let last = row_rect(&h, "nine");
-    assert!(
-        (last[2] - row_rect(&h, "three")[2].max(wide[2])).abs() < 1.0 && last[0] > wide[0] + 20.0,
-        "the last row is still right-aligned: {last:?}"
-    );
-}
-
-/// A second alignment picked while the same row is still selected applies to that row again, not
-/// the whole paragraph.
-#[test]
-fn a_second_alignment_for_a_selected_row_stays_on_that_row() {
-    let mut h = three_row_paragraph();
-    let first = row_rect(&h, "One");
-    let wide = row_rect(&h, "three");
-    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
-    h.key_press_modifiers(Modifiers::SHIFT, Key::Home);
-    h.run_steps(2);
-    align_by_pointer(&mut h, "Align right");
-    align_by_pointer(&mut h, "Centre");
-    assert!((row_rect(&h, "One")[0] - first[0]).abs() < 0.5, "the first row stays put: {:?}", row_rect(&h, "One"));
-    let last = row_rect(&h, "nine");
-    let (mid, centre) = ((last[0] + last[2]) / 2.0, (wide[0] + wide[2]) / 2.0);
-    assert!((mid - centre).abs() < 1.0, "the last row is centred: {last:?} in {wide:?}");
-}
 
 /// Redo from the menu or toolbar with typing in the box the page doesn't have yet. Closing the
 /// box first applied the typing, a new edit that dropped the document's waiting Redo, and the
diff --git a/docs/integration-20261030.md b/docs/integration-20261030.md
index 92b5e07127..2ee2dac6a7 100644
--- a/docs/integration-20261030.md
+++ b/docs/integration-20261030.md
@@ -5,6 +5,16 @@ Base: 1d1cbc4ec92012767f5b48c92b451e15eb401c42
 Validation: combined GitHub CI passed on bdf56209ce6a22980ef488eec92a55073f5a4e18 (Linux and Windows, run 41038860617). No fresh manual GUI pass has been performed. The subsequent architectural-guard additions require a fresh run.
 All included source heads are preserved as merge parents, retaining original authorship. No upstream PR was merged. Conflicts were resolved after the user requested inclusion despite merge conflicts.
 
+## Review follow-up and withheld behavior
+
+Review 5712795161 identified combined-behavior gaps after the green baseline at 673178b.
+The follow-up is pending fresh hosted validation; earlier results below are historical evidence.
+
+- Backdrop detection uses a shared strict 64 KiB decoding budget, including intermediate filter outputs, and caps content-stream entries. A fill stream executed more than once on the page is treated as ambiguous and is not replaced; source artwork stays untouched.
+- Monochrome downsampling no longer guesses Indexed/custom color-space polarity. Those images may be recompressed losslessly but retain their resolution. A local 2-by-2 patch of mixed output samples conservatively retains the entire source image, even when white margins dominate it.
+- **Withheld from #4180:** selected-row alignment of existing PDF paragraphs. The UI disables it for a text selection and the editing API explicitly refuses per-row alignment intent before mutation. Whole-paragraph alignment and the independently persisted alignments of added text remain available. Prior immediate-row tests are replaced by safe-refusal tests; no cross-session alignment guarantee is claimed for the withheld feature.
+- The custom JBIG2 encoder still needs separate representative independent-decoder qualification. No codec corruption defect has been established by this review. No fresh native manual GUI acceptance pass is claimed.
+
 ## Included
 - [#4304](https://github.com/storytold/pdfcraft/pull/4304): M11: PDF Optimizer stores black-and-white images as CCITT Group 4 (optimize.mono-compression) (1b7164cab1fc187c5385c30f94449542fe284280)
 - [#4335](https://github.com/storytold/pdfcraft/pull/4335): M11: black-and-white pictures stay one bit: Create PDF, the optimizer, and CCITT image export (210ba20fe69e701286bbfdbd924cfc01d9aaa9f4)
@@ -76,7 +86,7 @@ For each source-head diff above, the added `#[test]` function names were matched
 - #2635: 6/6 added source regression names passed; 0 missing, 0 skipped.
 - #1952: 6/6 added source regression names passed; 0 missing, 0 skipped.
 
-The conflict-specific tests `wrapped_rows_keep_alignment_separate_from_hard_break_markers` and `black_and_white_images_become_jbig2` (including the CCITT-to-JBIG2 conversion/render assertions) passed in that same run. Source tests for alignment/history, paragraph boundaries, field calculations and button export values remain present and passed.
+The conflict-specific tests `wrapped_rows_keep_alignment_separate_from_hard_break_markers` and `black_and_white_images_become_jbig2` (including the CCITT-to-JBIG2 conversion/render assertions) passed in that same run. Those counts describe that baseline. In the review follow-up, unsupported existing-row alignment success tests are replaced by safe-refusal tests; the corresponding feature is withheld. Paragraph-boundary, field-calculation and button-export coverage is retained.
 
 ## Protect dependency check
 
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 98ebd7e9ab..d4a06ba8fc 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1974,8 +1974,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text", "edit.text"]
 tools = ["text_edit", "content_update"]
-evidence = ["crates/edit/src/tests.rs::justify_underline_and_spacing", "crates/edit/src/tests.rs::paragraphs_take_new_formatting", "crates/edit/src/tests.rs::a_one_row_title_keeps_its_centre_when_it_grows_and_when_it_wraps", "crates/ui-egui/tests/it/editing.rs::the_format_panel_restyles_the_paragraph_being_edited", "crates/edit/src/tests.rs::one_row_of_a_paragraph_takes_its_own_alignment", "crates/edit/src/tests.rs::one_row_of_a_styled_region_takes_its_own_alignment", "crates/edit/src/tests.rs::added_text_paragraphs_keep_their_own_alignments", "crates/ui-egui/tests/it/editing.rs::aligning_a_selected_row_aligns_only_that_row_and_undo_puts_it_back", "crates/ui-egui/tests/it/content.rs::aligning_a_selected_line_of_added_text_aligns_only_that_line", "crates/automation/tests/it/automation.rs::added_text_lines_take_their_own_alignments"]
-notes = "left, centre, right and justify (word spacing per line, last line left) for existing paragraphs and added text. A centred paragraph is found either from its ragged rows or, for a one row title, from its centre sitting on the page's own centre away from the edge the rest of the text uses, so growing or wrapping it keeps that centre (#2581). With text selected, Format text aligns only the lines (rows between line breaks) the selection touches; with only the caret, the whole paragraph or box (aligns in text_edit, page_add_text and content_update). Added text keeps each line's alignment in its /PCAdded parameters, and a justified line's last row is not stretched. Missing: an edited paragraph's per-row alignment is not recorded in the page, so after it is closed and reopened a later rewrite of it can put that row back to the paragraph's alignment (as whole-paragraph justify is lost, #2508/#2515); aligning a row can regroup the paragraph, and the editor then shows only the part it groups first; a row justified on its own in a region of mixed styles is left-aligned, as the styled-region rewrite doesn't justify (a whole paragraph there isn't justified either); the added-text editor stretches justified lines with egui's own spacing, close to but not exactly as written"
+evidence = ["crates/edit/src/tests.rs::justify_underline_and_spacing", "crates/edit/src/tests.rs::paragraphs_take_new_formatting", "crates/edit/src/tests.rs::a_one_row_title_keeps_its_centre_when_it_grows_and_when_it_wraps", "crates/ui-egui/tests/it/editing.rs::the_format_panel_restyles_the_paragraph_being_edited", "crates/edit/src/tests.rs::one_row_of_a_paragraph_takes_its_own_alignment_is_refused_without_changing_the_document", "crates/edit/src/tests.rs::one_row_of_a_styled_region_takes_its_own_alignment_is_refused_without_changing_the_document", "crates/edit/src/tests.rs::added_text_paragraphs_keep_their_own_alignments", "crates/ui-egui/tests/it/editing.rs::selected_existing_rows_keep_alignment_disabled_and_the_complete_paragraph", "crates/ui-egui/tests/it/content.rs::aligning_a_selected_line_of_added_text_aligns_only_that_line", "crates/automation/tests/it/automation.rs::added_text_lines_take_their_own_alignments"]
+notes = "Whole-paragraph left, centre and right alignment remain available for existing PDF text; the supported single-style path also justifies. Mixed-style existing-paragraph justification is explicitly refused rather than silently applying Left. Selected-row alignment of existing PDF paragraphs is withheld: the UI disables alignment with a text selection, and text_edit refuses per-row intent before mutation until persistence and regrouping can be qualified. Added text retains independently persisted per-line alignment in /PCAdded, including through page_add_text and content_update. Missing: existing whole-paragraph justification intent across reopening (#2508/#2515), mixed-style justification, and existing-row alignment persistence/regrouping. The added-text preview uses egui spacing, close to but not exactly as written. Review 5712795161 follow-up validation is pending."
 
 [[feature]]
 id = "edit.line-paragraph-spacing"

From 4791cacd2cc55a1d91962c8109cfff11eae853e1 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 14:55:44 +0100
Subject: [PATCH 249/270] test: qualify conservative tone retention and format
 review regressions

---
 crates/automation/tests/it/automation.rs | 26 ++++++++++++-
 crates/engine/src/tests.rs               | 11 ++----
 crates/optimize/tests/optimize.rs        | 47 ++++++++----------------
 crates/ui-egui/tests/it/editing.rs       |  3 --
 parity/acrobat-features.toml             |  2 +-
 5 files changed, 45 insertions(+), 44 deletions(-)

diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index d6c058b8f4..abfd441d34 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6770,7 +6770,7 @@ fn doc_optimize_stores_black_and_white_images_as_ccitt_group_4() {
 fn doc_optimize_averages_black_and_white_scans_down() {
     let dir = workdir("optimize-mono-downsample");
     // 1000 × 400 samples on 120 × 48 pt: 600 ppi.
-    std::fs::write(dir.join("scan.pdf"), scan_drawn(b"q 120 0 0 48 50 500 cm /Scan Do Q")).unwrap();
+    std::fs::write(dir.join("scan.pdf"), simple_rule_scan_drawn(b"q 120 0 0 48 50 500 cm /Scan Do Q")).unwrap();
     let mut a = auto(&dir);
     let doc = ok(&mut a, "doc_open", json!({ "path": "scan.pdf" }))["doc"].as_u64().unwrap();
     let sizes = |name: &str| image_sizes(&dir.join(name));
@@ -6807,7 +6807,7 @@ fn image_sizes(path: &std::path::Path) -> Vec<(Option<i64>, Option<i64>)> {
 fn batch_ppi_bounds_how_far_black_and_white_scans_are_resampled() {
     let dir = workdir("batch-mono-ppi");
     // 1000 × 400 samples on 120 × 48 pt: 600 ppi.
-    std::fs::write(dir.join("scan.pdf"), scan_drawn(b"q 120 0 0 48 50 500 cm /Scan Do Q")).unwrap();
+    std::fs::write(dir.join("scan.pdf"), simple_rule_scan_drawn(b"q 120 0 0 48 50 500 cm /Scan Do Q")).unwrap();
     let mut a = auto(&dir);
     for (ppi, size) in [(None, (500, 200)), (Some(600), (1000, 400)), (Some(96), (500, 200))] {
         let out = format!("out-{ppi:?}");
@@ -10171,3 +10171,25 @@ fn a_shared_text_object_keeps_both_paragraphs_through_tools() {
     let extracted = page_text(&mut a, again);
     assert!(extracted[0].contains("Four") && extracted[0].contains("Neighbor stays."), "{extracted:?}");
 }
+
+/// Unambiguous separated one-pixel rules test the requested scale independently of the
+/// conservative local-tone guard. Ragged text can legitimately be retained by that guard.
+fn simple_rule_scan_drawn(content: &[u8]) -> Vec<u8> {
+    use pdfcraft_cos::{Document, Object, SaveOptions, Stream, write_full};
+    let mut doc = Document::open(std::sync::Arc::new(scan_drawn(content))).unwrap();
+    for number in doc.object_numbers() {
+        let reference = pdfcraft_cos::ObjRef::new(number, doc.generation(number));
+        let object = doc.get(reference);
+        let Object::Stream(image) = &*object else { continue };
+        if image.dict.name(b"Subtype") != Some(b"Image") {
+            continue;
+        }
+        let mut data = vec![0xFF; 125 * 400];
+        for y in 0..400 {
+            data[y * 125] &= 0x7F;
+            data[y * 125 + 124] &= 0xFE;
+        }
+        doc.set(reference, Object::Stream(Stream::flate(image.dict.clone(), &data)));
+    }
+    write_full(&doc, &SaveOptions::default()).unwrap()
+}
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 692ba47a08..5db12eda04 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -9294,7 +9294,9 @@ fn repeated_backdrop_artwork_survives_background_undo_redo_and_both_save_modes()
          5 0 obj << /Length {} >> stream\n{rectangle}\nendstream endobj\n\
          6 0 obj << /Length {} >> stream\n{artwork}\nendstream endobj\n\
          7 0 obj << /Length 1 >> stream\nQ\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
-        white.len(), rectangle.len(), artwork.len()
+        white.len(),
+        rectangle.len(),
+        artwork.len()
     );
     // Start with a conventional xref, so the first save can exercise incremental output.
     let source = pdfcraft_cos::Document::open(Arc::new(raw.into_bytes())).unwrap();
@@ -9308,12 +9310,7 @@ fn repeated_backdrop_artwork_survives_background_undo_redo_and_both_save_modes()
     black(&s, id);
     s.apply(
         id,
-        Edit::AddBackground {
-            pages: vec![0],
-            settings: Background { color: [1.0, 0.0, 0.0], ..Background::default() },
-            replace: false,
-            file: None,
-        },
+        Edit::AddBackground { pages: vec![0], settings: Background { color: [1.0, 0.0, 0.0], ..Background::default() }, replace: false, file: None },
     )
     .unwrap();
     black(&s, id);
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index a01def0693..0f2f1e1f4a 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1461,7 +1461,7 @@ fn black_and_white_rgb_in_resources_its_page_tree_and_a_form_share_becomes_grey(
 /// screen size. With `downsample` off nothing is resampled; with Retain, Flate stays Flate, CCITT
 /// stays CCITT, and eight-bit grey and RGB are left to the grey and colour settings.
 #[test]
-fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
+fn ambiguous_monochrome_text_is_recompressed_without_lossy_reduction() {
     let mut doc = Document::new_empty();
     let (w, h) = (1200u32, 480u32);
     let text = bilevel(w, h, false);
@@ -1547,24 +1547,8 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
         let d = stream(doc, r).dict;
         (d.int(b"Width").unwrap(), d.int(b"Height").unwrap())
     };
-    // Each new pixel: 1 when more than two of the 2 × 2 it covers are, or two when 1 is the dark
-    // sample (the mask's decode array inverts it, so its painted part is 1).
-    let stride = (w as usize).div_ceil(8);
-    let bit = |x: usize, y: usize| text[y * stride + x / 8] & (0x80 >> (x % 8)) != 0;
-    let halve = |dark_one: bool| {
-        let mut out = vec![0u8; (w as usize / 2).div_ceil(8) * h as usize / 2];
-        for y in 0..h as usize / 2 {
-            for x in 0..w as usize / 2 {
-                let ones = [(0, 0), (1, 0), (0, 1), (1, 1)].iter().filter(|(dx, dy)| bit(2 * x + dx, 2 * y + dy)).count();
-                if ones > 2 || (dark_one && ones == 2) {
-                    out[y * (w as usize / 2).div_ceil(8) + x / 8] |= 0x80 >> (x % 8);
-                }
-            }
-        }
-        out
-    };
-    let (halved, halved_mask) = (halve(false), halve(true));
-    assert_ne!(halved, halved_mask, "the picture has ties");
+    // This ragged text fixture has dense local mixed-sample patches. The conservative
+    // tone guard retains it too: a false positive costs size, not document content.
 
     // The grey and colour settings left alone too: an image of more bits would otherwise take
     // them when smaller.
@@ -1578,14 +1562,14 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     let mut kept = doc.clone();
     let r = optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
     // Not the inverted RGB: the colour settings leave an image with a decode array alone.
-    assert_eq!(r.images_resampled, 6, "{r:?}");
+    assert_eq!(r.images_resampled, 2, "{r:?}");
     assert_eq!(stream(&kept, flate).dict.name(b"Filter"), Some(&b"FlateDecode"[..]), "Retain: Flate stays Flate");
     for i in [fax, hex_fax] {
-        assert_eq!(stream(&kept, i).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "and CCITT stays CCITT: {i:?}");
+        assert_eq!(stream(&kept, i).dict.get(b"Filter"), stream(&doc, i).dict.get(b"Filter"), "Retain keeps the exact filter chain");
     }
     assert_eq!(raw(&kept, hex_at_400), raw(&doc, hex_at_400), "and nothing else changes");
     for i in [flate, fax, hex_fax] {
-        assert_eq!((size(&kept, i), kept.decoded_image(&stream(&kept, i)).unwrap()), ((600, 240), halved.clone()), "{i:?}");
+        assert_eq!((size(&kept, i), kept.decoded_image(&stream(&kept, i)).unwrap()), ((1200, 480), text.clone()), "{i:?}");
     }
     let bits = [eight, rgb, rgb_inverted].map(|i| stream(&kept, i).dict.int(b"BitsPerComponent"));
     assert_eq!(bits, [Some(8); 3], "Retain leaves eight bits to the grey and colour settings");
@@ -1593,13 +1577,13 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     let untouched = [fax_at_400].map(|r| raw(&doc, r));
     let hex_len = raw(&doc, hex_at_400).len();
     let r = optimize(&mut doc, &Settings::default()).unwrap();
-    assert_eq!((r.images_resampled, r.images_recompressed), (7, 3), "{r:?}");
+    assert_eq!((r.images_resampled, r.images_recompressed), (0, 9), "{r:?}");
     assert_eq!(stream(&doc, rgb).dict.get(b"ColorSpace"), Some(&Object::name("DeviceGray")));
     for i in [flate, fax, mask, eight, hex_fax, rgb] {
         let s = stream(&doc, i);
-        assert_eq!((size(&doc, i), s.dict.int(b"BitsPerComponent")), ((600, 240), if i == mask { None } else { Some(1) }));
+        assert_eq!((size(&doc, i), s.dict.int(b"BitsPerComponent")), ((1200, 480), if i == mask { None } else { Some(1) }));
         assert!(matches!(s.dict.name(b"Filter"), Some(b"CCITTFaxDecode" | b"FlateDecode")), "{i:?}");
-        assert_eq!(doc.decoded_image(&s).unwrap(), if i == mask { halved_mask.clone() } else { halved.clone() }, "{i:?}");
+        assert_eq!(doc.decoded_image(&s).unwrap(), text.clone(), "{i:?}");
     }
     assert_eq!(stream(&doc, mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");
     // Grey now, with grey's decode pair, which makes 1 black: its ties are black too.
@@ -1607,9 +1591,9 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     let inverting = Object::Array(vec![1.into(), 0.into()]);
     assert_eq!(
         (size(&doc, rgb_inverted), s.dict.get(b"ColorSpace"), s.dict.get(b"Decode")),
-        ((600, 240), Some(&Object::name("DeviceGray")), Some(&inverting))
+        ((1200, 480), Some(&Object::name("DeviceGray")), Some(&inverting))
     );
-    assert_eq!(doc.decoded_image(&s).unwrap(), halved.iter().map(|b| !b).collect::<Vec<u8>>(), "the same picture, ties black");
+    assert_eq!(doc.decoded_image(&s).unwrap(), text.iter().map(|b| !b).collect::<Vec<u8>>(), "the same picture, ties black");
     for i in [at_400, soft, hex_at_400] {
         assert_eq!((size(&doc, i), stream(&doc, i).dict.name(b"Filter")), ((1200, 480), Some(&b"CCITTFaxDecode"[..])), "{i:?}");
     }
@@ -1617,8 +1601,7 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     assert_eq!(doc.decoded_image(&stream(&doc, hex_at_400)).unwrap(), text, "and the picture kept");
     assert_eq!([fax_at_400].map(|r| raw(&doc, r)), untouched);
     let after = render(&doc);
-    let differ = before.iter().zip(&after).filter(|(a, b)| a.abs_diff(**b) > 64).count();
-    assert!(differ * 200 < before.len(), "{differ} of {} channel values differ visibly", before.len());
+    assert_eq!(after, before, "conservative retention preserves the rendered page exactly");
 }
 
 /// Monochrome downsampling leaves a halftone or a dither at its resolution, as most new pixels
@@ -1658,7 +1641,7 @@ fn monochrome_downsampling_leaves_halftones_and_overwide_rows_at_their_resolutio
         let d = stream(&doc, r).dict;
         (d.int(b"Width"), d.int(b"Height"))
     };
-    assert_eq!(size(text), (Some(600), Some(240)), "text");
+    assert_eq!(size(text), (Some(1200), Some(480)), "ambiguous dense text is retained conservatively");
     for (i, r) in halftones.iter().enumerate() {
         assert_eq!(size(*r), (Some(1200), Some(480)), "halftone {i}");
     }
@@ -1703,7 +1686,8 @@ fn a_fax_image_behind_a_decompression_bomb_is_left_alone() {
         let before = stream(&doc, img).raw;
         let r = optimize(&mut doc, &Settings::default()).unwrap();
         if padding == 0 {
-            assert_eq!(r.images_resampled, 1, "{r:?}");
+            assert_eq!(r.images_resampled, 0, "ambiguous local tones are retained: {r:?}");
+            assert_eq!(doc.decoded_image(&stream(&doc, img)).unwrap(), bilevel(w, h, false));
         } else {
             assert_eq!((r.images_resampled, r.images_recompressed), (0, 0), "{r:?}");
             assert_eq!(stream(&doc, img).raw, before);
@@ -3431,6 +3415,7 @@ fn indexed_thin_rules_keep_their_samples_for_both_palette_orders_and_decodes() {
     optimize(&mut gray, &Settings::default()).unwrap();
     let gray_stream = stream(&gray, gray_image);
     let gray_samples = gray.decoded_image(&gray_stream).unwrap();
+    assert_eq!((gray_stream.dict.int(b"Width"), gray_stream.dict.int(b"Height")), (Some(600), Some(240)));
     assert!(gray_samples.iter().any(|b| *b != 0xFF), "the DeviceGray thin rule survives");
     for white_first in [false, true] {
         for inverted in [false, true] {
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 0eb5ccb7fe..bdb0720dde 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -7137,7 +7137,6 @@ fn selected_existing_rows_keep_alignment_disabled_and_the_complete_paragraph() {
     assert_eq!(row_rect(&h, "nine"), last);
 }
 
-
 /// Clearing the selection restores ordinary whole-paragraph alignment and its undo step.
 #[test]
 fn whole_paragraph_alignment_stays_available_without_a_row_selection() {
@@ -7156,7 +7155,6 @@ fn whole_paragraph_alignment_stays_available_without_a_row_selection() {
     assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), None);
 }
 
-
 /// Redo after Undo in the box puts the typing back, in the box: it doesn't reach the document,
 /// whose own Redo (a formatting change waiting here) must stay waiting.
 #[test]
@@ -7189,7 +7187,6 @@ fn redo_after_undoing_typing_puts_the_typing_back() {
     assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
 }
 
-
 /// Redo from the menu or toolbar with typing in the box the page doesn't have yet. Closing the
 /// box first applied the typing, a new edit that dropped the document's waiting Redo, and the
 /// Redo itself then failed: the step was gone. The typing now stays in the box and the Redo
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index d4a06ba8fc..1404247cd7 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7384,7 +7384,7 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
-evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::black_and_white_images_above_450_ppi_are_averaged_down_to_300", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::ambiguous_monochrome_text_is_recompressed_without_lossy_reduction", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
 notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax, and eight-bit black-and-white grey and RGB, and indexed images that use only palette entries 0 and 1) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, halftones and dithers (most of their new pixels would cover both black and white, and their tones turn solid), or images wider than a fax row (1,048,576 samples), and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]

From 7fe33d1cbd1a71ce936d6452b226c3f79773366d Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 15:32:44 +0100
Subject: [PATCH 250/270] test: verify conservative review fixes across
 rendering and automation

---
 crates/automation/tests/it/automation.rs | 21 ++++++++---------
 crates/engine/src/tests.rs               |  9 +++++++-
 crates/optimize/tests/optimize.rs        | 29 ++++++++++--------------
 3 files changed, 29 insertions(+), 30 deletions(-)

diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index abfd441d34..6a5765b911 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -9780,24 +9780,21 @@ fn added_text_lines_take_their_own_alignments() {
     assert!(a.call("content_update", &json!({"doc":id,"page":1,"index":1,"aligns":"right"})).is_err());
 }
 
-/// `aligns` alone on an existing paragraph aligns its rows by index, as the app does: the rows
-/// stay rows instead of being rewrapped into one, where only the first entry would count.
+/// Existing-row alignment is withheld until its intent survives later editing sessions.
 #[test]
-fn text_edit_aligns_alone_aligns_the_paragraphs_rows() {
+fn text_edit_row_alignment_is_refused_without_changing_existing_text() {
     let dir = workdir("paragraph-row-aligns");
     let body = "BT /F1 12 Tf 14.4 TL 1 0 0 1 72 700 Tm (The quick brown fox jumps over the lazy dog) Tj T* (and keeps running.) Tj ET";
     std::fs::write(dir.join("rows.pdf"), win_ansi_paragraph_pdf(body)).unwrap();
     let mut a = auto(&dir);
     let doc = ok(&mut a, "doc_open", json!({ "path": "rows.pdf" }))["doc"].as_u64().unwrap();
-    ok(&mut a, "text_edit", json!({ "doc": doc, "page": 1, "paragraph": 1, "aligns": [null, "right"] }));
-    let lines = ok(&mut a, "text_lines", json!({ "doc": doc, "page": 1 }));
-    let rect = |t: &str| -> Vec<f64> {
-        let line = lines["lines"].as_array().unwrap().iter().find(|l| l["text"] == t).unwrap_or_else(|| panic!("{t:?} is a row: {lines}"));
-        line["rect"].as_array().unwrap().iter().map(|v| v.as_f64().unwrap()).collect()
-    };
-    let (first, second) = (rect("The quick brown fox jumps over the lazy dog"), rect("and keeps running."));
-    assert!((first[0] - 72.0).abs() < 0.5, "the first row stays at the left: {first:?}");
-    assert!((second[2] - first[2]).abs() < 1.0 && second[0] > 100.0, "the second row is right-aligned: {second:?} vs {first:?}");
+    let before = ok(&mut a, "text_lines", json!({ "doc": doc, "page": 1 }));
+    let refused = err(&mut a, "text_edit", json!({ "doc": doc, "page": 1, "paragraph": 1, "aligns": [null, "right"] }));
+    assert!(matches!(&refused, ToolError::Failed(m) | ToolError::InvalidArgs(m) if m.contains("selected-row alignment")), "{refused:?}");
+    assert_eq!(ok(&mut a, "text_lines", json!({ "doc": doc, "page": 1 })), before);
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "unchanged.pdf" }));
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "unchanged.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "text_lines", json!({ "doc": reopened, "page": 1 })), before);
 }
 
 /// An editable combo box (ISO 32000-2 Table 233, Edit) takes a value that isn't one of its
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 5db12eda04..833fa16b9f 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -9304,7 +9304,14 @@ fn repeated_backdrop_artwork_survives_background_undo_redo_and_both_save_modes()
     let mut s = Session::new();
     let id = s.open("shared-backdrop.pdf", None, Arc::new(bytes), None).unwrap();
     let black = |s: &Session, id| {
-        let rgba = pixel(s, id, 0, 30, 70);
+        let doc = s.get(id).unwrap();
+        let mut renderer = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), doc.config.clone());
+        let out = renderer.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+        assert!(out.error.is_none(), "{:?}", out.error);
+        assert_eq!((out.width, out.height), (100, 100));
+        // PDF point (30, 30), inside the later black square, in top-down raster coordinates.
+        let i = ((70 * out.width + 30) * 4) as usize;
+        let rgba = &out.rgba[i..i + 4];
         assert!(rgba[0] < 20 && rgba[1] < 20 && rgba[2] < 20, "later artwork survives: {rgba:?}");
     };
     black(&s, id);
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 0f2f1e1f4a..00b2dc2db5 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1450,16 +1450,11 @@ fn black_and_white_rgb_in_resources_its_page_tree_and_a_form_share_becomes_grey(
     }
 }
 
-/// Black-and-white images above 450 ppi are averaged down to 300 ppi, by default: 1-bit Flate, CCITT
-/// Group 4 (alone and behind ASCIIHexDecode), an image mask (its inverting decode array stays), and
-/// eight-bit grey and RGB of only black and white (the RGB also the other way round, with a decode
-/// array that inverts it, so its ties are 1s), all drawn at 600 ppi, are stored at half the size (as
-/// Group 4, or 1-bit Flate when that is smaller, as it is on this clean text), each new pixel the
-/// majority of the 2 × 2 it covers (a tie black, or for the mask painted). Left at their size: an image at 400 ppi (stored
-/// again as Group 4), a Group 4 one at 400 ppi (not even decoded), one behind ASCIIHexDecode at
-/// 400 ppi (stored again as Group 4 alone), and one with a soft mask. The page looks the same at
-/// screen size. With `downsample` off nothing is resampled; with Retain, Flate stays Flate, CCITT
-/// stays CCITT, and eight-bit grey and RGB are left to the grey and colour settings.
+/// Dense local mixed-sample patches are retained conservatively by the monochrome settings.
+/// One-bit Flate, CCITT and masks preserve samples; eight-bit bilevel inputs may be packed
+/// losslessly. Disable the independent gray/color reduction for the exact-render comparison:
+/// those settings can otherwise choose smaller grayscale/JPEG output for eight-bit sources.
+/// The Retain case separately checks that gray/color reduction remains available.
 #[test]
 fn ambiguous_monochrome_text_is_recompressed_without_lossy_reduction() {
     let mut doc = Document::new_empty();
@@ -1576,7 +1571,7 @@ fn ambiguous_monochrome_text_is_recompressed_without_lossy_reduction() {
 
     let untouched = [fax_at_400].map(|r| raw(&doc, r));
     let hex_len = raw(&doc, hex_at_400).len();
-    let r = optimize(&mut doc, &Settings::default()).unwrap();
+    let r = optimize(&mut doc, &Settings { gray: keep, color: keep, ..Settings::default() }).unwrap();
     assert_eq!((r.images_resampled, r.images_recompressed), (0, 9), "{r:?}");
     assert_eq!(stream(&doc, rgb).dict.get(b"ColorSpace"), Some(&Object::name("DeviceGray")));
     for i in [flate, fax, mask, eight, hex_fax, rgb] {
@@ -1607,9 +1602,8 @@ fn ambiguous_monochrome_text_is_recompressed_without_lossy_reduction() {
 /// Monochrome downsampling leaves a halftone or a dither at its resolution, as most new pixels
 /// would cover both black and white and taking the sample covering more would turn its tones
 /// solid: a 50% checkerboard, a 25% ordered dither and an error-diffused one, each at 600 ppi.
-/// Text at 600 ppi, which covers both only along its edges, is averaged down. Rows no wider than
-/// a fax row (`MAX_CCITT_COLUMNS`) are averaged down too, but not one column wider: the averaging
-/// keeps a counter for each column.
+/// Dense ragged text is retained too. Rows wider than a fax row (`MAX_CCITT_COLUMNS`)
+/// are never averaged: the averaging keeps a counter for each column.
 #[test]
 fn monochrome_downsampling_leaves_halftones_and_overwide_rows_at_their_resolution() {
     let (w, h) = (1200u32, 480u32);
@@ -1721,8 +1715,8 @@ fn g4_image(doc: &mut Document, bits: &[u8], (w, h): (u32, u32), hex: bool) -> O
 
 /// What Monochrome Images leaves alone and what it may still do. A Group 4 halftone above 450 ppi
 /// isn't resampled, so it stays byte for byte: alone, by default; behind ASCIIHexDecode, with
-/// Retain (by default it is stored again as Group 4 alone). Under Retain a resampled Flate scan
-/// stays Flate though Group 4 would be smaller. A busy Group 4 image behind ASCIIHexDecode, whose
+/// Retain (by default it is stored again as Group 4 alone). Under Retain an ambiguous Flate scan
+/// keeps its bytes and resolution though Group 4 would be smaller. A busy Group 4 image behind ASCIIHexDecode, whose
 /// code is more than three times its raster, decodes within a fax code's bound and is stored
 /// again as Group 4 alone. Sixteen-bit grey of only 0x0000 and 0xFFFF isn't eight-bit black and
 /// white, and keeps its bytes.
@@ -1789,7 +1783,8 @@ fn monochrome_images_keep_what_they_should() {
     let r = optimize(&mut doc, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
     assert_eq!(raw(&doc, wrapped), before, "Retain: a wrapped Group 4 halftone stays as it is");
     let s = stream(&doc, scan);
-    assert_eq!((s.dict.int(b"Width"), s.dict.name(b"Filter")), (Some(600), Some(&b"FlateDecode"[..])), "Retain: Flate stays Flate: {r:?}");
+    assert_eq!((s.dict.int(b"Width"), s.dict.name(b"Filter")), (Some(1200), Some(&b"FlateDecode"[..])), "Retain: {r:?}");
+    assert_eq!(doc.decoded_image(&s).unwrap(), ragged, "Retain preserves every sample");
 }
 
 /// `rows` coded as CCITT Group 3, one-dimensional (`/K 0`): each row its runs in turn, white first,

From 6772772440d3b2c781624ce8a7ed33e7c38839a3 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 15:52:18 +0100
Subject: [PATCH 251/270] test: accept preserved CCITT filter arrays in
 lossless regression

---
 crates/optimize/tests/optimize.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 00b2dc2db5..2e3ea2d42f 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1577,7 +1577,7 @@ fn ambiguous_monochrome_text_is_recompressed_without_lossy_reduction() {
     for i in [flate, fax, mask, eight, hex_fax, rgb] {
         let s = stream(&doc, i);
         assert_eq!((size(&doc, i), s.dict.int(b"BitsPerComponent")), ((1200, 480), if i == mask { None } else { Some(1) }));
-        assert!(matches!(s.dict.name(b"Filter"), Some(b"CCITTFaxDecode" | b"FlateDecode")), "{i:?}");
+        assert!(matches!(s.filters().as_slice(), [(Filter::CcittFax | Filter::Flate, _)]), "{i:?}");
         assert_eq!(doc.decoded_image(&s).unwrap(), text.clone(), "{i:?}");
     }
     assert_eq!(stream(&doc, mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");

From a57095c872b903a6dae598c9b353cbcd667a37f4 Mon Sep 17 00:00:00 2001
From: songzhihui <song19891121@qq.com>
Date: Sat, 31 Oct 2026 01:39:00 +0800
Subject: [PATCH 252/270] M2: assert exact GBK glyph rasters for installed
 Chinese families

---
 ROADMAP.md                                   |  3 +
 crates/render/src/raster/tests.rs            |  7 +++
 crates/render/src/raster/tests/gbk_glyphs.rs | 60 ++++++++++++++++++++
 docs/roadmap.md                              |  4 +-
 4 files changed, 73 insertions(+), 1 deletion(-)
 create mode 100644 crates/render/src/raster/tests/gbk_glyphs.rs

diff --git a/ROADMAP.md b/ROADMAP.md
index d30325d3e3..76e86471b6 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,5 +1,6 @@
 # PdfCraft roadmap
 
+> **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: GBK rasters compared with explicit Unicode and independently selected installed faces; wrong-glyph and wrong-family negative controls fail; estimates unchanged)
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: integrate main fa5f9f8c; retain CJK viewer and upstream raster regressions, restore explicit display_config imports; estimates unchanged)
 > **Last reviewed:** 2026-10-28 · **Last updated:** 2026-10-28 · **Change:** patch (M2, PR #4172: integrate main 5af10276; retain both roadmap histories and viewer-only CJK font policy; estimates unchanged)
 > **Last reviewed:** 2026-10-27 · **Last updated:** 2026-10-27 · **Change:** patch (M2, PR #4172: integrate main 1dd2737b; preserve viewer-only CJK fallback and regression coverage across engine, renderer and Combine module splits; estimates unchanged)
@@ -212,6 +213,8 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 ## Progress log
 
+- **2026-10-31 (M2, PR #4172 review):** Added same-machine pixel oracles for GBK Song, Hei, Kai and FangSong, including all four subset-prefixed Founder aliases. Reference PDFs use explicit Unicode mappings and independently selected installed faces; font data and rasters remain in memory. All eight cases ran; wrong-glyph and wrong-family production mutations each failed the new assertion and were restored. Validation: 422 renderer unit tests, renderer all-target Clippy with -D warnings, formatting, layers/assets/parity and renderer WASM checks passed; existing optional-patch/WASM warnings and parity notes remain. Estimates unchanged.
+
 - **2026-10-31 (M2, PR #4172):** Integrated main fa5f9f8c, retaining both roadmap histories and raster regression groups. Restored display_config and thumbnail_config imports after the upstream explicit-import migration. Validation: 422 renderer unit tests, engine/UI all-target checks, scoped all-target Clippy with -D warnings, formatting, layers, assets, parity and renderer/engine WASM checks passed. Existing optional-patch/WASM warnings and parity notes remain; no full engine/UI runtime test rerun. Display-only font policy and estimates unchanged.
 
 - **2026-10-28 (M2, PR #4172):** Integrated main 5af10276, preserving both roadmap histories and reviewing auto-merged export tests and accessibility UI changes. Validation: 488 scoped tests passed (18 engine, 412 renderer unit, 43 renderer integration, 15 Combine; one existing renderer integration test ignored); scoped all-target Clippy with -D warnings, formatting, layers, assets, parity and renderer/engine WASM checks passed. Viewer-only CJK fallback and print/output font policy remain unchanged; estimates unchanged.
diff --git a/crates/render/src/raster/tests.rs b/crates/render/src/raster/tests.rs
index 4741b7fd63..df6896b980 100644
--- a/crates/render/src/raster/tests.rs
+++ b/crates/render/src/raster/tests.rs
@@ -7040,6 +7040,9 @@ fn test_clip_only_text_raster_preserves_clipping_without_painting() {
     assert!(pixels.contains(&white), "the clip is text-shaped, not the whole page");
 }
 
+#[cfg(target_os = "windows")]
+mod gbk_glyphs;
+
 /// Chinese and Korean CID fonts that aren't embedded (Adobe-CNS1 `MSung-Light`, Adobe-GB1
 /// `STSong-Light`, Adobe-Korea1 `HYGoThic-Medium`; Acrobat also writes Japanese `KozGoPr6N`
 /// text boxes without the font) drew nothing, because craft-fonts has only Japanese faces.
@@ -7061,6 +7064,8 @@ fn non_embedded_chinese_and_korean_cid_fonts_draw_with_an_installed_face() {
         ("KaiTi", CidFamily::AdobeGB1, "GB1", "GBK-EUC-H", "D6D0CEC4", "CIDFontType2"),
         ("FangSong", CidFamily::AdobeGB1, "GB1", "GBK-EUC-H", "D6D0CEC4", "CIDFontType2"),
         ("ABCDEF+FZSSK--GBK1-0", CidFamily::AdobeGB1, "GB1", "GBK-EUC-H", "D6D0CEC4", "CIDFontType2"),
+        ("ABCDEF+FZHTK--GBK1-0", CidFamily::AdobeGB1, "GB1", "GBK-EUC-H", "D6D0CEC4", "CIDFontType2"),
+        ("ABCDEF+FZKTK--GBK1-0", CidFamily::AdobeGB1, "GB1", "GBK-EUC-H", "D6D0CEC4", "CIDFontType2"),
         ("ABCDEF+FZFSK--GBK1-0", CidFamily::AdobeGB1, "GB1", "GBK-EUC-H", "D6D0CEC4", "CIDFontType2"),
     ];
     for (base_font, family, ordering, encoding, code, subtype) in cases {
@@ -7105,6 +7110,8 @@ trailer << /Root 1 0 R >>
         let saved = ink(RenderConfig::default());
         assert!(saved < 50, "{base_font}: not drawn without system_fonts ({saved} dark pixels)");
         if encoding == "GBK-EUC-H" {
+            #[cfg(target_os = "windows")]
+            gbk_glyphs::assert_expected_glyphs(&pdf, base_font);
             let mut renderer = PageRenderer::new(pdf, RenderConfig { system_fonts: true, ..Default::default() });
             let text = renderer.render(RenderRequest { page: 0, kind: RequestKind::Text, ..Default::default() });
             assert!(text.error.is_none(), "{base_font}: {:?}", text.error);
diff --git a/crates/render/src/raster/tests/gbk_glyphs.rs b/crates/render/src/raster/tests/gbk_glyphs.rs
new file mode 100644
index 0000000000..8443fed624
--- /dev/null
+++ b/crates/render/src/raster/tests/gbk_glyphs.rs
@@ -0,0 +1,60 @@
+//! A same-machine pixel oracle, independent of GBK decoding and installed-face selection.
+//! All font reads and reference rasters stay in memory; nothing is embedded or published.
+
+use super::*;
+use hayro::hayro_interpret::font::FontData;
+use skrifa::MetadataProvider as _;
+use skrifa::string::StringId;
+
+/// Compare the real GBK PDF path with explicit Unicode and a known installed face. Unlike an
+/// ink count or extracted text, this fails if drawing chooses another glyph or font family.
+pub(super) fn assert_expected_glyphs(pdf: &Arc<Vec<u8>>, base_font: &str) {
+    let (expected, file) = match base_font {
+        "SimSun" | "ABCDEF+FZSSK--GBK1-0" => ("SimSun", "simsun.ttc"),
+        "SimHei" | "ABCDEF+FZHTK--GBK1-0" => ("SimHei", "simhei.ttf"),
+        "KaiTi" | "ABCDEF+FZKTK--GBK1-0" => ("KaiTi", "simkai.ttf"),
+        "FangSong" | "ABCDEF+FZFSK--GBK1-0" => ("FangSong", "simfang.ttf"),
+        other => panic!("no independent GBK oracle for {other}"),
+    };
+    // Do not use the production candidate list, resolver or face-selection helpers here.
+    let directory = std::env::var_os("WINDIR").or_else(|| std::env::var_os("SystemRoot")).unwrap_or_else(|| r"C:\Windows".into());
+    let path = std::path::PathBuf::from(directory).join("Fonts").join(file);
+    if !path.is_file() {
+        eprintln!("{base_font}: exact {expected} face unavailable; pixel oracle skipped");
+        return;
+    }
+    let bytes = Arc::new(std::fs::read(path).expect("read installed reference font"));
+    let index = (0..32)
+        .find(|&index| {
+            skrifa::FontRef::from_index(&bytes, index)
+                .is_ok_and(|font| font.localized_strings(StringId::POSTSCRIPT_NAME).any(|name| name.chars().collect::<String>() == expected))
+        })
+        .expect("reference file contains the expected PostScript face");
+    let face = skrifa::FontRef::from_index(&bytes, index).unwrap();
+    for character in ['\u{4e2d}', '\u{6587}'] {
+        assert!(face.charmap().map(character).is_some_and(|id| id.to_u32() != 0), "{expected} must contain {character}");
+    }
+
+    // Explicit ToUnicode maps arbitrary reference codes to U+4E2D and U+6587, bypassing GBK
+    // and Adobe-GB1 CID lookup. The fixed resolver below bypasses family classification too.
+    let cmap = "begincmap /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespacerange \
+                2 beginbfchar <0001> <4E2D> <0002> <6587> endbfchar endcmap";
+    let source = std::str::from_utf8(pdf).unwrap();
+    assert!(source.contains("/Encoding /GBK-EUC-H") && source.contains("<D6D0CEC4>"));
+    let reference = source
+        .replace("/Encoding /GBK-EUC-H", "/Encoding /Identity-H /ToUnicode 8 0 R")
+        .replace("<D6D0CEC4>", "<00010002>")
+        .replace("trailer <<", &format!("8 0 obj << /Length {} >> stream\n{cmap}\nendstream endobj\ntrailer <<", cmap.len()));
+    let parsed = Pdf::new(Arc::new(reference.into_bytes())).unwrap();
+    let data: FontData = bytes;
+    let settings = InterpreterSettings { font_resolver: Arc::new(move |_| Some((data.clone(), index))), ..Default::default() };
+    let reference = hayro::render(&parsed.pages()[0], &RenderCache::new(), &settings, &RenderSettings { bg_color: WHITE, ..Default::default() });
+    let mut renderer = PageRenderer::new(pdf.clone(), RenderConfig::default().on_screen());
+    let actual = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    assert!(actual.error.is_none(), "{base_font}: {:?}", actual.error);
+    let expected_pixels = reference.data_as_u8_slice();
+    assert_eq!(actual.rgba.len(), expected_pixels.len());
+    assert!(expected_pixels.as_chunks::<4>().0.iter().filter(|pixel| pixel[0] < 128).count() > 300, "reference must draw two visible glyphs");
+    assert!(actual.rgba.as_ref() == expected_pixels, "{base_font}: GBK raster must draw the exact {expected} glyphs for U+4E2D U+6587");
+    eprintln!("{base_font}: exact {expected} Unicode-reference pixels matched");
+}
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 7c30577652..12161c4dff 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,5 +1,6 @@
 # PdfCraft roadmap: milestones and what's next
 
+> **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: GBK rasters compared with explicit Unicode and independently selected installed faces; wrong-glyph and wrong-family negative controls fail; estimates unchanged)
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: integrate main fa5f9f8c; retain CJK viewer and upstream raster regressions, restore explicit display_config imports; estimates unchanged)
 > **Last reviewed:** 2026-10-28 · **Last updated:** 2026-10-28 · **Change:** patch (M2, PR #4172: integrate main 5af10276; retain both roadmap histories and viewer-only CJK font policy; estimates unchanged)
 > **Last reviewed:** 2026-10-27 · **Last updated:** 2026-10-27 · **Change:** patch (M2, PR #4172: integrate main 1dd2737b; preserve viewer-only CJK fallback and regression coverage across engine, renderer and Combine module splits; estimates unchanged)
@@ -190,7 +191,7 @@ total matches the parity estimate.
 |---|---|---|---|---|---|
 | M0 | Skeleton: workspace, xtask gates, CI | 15–30 | 98% | 1–2 | GitHub workflow, `deny.toml` (licence audit of every dependency), parity checklist (826 features, `xtask parity`) done. Missing: remaining crate stubs, testkit/oracle crates |
 | M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 80% | 20–40 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. An unchanged incremental save of a classic table writes a zero-length cross-reference subsection instead of a section with no subsections (#1339). A full rewrite keeps unknown trailer entries, including objects reachable only from them (#1338). Fuzzing runs nightly (`xtask fuzz`). Raw-deflate fallback preserves decoding-limit errors, including through tolerant COS stream decoding. Done since: #2658: macOS atomic saves retain destination extended attributes, including Finder tags, and reject partial resource-fork reads after size changes. Metadata failures retain the original PDF and unsaved edit. Missing: ≥ 250 tests, own image codecs |
-| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized. Forms without Resources use page Properties for ActualText and layer visibility; own dictionaries stop fallback. Oversized missing inline-image samples, including header and terminator overhead, no longer pin the content window (#3107 / PR #3438); normal large streamed images retain deterministic sample boundaries. Radial luminosity fades have synthetic coverage for the existing #2132 mask guard, including per-pixel references, antialiased clips, previews, scales and tiles; no additional production fix was needed. Dotted TOC leaders no longer inflate letter tracking or hide word spaces (#3086); phrase search and selection are covered. Short tracked ellipses retain their gap samples and remain searchable. Missing spacing glyphs in non-embedded Japanese CID substitutes render blank without changing PDF advances or Unicode (#3601). The desktop viewer can use installed CJK fonts, including Windows GBK Song/Hei/Kai/FangSong and subset-prefixed Founder names; Combine thumbnails and accessibility figure previews use the same display-only fallback, without changing export or print font policy (#234, continuation of #1567, review #4172). Print previews exclude installed faces and isolate their font cache; GBK regressions cover view/print switching for inline and pooled whole-page/tile rendering. Installed-font helpers and their regression contracts have function documentation. Integration with main fa5f9f8c retains viewer fallback across the split engine session modules, renderer tests and Combine thumbnail workers. |
+| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized. Forms without Resources use page Properties for ActualText and layer visibility; own dictionaries stop fallback. Oversized missing inline-image samples, including header and terminator overhead, no longer pin the content window (#3107 / PR #3438); normal large streamed images retain deterministic sample boundaries. Radial luminosity fades have synthetic coverage for the existing #2132 mask guard, including per-pixel references, antialiased clips, previews, scales and tiles; no additional production fix was needed. Dotted TOC leaders no longer inflate letter tracking or hide word spaces (#3086); phrase search and selection are covered. Short tracked ellipses retain their gap samples and remain searchable. Missing spacing glyphs in non-embedded Japanese CID substitutes render blank without changing PDF advances or Unicode (#3601). The desktop viewer can use installed CJK fonts, including Windows GBK Song/Hei/Kai/FangSong and subset-prefixed Founder names; Combine thumbnails and accessibility figure previews use the same display-only fallback, without changing export or print font policy (#234, continuation of #1567, review #4172). Print previews exclude installed faces and isolate their font cache; GBK regressions cover view/print switching for inline and pooled whole-page/tile rendering. Installed-font helpers and their regression contracts have function documentation. GBK regression rasters match explicit-Unicode references with independently selected installed faces; wrong-glyph and wrong-family negative controls fail. Integration with main fa5f9f8c retains viewer fallback across the split engine session modules, renderer tests and Combine thumbnail workers. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. The renderer keeps its one-point crop-size floor in physical points after UserUnit scaling, with regression coverage for crop origins, rotations and f32 reciprocal rounding. Existing unit policy and nearly-zero fallback are retained. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). #3808: the Pages inspector offers a 50–150% thumbnail slider and buttons, also available through `ui.set`. Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. #3149: page-list changes discard render demand based on old geometry; actual raster dimensions are checked against the GPU limit before upload. Synthetic crash and continued-rendering regressions cover the replacement path. Save-prompt shortcuts yield to dialogs above them; stacked link-consent UI regression covers Escape and Return. Comment hover follows individual marked lines and original annotation paint order (#3541/#3620), independently of spatial inspection sorting; synthetic rotation, differing-upper-edge overlap and unchanged-document regressions. Optional page gaps join page edges without cropping PDF margins; current-document toggle, persisted default and UI control options are covered by viewer tests. Gap changes in Organize Pages preserve document scroll position, and both comparison panes follow menu and control choices. Repeated window resizes by an edge and moves by the tab strip on GNOME/Wayland work without a click in between. |
@@ -289,6 +290,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-31 | patch | M2, PR #4172: eight GBK font/alias cases compare exact pixels with independent installed-face and explicit-Unicode references; wrong-glyph and wrong-family negative controls fail. Estimates unchanged. |
 | 2026-10-31 | patch | M2, PR #4172: integrate main fa5f9f8c, preserve both raster test groups and restore explicit display_config imports; display-only CJK policy and estimates unchanged. |
 | 2026-10-28 | patch | M2, PR #4172: integrate main 5af10276 and retain both roadmap histories; viewer-only CJK and print/output font policies and estimates unchanged. |
 | 2026-10-24 | minor | M11: the PDF Optimizer and Reduce File Size store Group 3 fax images as Group 4 when smaller (`Document::fax_params`), and pack eight-bit `DeviceRGB` of only black and white (as grey) and indexed images of 2, 4 or 8 bits that use only palette entries 0 and 1 (keeping the palette) to one bit, so Monochrome Images compresses and downsamples them. Estimates unchanged. |

From ec33924e80aad66d09c06105e169840b6d5dab57 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Fri, 30 Oct 2026 20:12:04 -0400
Subject: [PATCH 253/270] fix(flatpak): allow reading launcher version pins
 (#5490)

* fix(flatpak): allow reading launcher version pins

* fix(flatpak): allow reading launcher version pins
---
 packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml | 1 +
 packaging/linux/flatpak/ai.storyteller.pdfcraft.yml        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
index fcfb8183cc..c5e4021310 100644
--- a/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
+++ b/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
@@ -17,6 +17,7 @@ runtime-version: '25.08'
 sdk: org.freedesktop.Sdk
 command: pdfcraft
 finish-args:
+  - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland
   - --socket=fallback-x11
diff --git a/packaging/linux/flatpak/ai.storyteller.pdfcraft.yml b/packaging/linux/flatpak/ai.storyteller.pdfcraft.yml
index 0d0c25949c..5d30c5a4e3 100644
--- a/packaging/linux/flatpak/ai.storyteller.pdfcraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.pdfcraft.yml
@@ -18,6 +18,7 @@ sdk-extensions:
   - org.freedesktop.Sdk.Extension.rust-stable
 command: pdfcraft
 finish-args:
+  - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland
   - --socket=fallback-x11

From 4b70916883ce217de7895cdb9f7d30ea79326972 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <brandon@storyteller.ai>
Date: Fri, 30 Oct 2026 23:22:50 -0400
Subject: [PATCH 254/270] Flatpak bundle: skip the debuginfo pass for
 cups-client (runner has no eu-strip)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
index c5e4021310..15719a2179 100644
--- a/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
+++ b/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
@@ -51,6 +51,10 @@ modules:
   # the socket path matches the host's, which --socket=cups mounts.
   - name: cups-client
     buildsystem: simple
+    # The release runner's flatpak-builder has no eu-strip (elfutils), which the debuginfo pass
+    # runs on every binary this module compiles.
+    build-options:
+      no-debuginfo: true
     build-commands:
       - ./configure --prefix=/app --sysconfdir=/etc --localstatedir=/var --with-rundir=/run/cups
         --with-domainsocket=/run/cups/cups.sock --disable-shared --with-components=libcups

From 8f16855097883aca144a4562b0eeff0d1d28856e Mon Sep 17 00:00:00 2001
From: Brandon Thomas <brandon@storyteller.ai>
Date: Fri, 30 Oct 2026 23:22:57 -0400
Subject: [PATCH 255/270] Release 0.16.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock | 72 +++++++++++++++++++++++++++---------------------------
 Cargo.toml | 68 +++++++++++++++++++++++++--------------------------
 2 files changed, 70 insertions(+), 70 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index cfcb9dc362..1018013fc9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4207,7 +4207,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "chrono",
  "craft-update",
@@ -4231,7 +4231,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-a11y"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -4243,7 +4243,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-annot"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -4254,7 +4254,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-audit"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -4265,7 +4265,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-automation"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "base64 0.23.1",
  "flate2",
@@ -4287,7 +4287,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-cli"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "base64 0.23.1",
  "pdfcraft-audit",
@@ -4305,11 +4305,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-compare"
-version = "0.15.0"
+version = "0.16.0"
 
 [[package]]
 name = "pdfcraft-content"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -4317,7 +4317,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-cos"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "chrono",
  "hayro-syntax",
@@ -4332,7 +4332,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-create"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "encoding_rs",
  "hayro-ccitt",
@@ -4352,7 +4352,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-crypt"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "aes",
  "md-5",
@@ -4364,7 +4364,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-edit"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "hayro-syntax",
  "kurbo 0.13.1",
@@ -4380,7 +4380,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-engine"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "chrono",
  "craft-docpath",
@@ -4422,14 +4422,14 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-export"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "flate2",
 ]
 
 [[package]]
 name = "pdfcraft-filters"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "fax",
  "flate2",
@@ -4442,7 +4442,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-fonts"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "harfrust",
  "pdfcraft-cos",
@@ -4452,7 +4452,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-forms"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4465,11 +4465,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-geom"
-version = "0.15.0"
+version = "0.16.0"
 
 [[package]]
 name = "pdfcraft-js"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "boa_engine",
  "chrono",
@@ -4477,7 +4477,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-measure"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-content",
@@ -4490,14 +4490,14 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-model"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "pdfcraft-cos",
 ]
 
 [[package]]
 name = "pdfcraft-ocr"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "ocrs",
  "pdfcraft-fonts",
@@ -4508,7 +4508,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-optimize"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "image",
  "pdfcraft-annot",
@@ -4524,11 +4524,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-oracle"
-version = "0.15.0"
+version = "0.16.0"
 
 [[package]]
 name = "pdfcraft-organize"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4539,7 +4539,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-platform"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "async-channel",
  "futures-lite",
@@ -4549,7 +4549,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-preflight"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "flate2",
  "pdfcraft-content",
@@ -4560,7 +4560,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-print"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "craft-print",
  "pdfcraft-content",
@@ -4572,7 +4572,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-redact"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-content",
@@ -4589,7 +4589,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-render"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "bytemuck",
  "flate2",
@@ -4608,7 +4608,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-sign"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "aes",
  "aws-lc-rs",
@@ -4644,11 +4644,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-testkit"
-version = "0.15.0"
+version = "0.16.0"
 
 [[package]]
 name = "pdfcraft-ui-egui"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "arboard",
  "base64 0.23.1",
@@ -4700,7 +4700,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-web"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "eframe",
  "egui",
@@ -4712,7 +4712,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-xfa"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "base64 0.23.1",
  "image",
@@ -4726,7 +4726,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-xfdf"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-cos",
diff --git a/Cargo.toml b/Cargo.toml
index 1b04ab5263..a64505405d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ exclude = ["vendor"]
 default-members = ["crates/*", "apps/pdfcraft", "apps/pdfcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.15.0"
+version = "0.16.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -26,39 +26,39 @@ craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-l
 # craft-update: app-specific pretend versions apply to startup and manual checks.
 craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "04aa1703b32d299e54f78fcde4182f2b393a9116", features = ["egui"] }
 # internal
-pdfcraft-geom = { path = "crates/geom", version = "0.15.0" }
-pdfcraft-filters = { path = "crates/filters", version = "0.15.0" }
-pdfcraft-cos = { path = "crates/cos", version = "0.15.0" }
-pdfcraft-crypt = { path = "crates/crypt", version = "0.15.0" }
-pdfcraft-organize = { path = "crates/organize", version = "0.15.0" }
-pdfcraft-measure = { path = "crates/measure", version = "0.15.0" }
-pdfcraft-annot = { path = "crates/annot", version = "0.15.0" }
-pdfcraft-audit = { path = "crates/audit", version = "0.15.0" }
-pdfcraft-fonts = { path = "crates/fonts", version = "0.15.0" }
-pdfcraft-model = { path = "crates/model", version = "0.15.0" }
-pdfcraft-content = { path = "crates/content", version = "0.15.0" }
-pdfcraft-redact = { path = "crates/redact", version = "0.15.0" }
-pdfcraft-print = { path = "crates/print", version = "0.15.0" }
-pdfcraft-xfdf = { path = "crates/xfdf", version = "0.15.0" }
-pdfcraft-sign = { path = "crates/sign", version = "0.15.0" }
-pdfcraft-optimize = { path = "crates/optimize", version = "0.15.0" }
-pdfcraft-a11y = { path = "crates/a11y", version = "0.15.0" }
-pdfcraft-oracle = { path = "crates/oracle", version = "0.15.0" }
-pdfcraft-testkit = { path = "crates/testkit", version = "0.15.0" }
-pdfcraft-ocr = { path = "crates/ocr", version = "0.15.0" }
-pdfcraft-js = { path = "crates/js", version = "0.15.0" }
-pdfcraft-compare = { path = "crates/compare", version = "0.15.0" }
-pdfcraft-preflight = { path = "crates/preflight", version = "0.15.0" }
-pdfcraft-export = { path = "crates/export", version = "0.15.0" }
-pdfcraft-edit = { path = "crates/edit", version = "0.15.0" }
-pdfcraft-create = { path = "crates/create", version = "0.15.0" }
-pdfcraft-forms = { path = "crates/forms", version = "0.15.0" }
-pdfcraft-xfa = { path = "crates/xfa", version = "0.15.0" }
-pdfcraft-render = { path = "crates/render", version = "0.15.0" }
-pdfcraft-engine = { path = "crates/engine", version = "0.15.0" }
-pdfcraft-platform = { path = "crates/platform", version = "0.15.0" }
-pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.15.0" }
-pdfcraft-automation = { path = "crates/automation", version = "0.15.0", default-features = false }
+pdfcraft-geom = { path = "crates/geom", version = "0.16.0" }
+pdfcraft-filters = { path = "crates/filters", version = "0.16.0" }
+pdfcraft-cos = { path = "crates/cos", version = "0.16.0" }
+pdfcraft-crypt = { path = "crates/crypt", version = "0.16.0" }
+pdfcraft-organize = { path = "crates/organize", version = "0.16.0" }
+pdfcraft-measure = { path = "crates/measure", version = "0.16.0" }
+pdfcraft-annot = { path = "crates/annot", version = "0.16.0" }
+pdfcraft-audit = { path = "crates/audit", version = "0.16.0" }
+pdfcraft-fonts = { path = "crates/fonts", version = "0.16.0" }
+pdfcraft-model = { path = "crates/model", version = "0.16.0" }
+pdfcraft-content = { path = "crates/content", version = "0.16.0" }
+pdfcraft-redact = { path = "crates/redact", version = "0.16.0" }
+pdfcraft-print = { path = "crates/print", version = "0.16.0" }
+pdfcraft-xfdf = { path = "crates/xfdf", version = "0.16.0" }
+pdfcraft-sign = { path = "crates/sign", version = "0.16.0" }
+pdfcraft-optimize = { path = "crates/optimize", version = "0.16.0" }
+pdfcraft-a11y = { path = "crates/a11y", version = "0.16.0" }
+pdfcraft-oracle = { path = "crates/oracle", version = "0.16.0" }
+pdfcraft-testkit = { path = "crates/testkit", version = "0.16.0" }
+pdfcraft-ocr = { path = "crates/ocr", version = "0.16.0" }
+pdfcraft-js = { path = "crates/js", version = "0.16.0" }
+pdfcraft-compare = { path = "crates/compare", version = "0.16.0" }
+pdfcraft-preflight = { path = "crates/preflight", version = "0.16.0" }
+pdfcraft-export = { path = "crates/export", version = "0.16.0" }
+pdfcraft-edit = { path = "crates/edit", version = "0.16.0" }
+pdfcraft-create = { path = "crates/create", version = "0.16.0" }
+pdfcraft-forms = { path = "crates/forms", version = "0.16.0" }
+pdfcraft-xfa = { path = "crates/xfa", version = "0.16.0" }
+pdfcraft-render = { path = "crates/render", version = "0.16.0" }
+pdfcraft-engine = { path = "crates/engine", version = "0.16.0" }
+pdfcraft-platform = { path = "crates/platform", version = "0.16.0" }
+pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.16.0" }
+pdfcraft-automation = { path = "crates/automation", version = "0.16.0", default-features = false }
 
 # pdf
 hayro = "0.7.1"

From 35c187ff1927b720da4d025bb746b3b445b839cc Mon Sep 17 00:00:00 2001
From: Brandon Thomas <brandon@storyteller.ai>
Date: Fri, 30 Oct 2026 23:25:35 -0400
Subject: [PATCH 256/270] Flatpak bundle: skip the debuginfo pass manifest-wide
 (runner has no eu-strip)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../linux/flatpak/ai.storyteller.pdfcraft.bundle.yml     | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
index 15719a2179..065945c6ea 100644
--- a/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
+++ b/packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml
@@ -45,16 +45,17 @@ finish-args:
   # Deliberately not granted: home/host filesystem access. No CUPS socket either: printing
   # runs the `lp` command (crates/print), which the freedesktop runtime doesn't ship, so Print
   # reports that the spooler is unavailable until it goes through the print portal.
+# The release runner's flatpak-builder has no eu-strip (elfutils), which its debuginfo pass runs
+# on cups-client's unstripped tools, in whichever module comes first after they're installed. The
+# app's own binaries come from the release tarball, already stripped.
+build-options:
+  no-debuginfo: true
 modules:
   # CUPS client tools for craft-print: the runtime has libcups but not lpstat/lp/lpoptions.
   # Linked statically against this release's libcups, so a runtime update can't break them;
   # the socket path matches the host's, which --socket=cups mounts.
   - name: cups-client
     buildsystem: simple
-    # The release runner's flatpak-builder has no eu-strip (elfutils), which the debuginfo pass
-    # runs on every binary this module compiles.
-    build-options:
-      no-debuginfo: true
     build-commands:
       - ./configure --prefix=/app --sysconfdir=/etc --localstatedir=/var --with-rundir=/run/cups
         --with-domainsocket=/run/cups/cups.sock --disable-shared --with-components=libcups

From 24bb85308e4b65404fc908506ade6341a29999d7 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <brandon@storyteller.ai>
Date: Fri, 30 Oct 2026 23:25:37 -0400
Subject: [PATCH 257/270] Release 0.16.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock | 72 +++++++++++++++++++++++++++---------------------------
 Cargo.toml | 68 +++++++++++++++++++++++++--------------------------
 2 files changed, 70 insertions(+), 70 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 1018013fc9..b29fd629b2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4207,7 +4207,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "chrono",
  "craft-update",
@@ -4231,7 +4231,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-a11y"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -4243,7 +4243,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-annot"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -4254,7 +4254,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-audit"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -4265,7 +4265,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-automation"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "base64 0.23.1",
  "flate2",
@@ -4287,7 +4287,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-cli"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "base64 0.23.1",
  "pdfcraft-audit",
@@ -4305,11 +4305,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-compare"
-version = "0.16.0"
+version = "0.16.1"
 
 [[package]]
 name = "pdfcraft-content"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -4317,7 +4317,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-cos"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "chrono",
  "hayro-syntax",
@@ -4332,7 +4332,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-create"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "encoding_rs",
  "hayro-ccitt",
@@ -4352,7 +4352,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-crypt"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "aes",
  "md-5",
@@ -4364,7 +4364,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-edit"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "hayro-syntax",
  "kurbo 0.13.1",
@@ -4380,7 +4380,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-engine"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "chrono",
  "craft-docpath",
@@ -4422,14 +4422,14 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-export"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "flate2",
 ]
 
 [[package]]
 name = "pdfcraft-filters"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "fax",
  "flate2",
@@ -4442,7 +4442,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-fonts"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "harfrust",
  "pdfcraft-cos",
@@ -4452,7 +4452,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-forms"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4465,11 +4465,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-geom"
-version = "0.16.0"
+version = "0.16.1"
 
 [[package]]
 name = "pdfcraft-js"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "boa_engine",
  "chrono",
@@ -4477,7 +4477,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-measure"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-content",
@@ -4490,14 +4490,14 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-model"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "pdfcraft-cos",
 ]
 
 [[package]]
 name = "pdfcraft-ocr"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "ocrs",
  "pdfcraft-fonts",
@@ -4508,7 +4508,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-optimize"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "image",
  "pdfcraft-annot",
@@ -4524,11 +4524,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-oracle"
-version = "0.16.0"
+version = "0.16.1"
 
 [[package]]
 name = "pdfcraft-organize"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4539,7 +4539,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-platform"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "async-channel",
  "futures-lite",
@@ -4549,7 +4549,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-preflight"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "flate2",
  "pdfcraft-content",
@@ -4560,7 +4560,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-print"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "craft-print",
  "pdfcraft-content",
@@ -4572,7 +4572,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-redact"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-content",
@@ -4589,7 +4589,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-render"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "bytemuck",
  "flate2",
@@ -4608,7 +4608,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-sign"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "aes",
  "aws-lc-rs",
@@ -4644,11 +4644,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-testkit"
-version = "0.16.0"
+version = "0.16.1"
 
 [[package]]
 name = "pdfcraft-ui-egui"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "arboard",
  "base64 0.23.1",
@@ -4700,7 +4700,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-web"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "eframe",
  "egui",
@@ -4712,7 +4712,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-xfa"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "base64 0.23.1",
  "image",
@@ -4726,7 +4726,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-xfdf"
-version = "0.16.0"
+version = "0.16.1"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-cos",
diff --git a/Cargo.toml b/Cargo.toml
index a64505405d..771f4c9611 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ exclude = ["vendor"]
 default-members = ["crates/*", "apps/pdfcraft", "apps/pdfcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.16.0"
+version = "0.16.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -26,39 +26,39 @@ craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-l
 # craft-update: app-specific pretend versions apply to startup and manual checks.
 craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "04aa1703b32d299e54f78fcde4182f2b393a9116", features = ["egui"] }
 # internal
-pdfcraft-geom = { path = "crates/geom", version = "0.16.0" }
-pdfcraft-filters = { path = "crates/filters", version = "0.16.0" }
-pdfcraft-cos = { path = "crates/cos", version = "0.16.0" }
-pdfcraft-crypt = { path = "crates/crypt", version = "0.16.0" }
-pdfcraft-organize = { path = "crates/organize", version = "0.16.0" }
-pdfcraft-measure = { path = "crates/measure", version = "0.16.0" }
-pdfcraft-annot = { path = "crates/annot", version = "0.16.0" }
-pdfcraft-audit = { path = "crates/audit", version = "0.16.0" }
-pdfcraft-fonts = { path = "crates/fonts", version = "0.16.0" }
-pdfcraft-model = { path = "crates/model", version = "0.16.0" }
-pdfcraft-content = { path = "crates/content", version = "0.16.0" }
-pdfcraft-redact = { path = "crates/redact", version = "0.16.0" }
-pdfcraft-print = { path = "crates/print", version = "0.16.0" }
-pdfcraft-xfdf = { path = "crates/xfdf", version = "0.16.0" }
-pdfcraft-sign = { path = "crates/sign", version = "0.16.0" }
-pdfcraft-optimize = { path = "crates/optimize", version = "0.16.0" }
-pdfcraft-a11y = { path = "crates/a11y", version = "0.16.0" }
-pdfcraft-oracle = { path = "crates/oracle", version = "0.16.0" }
-pdfcraft-testkit = { path = "crates/testkit", version = "0.16.0" }
-pdfcraft-ocr = { path = "crates/ocr", version = "0.16.0" }
-pdfcraft-js = { path = "crates/js", version = "0.16.0" }
-pdfcraft-compare = { path = "crates/compare", version = "0.16.0" }
-pdfcraft-preflight = { path = "crates/preflight", version = "0.16.0" }
-pdfcraft-export = { path = "crates/export", version = "0.16.0" }
-pdfcraft-edit = { path = "crates/edit", version = "0.16.0" }
-pdfcraft-create = { path = "crates/create", version = "0.16.0" }
-pdfcraft-forms = { path = "crates/forms", version = "0.16.0" }
-pdfcraft-xfa = { path = "crates/xfa", version = "0.16.0" }
-pdfcraft-render = { path = "crates/render", version = "0.16.0" }
-pdfcraft-engine = { path = "crates/engine", version = "0.16.0" }
-pdfcraft-platform = { path = "crates/platform", version = "0.16.0" }
-pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.16.0" }
-pdfcraft-automation = { path = "crates/automation", version = "0.16.0", default-features = false }
+pdfcraft-geom = { path = "crates/geom", version = "0.16.1" }
+pdfcraft-filters = { path = "crates/filters", version = "0.16.1" }
+pdfcraft-cos = { path = "crates/cos", version = "0.16.1" }
+pdfcraft-crypt = { path = "crates/crypt", version = "0.16.1" }
+pdfcraft-organize = { path = "crates/organize", version = "0.16.1" }
+pdfcraft-measure = { path = "crates/measure", version = "0.16.1" }
+pdfcraft-annot = { path = "crates/annot", version = "0.16.1" }
+pdfcraft-audit = { path = "crates/audit", version = "0.16.1" }
+pdfcraft-fonts = { path = "crates/fonts", version = "0.16.1" }
+pdfcraft-model = { path = "crates/model", version = "0.16.1" }
+pdfcraft-content = { path = "crates/content", version = "0.16.1" }
+pdfcraft-redact = { path = "crates/redact", version = "0.16.1" }
+pdfcraft-print = { path = "crates/print", version = "0.16.1" }
+pdfcraft-xfdf = { path = "crates/xfdf", version = "0.16.1" }
+pdfcraft-sign = { path = "crates/sign", version = "0.16.1" }
+pdfcraft-optimize = { path = "crates/optimize", version = "0.16.1" }
+pdfcraft-a11y = { path = "crates/a11y", version = "0.16.1" }
+pdfcraft-oracle = { path = "crates/oracle", version = "0.16.1" }
+pdfcraft-testkit = { path = "crates/testkit", version = "0.16.1" }
+pdfcraft-ocr = { path = "crates/ocr", version = "0.16.1" }
+pdfcraft-js = { path = "crates/js", version = "0.16.1" }
+pdfcraft-compare = { path = "crates/compare", version = "0.16.1" }
+pdfcraft-preflight = { path = "crates/preflight", version = "0.16.1" }
+pdfcraft-export = { path = "crates/export", version = "0.16.1" }
+pdfcraft-edit = { path = "crates/edit", version = "0.16.1" }
+pdfcraft-create = { path = "crates/create", version = "0.16.1" }
+pdfcraft-forms = { path = "crates/forms", version = "0.16.1" }
+pdfcraft-xfa = { path = "crates/xfa", version = "0.16.1" }
+pdfcraft-render = { path = "crates/render", version = "0.16.1" }
+pdfcraft-engine = { path = "crates/engine", version = "0.16.1" }
+pdfcraft-platform = { path = "crates/platform", version = "0.16.1" }
+pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.16.1" }
+pdfcraft-automation = { path = "crates/automation", version = "0.16.1", default-features = false }
 
 # pdf
 hayro = "0.7.1"

From 44ddb348a93741308b937996fc3deff5904d1cc1 Mon Sep 17 00:00:00 2001
From: aiongg <aiongtaigi@gmail.com>
Date: Sat, 31 Oct 2026 04:17:20 +0000
Subject: [PATCH 258/270] docs: tidy agent, contributor and asset docs

---
 AGENTS.md                             | 15 +++++---------
 ATTRIBUTION.md                        | 28 +++++++++++++--------------
 ATTRIBUTION.toml                      | 28 +++++++++++++--------------
 CLAUDE.md                             |  6 +++---
 ROADMAP.md                            |  4 ++--
 assets/app-icon/README.md             |  3 +--
 contributors/people.toml              |  7 ++-----
 crates/fonts/README.md                |  2 +-
 crates/ui-egui/build.rs               |  7 +++----
 crates/ui-egui/src/dialogs.rs         |  2 +-
 crates/ui-egui/src/dialogs/credits.rs |  2 +-
 docs/contributors.md                  | 25 ++++--------------------
 12 files changed, 51 insertions(+), 78 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 98758c5dbd..cd6c0e2ca5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,8 +2,6 @@
 
 These rules bind every AI agent and every human contributor working in this repository. They come before any task, instruction or deadline. `CLAUDE.md` holds the day-to-day working instructions. If the two ever disagree, **this file wins.**
 
-Some sections link to **craftrules**, the standards shared by the Crafting Apps. That repository is internal to the storytold team, so outside contributors can't open it. Every rule a contributor here must follow is stated in this file and `CLAUDE.md`; the craftrules links give team members the background.
-
 ---
 
 ## 1. Asset policy (absolute — no exceptions)
@@ -69,7 +67,7 @@ Anything else is forbidden, including assets whose licence you cannot prove from
 
 ### 1.4 Fonts live in craft-fonts
 
-- Font assets shared by the Crafting Apps, including every Japanese font, live in [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), not here. **Never commit a font file to this repository**; adding a font means adding it to craft-fonts. (The Latin UI fonts already in `assets/fonts/` — Inter, JetBrains Mono, Dancing Script — stay.) Team members: the shared rules are in [craftrules `standards/fonts.md`](https://github.com/storytold/craftrules/blob/main/standards/fonts.md) (internal).
+- Font assets shared by the Crafting Apps, including every Japanese font, live in [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), not here. **Never commit a font file to this repository**; adding a font means adding it to craft-fonts. (The Latin UI fonts already in `assets/fonts/` — Inter, JetBrains Mono, Dancing Script — stay.)
 - craft-fonts is an **optional build input**, never a Cargo dependency: `CRAFT_FONTS_DIR=<checkout> cargo build` makes `crates/fonts/build.rs` embed its fonts as `pdfcraft_fonts::CRAFT_FONTS`. Without it PdfCraft builds, tests and runs, but has no Japanese face (Japanese UI text shows replacement boxes, and writing Japanese into a PDF returns a clear error). Release builds always set it (`.github/workflows/release.yml`), and `ATTRIBUTION.toml` lists it as a `[[build_input]]`.
 - The desktop app may read one font **already installed on the user's machine** at runtime, as the last interface fallback for characters no embedded face has (`crates/ui-egui/src/system_fonts.rs`). That font is never embedded, shipped, committed or copied, and never appears in published screenshots (`PDFCRAFT_SYSTEM_FONTS=0`, which `cargo xtask screenshots` sets). It is not a way around §1.2: nothing from it may enter a PDF, a package or the repository.
 - The page viewer may also draw a CID font of an Adobe CJK collection (Japan1, GB1, CNS1, Korea1) that a PDF does **not embed** with one face already installed on the machine (`crates/render/src/system_font.rs`), **on screen only**. `RenderConfig::system_fonts` is off by default and is enabled only for on-screen viewer and preview rasters (`RenderConfig::on_screen`, used by the engine viewer, Combine thumbnails and accessibility figure previews), so exports, printing, OCR and the automation tools never use it. Like the interface font it is read at runtime and never embedded, shipped, committed or copied; Noto CJK and Source Han are never candidates (§1.1), nor is any Adobe family; and `PDFCRAFT_SYSTEM_FONTS=0` turns it off. It is not a way around §1.2 either: nothing drawn with it may be saved or printed.
@@ -93,7 +91,7 @@ If you find an asset that breaks these rules, stop and remove it from the reposi
 - Behaviour comes only from public specifications (ISO 32000-2, the Arlington model), public documentation and black-box observation.
 - Never copy GPL/AGPL code. Copyleft tools run only as external oracle processes.
 - Observe Acrobat only with synthetic fixtures. Never capture personal data, account information or recent files.
-- Shared real-file test oracles (Photoshop-authored PSDs, etc.) live in [`storytold/photocraft-corpus`](https://github.com/storytold/photocraft-corpus), explained in [craftrules `standards/test-corpora.md`](https://github.com/storytold/craftrules/blob/main/standards/test-corpora.md) (internal). Never commit large binary fixtures to this repo; fetch them pinned by commit and sha256-verified, as PhotoCraft does with `cargo xtask corpus`.
+- Shared real-file test oracles (Photoshop-authored PSDs, etc.) live in [`storytold/photocraft-corpus`](https://github.com/storytold/photocraft-corpus). Never commit large binary fixtures to this repo; fetch them pinned by commit and sha256-verified, as PhotoCraft does with `cargo xtask corpus`.
 
 ## 3. Agent control (automation and MCP)
 
@@ -106,7 +104,7 @@ If you find an asset that breaks these rules, stop and remove it from the reposi
 
 ## 4. Never crash
 
-PdfCraft opens files from strangers, and people trust it with their work. A malformed PDF, a bad tool argument, a corrupt settings file or a full disk must produce an error the user (or agent) can act on, never a crash and never lost work. **This outranks feature work:** don't ship a feature by adding a panic path, and fix a crash before building on top of it. The rules below are the ones that bind this repository; the shared standard for every Crafting App, [`craftrules/standards/never-crash.md`](https://github.com/storytold/craftrules/blob/main/standards/never-crash.md), is internal to the storytold team.
+PdfCraft opens files from strangers, and people trust it with their work. A malformed PDF, a bad tool argument, a corrupt settings file or a full disk must produce an error the user (or agent) can act on, never a crash and never lost work. **This outranks feature work:** don't ship a feature by adding a panic path, and fix a crash before building on top of it. The rules below are the ones that bind this repository.
 
 - **Fail with `Result`.** Non-test code returns errors through the crate's error type and `?`. Where readers are lenient by design, fall back gracefully and record the repair (see Fidelity in `CLAUDE.md`).
 - **No panicking shortcuts.** No `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!` or `unimplemented!` outside tests, unless the call is provably infallible (e.g. writing to a `Vec`), with a comment saying why. `assert!` only for internal invariants that input cannot reach.
@@ -125,20 +123,17 @@ Follow `CLAUDE.md`. It covers quality gates, layering, commit rules and how to r
 ## Contributor credits (About window)
 
 - About ▸ Contributors/Models are compiled into the binary from `contributors/contributors.json`
-  (commit stats; generated, never hand-edit) and `contributors/people.toml` (names people chose for
+  (commit stats; never hand-edit) and `contributors/people.toml` (names people chose for
   themselves). See `docs/contributors.md`.
 - **Agents working for a contributor:** when you prepare a PR, check whether your human's GitHub
   username has a `[people.<username>]` entry in `contributors/people.toml`. If not, ask them once
   whether they want to be credited by more than their username: a real name, a display name, and/or
   their public GitHub profile name (`sync_github_name = true`). If yes, add **only their own** entry
-  (copy the template at the top of the file, or run
-  `python3 ../../craftrules/scripts/contributors.py --add-me . --real-name "…" --sync-github-name`)
+  (copy the template at the top of the file)
   and include it in their PR, committed as them. If no, change nothing: they are credited as
   `@username` anyway.
 - Never add, edit, guess or copy anyone else's entry or name (not from git config, commit authors or
   GitHub profiles). Never hand-edit `contributors.json`.
-- Maintainers refresh the stats with `python3 ../../craftrules/scripts/contributors.py .` (it also
-  re-verifies who wrote each `people.toml` entry; `--check` only verifies).
 
 ## CI workflows
 - Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 23ebcbbe82..8da4b0a200 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -240,22 +240,22 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `docs/brand/artcraft-mark-black.svg` | ArtCraft brand: artcraft-mark-black | ArtCraft Team | LicenseRef-Storyteller-Trademark | ArtCraft Team brand assets (provided by the project owner, 2026-10-01; identical copies in storytold/photocraft) | ArtCraft branding next to the community links (About dialog, Help menu, home screen) and in docs. ArtCraft Team trademark, not open source; may be used only unmodified within PdfCraft; forks and modified versions must remove it. |
 | `docs/brand/artcraft-mark.png` | ArtCraft brand: artcraft-mark | ArtCraft Team | LicenseRef-Storyteller-Trademark | ArtCraft Team brand assets (provided by the project owner, 2026-10-01; identical copies in storytold/photocraft) | ArtCraft branding next to the community links (About dialog, Help menu, home screen) and in docs. ArtCraft Team trademark, not open source; may be used only unmodified within PdfCraft; forks and modified versions must remove it. |
 | `docs/brand/artcraft-mark.svg` | ArtCraft brand: artcraft-mark | ArtCraft Team | LicenseRef-Storyteller-Trademark | ArtCraft Team brand assets (provided by the project owner, 2026-10-01; identical copies in storytold/photocraft) | ArtCraft branding next to the community links (About dialog, Help menu, home screen) and in docs. ArtCraft Team trademark, not open source; may be used only unmodified within PdfCraft; forks and modified versions must remove it. |
-| `assets/app-icon/pdfcraft.svg` | PdfCraft app icon (master vector) | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Master artwork; every other app-icon file is rendered from it (packaging/icons.sh) |
-| `assets/app-icon/pdfcraft-small.svg` | PdfCraft app icon (light vector) | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | README header and assets/app-icon/README.md |
-| `assets/app-icon/pdfcraft-1024.png` | PdfCraft app icon, 1024 px on Apple's icon grid | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Runtime window/Dock icon on macOS (apps/pdfcraft/src/main.rs) |
-| `assets/app-icon/pdfcraft.icns` | PdfCraft app icon (macOS .icns) | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | macOS app bundle icon |
-| `assets/app-icon/pdfcraft.ico` | PdfCraft app icon (Windows .ico, 16-256 px) | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Embedded in pdfcraft.exe by apps/pdfcraft/build.rs (Explorer, taskbar, Start menu, Alt-Tab) |
+| `assets/app-icon/pdfcraft.svg` | PdfCraft app icon (master vector) | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Master artwork; every other app-icon file is rendered from it (packaging/icons.sh) |
+| `assets/app-icon/pdfcraft-small.svg` | PdfCraft app icon (light vector) | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | README header and assets/app-icon/README.md |
+| `assets/app-icon/pdfcraft-1024.png` | PdfCraft app icon, 1024 px on Apple's icon grid | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Runtime window/Dock icon on macOS (apps/pdfcraft/src/main.rs) |
+| `assets/app-icon/pdfcraft.icns` | PdfCraft app icon (macOS .icns) | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | macOS app bundle icon |
+| `assets/app-icon/pdfcraft.ico` | PdfCraft app icon (Windows .ico, 16-256 px) | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Embedded in pdfcraft.exe by apps/pdfcraft/build.rs (Explorer, taskbar, Start menu, Alt-Tab) |
 | `assets/app-icon/pdfcraft-document.svg` | PdfCraft PDF document icon (master vector) | Lucide Icons and Contributors (document outline); PdfCraft contributors (PDF badge, lettering and composition) | ISC AND (MIT OR Apache-2.0) | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg); contributor-original composition (assets/app-icon/README.md) | Master artwork for the Windows PDF file type icon; rendered by packaging/icons.sh, without fonts or external images |
 | `assets/app-icon/pdfcraft-document.ico` | PdfCraft PDF document icon (Windows .ico, 16-256 px) | Lucide Icons and Contributors (document outline); PdfCraft contributors (PDF badge, lettering and composition) | ISC AND (MIT OR Apache-2.0) | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg); contributor-original composition (assets/app-icon/README.md) | Embedded in pdfcraft.exe as resource 2; the Windows installer uses it for PdfCraft.Document and Applications/pdfcraft.exe PDF file associations |
-| `assets/app-icon/hicolor/16x16/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 16 px | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
-| `assets/app-icon/hicolor/24x24/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 24 px | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
-| `assets/app-icon/hicolor/32x32/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 32 px | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
-| `assets/app-icon/hicolor/48x48/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 48 px | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
-| `assets/app-icon/hicolor/64x64/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 64 px | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
-| `assets/app-icon/hicolor/128x128/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 128 px | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
-| `assets/app-icon/hicolor/256x256/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 256 px | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop); runtime window icon on Windows and Linux (apps/pdfcraft/src/main.rs) |
-| `assets/app-icon/hicolor/512x512/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 512 px | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
-| `assets/app-icon/hicolor/scalable/apps/ai.storyteller.pdfcraft.svg` | PdfCraft app icon (Linux scalable) | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
+| `assets/app-icon/hicolor/16x16/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 16 px | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
+| `assets/app-icon/hicolor/24x24/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 24 px | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
+| `assets/app-icon/hicolor/32x32/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 32 px | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
+| `assets/app-icon/hicolor/48x48/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 48 px | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
+| `assets/app-icon/hicolor/64x64/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 64 px | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
+| `assets/app-icon/hicolor/128x128/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 128 px | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
+| `assets/app-icon/hicolor/256x256/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 256 px | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop); runtime window icon on Windows and Linux (apps/pdfcraft/src/main.rs) |
+| `assets/app-icon/hicolor/512x512/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 512 px | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
+| `assets/app-icon/hicolor/scalable/apps/ai.storyteller.pdfcraft.svg` | PdfCraft app icon (Linux scalable) | PdfCraft contributors (drawn by the project owner in ArtCraft) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
 | `docs/images/pdfcraft-bookmarks.png` | PdfCraft screenshot: Bookmarks | PdfCraft contributors (generated by `cargo xtask screenshots`) | MIT OR Apache-2.0 | this repository | README: navigation. Shows only PdfCraft UI, Lucide icons and the showcase PDF built from the [[fetched]] OFL fonts |
 | `docs/images/pdfcraft-dark.png` | PdfCraft screenshot: Dark theme | PdfCraft contributors (generated by `cargo xtask screenshots`) | MIT OR Apache-2.0 | this repository | README: themes. Shows only PdfCraft UI, Lucide icons and the showcase PDF built from the [[fetched]] OFL fonts |
 | `docs/images/pdfcraft-find.png` | PdfCraft screenshot: Find text | PdfCraft contributors (generated by `cargo xtask screenshots`) | MIT OR Apache-2.0 | this repository | README: search. Shows only PdfCraft UI, Lucide icons and the showcase PDF built from the [[fetched]] OFL fonts |
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 7dcd882f84..84f71f904e 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -2873,7 +2873,7 @@ sha256 = "f87af81b6fa411da8820eed2bfdcc54c0ee9cd453b4e868c64f56c69db142d0e"
 [[asset]]
 path = "assets/app-icon/pdfcraft.svg"
 title = "PdfCraft app icon (master vector)"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
@@ -2884,7 +2884,7 @@ sha256 = "27745c021830f82c033b0f15f2d8d9f8e099138743297887ff7e2c9e7ed069da"
 [[asset]]
 path = "assets/app-icon/pdfcraft-small.svg"
 title = "PdfCraft app icon (light vector)"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
@@ -2895,7 +2895,7 @@ sha256 = "b524df1a583f8034a5a23836955e4fb423e0149429d695e80d95e5056f408678"
 [[asset]]
 path = "assets/app-icon/pdfcraft-1024.png"
 title = "PdfCraft app icon, 1024 px on Apple's icon grid"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
@@ -2906,7 +2906,7 @@ sha256 = "68ac6730b8990d07503351d32eacea81e9ec171a7a6f09daf52d6555d8245c8a"
 [[asset]]
 path = "assets/app-icon/pdfcraft.icns"
 title = "PdfCraft app icon (macOS .icns)"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
@@ -2917,7 +2917,7 @@ sha256 = "fca7e7a0e34cc5c5ecae5bca97ee896aac68c4a34b088bc3a0b3271484f23974"
 [[asset]]
 path = "assets/app-icon/pdfcraft.ico"
 title = "PdfCraft app icon (Windows .ico, 16-256 px)"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
@@ -2950,7 +2950,7 @@ sha256 = "910be5e0ecdc94ce00368077ca1bef449bd5d62a75516feeb37884296c6fac4d"
 [[asset]]
 path = "assets/app-icon/hicolor/16x16/apps/ai.storyteller.pdfcraft.png"
 title = "PdfCraft app icon, 16 px"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
@@ -2961,7 +2961,7 @@ sha256 = "660d2aace45ec1a28bc7e3708eab71ffee5cb1203f57a6256f7bd7c727193567"
 [[asset]]
 path = "assets/app-icon/hicolor/24x24/apps/ai.storyteller.pdfcraft.png"
 title = "PdfCraft app icon, 24 px"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
@@ -2972,7 +2972,7 @@ sha256 = "1989441bdcc8d1df0d73cfe7eb836e9211abaa0fd7fd6ec7e4634bfcd472995d"
 [[asset]]
 path = "assets/app-icon/hicolor/32x32/apps/ai.storyteller.pdfcraft.png"
 title = "PdfCraft app icon, 32 px"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
@@ -2983,7 +2983,7 @@ sha256 = "7fd1ac555f7f6b13ef3fba2696dfb86900cfcb7f7b669aece38590bf2306cf2e"
 [[asset]]
 path = "assets/app-icon/hicolor/48x48/apps/ai.storyteller.pdfcraft.png"
 title = "PdfCraft app icon, 48 px"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
@@ -2994,7 +2994,7 @@ sha256 = "784ef3bd9f9e479cb2df22a0aee259a441a9c358390e646639c3a0ed79d41288"
 [[asset]]
 path = "assets/app-icon/hicolor/64x64/apps/ai.storyteller.pdfcraft.png"
 title = "PdfCraft app icon, 64 px"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
@@ -3005,7 +3005,7 @@ sha256 = "deb1a9f849549d3f0652fb6d3c30b6eb6ea54498eaea8c1007d901bbafe7067c"
 [[asset]]
 path = "assets/app-icon/hicolor/128x128/apps/ai.storyteller.pdfcraft.png"
 title = "PdfCraft app icon, 128 px"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
@@ -3016,7 +3016,7 @@ sha256 = "1933bbeaea290497facd328e917dafcc433d0c0caa9f1e207aa45ac1e430898c"
 [[asset]]
 path = "assets/app-icon/hicolor/256x256/apps/ai.storyteller.pdfcraft.png"
 title = "PdfCraft app icon, 256 px"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
@@ -3027,7 +3027,7 @@ sha256 = "47094c09fb77eb35d465eee46445626a4d78c7ef50629cc7d04a602de3e144e9"
 [[asset]]
 path = "assets/app-icon/hicolor/512x512/apps/ai.storyteller.pdfcraft.png"
 title = "PdfCraft app icon, 512 px"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
@@ -3038,7 +3038,7 @@ sha256 = "dea8010a8b41011aba054d3bfb8b790da57bc958c60869f508e1bbd288d3f280"
 [[asset]]
 path = "assets/app-icon/hicolor/scalable/apps/ai.storyteller.pdfcraft.svg"
 title = "PdfCraft app icon (Linux scalable)"
-author = "PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py)"
+author = "PdfCraft contributors (drawn by the project owner in ArtCraft)"
 source = "Contributor-original (see assets/app-icon/README.md)"
 licence = "MIT OR Apache-2.0"
 licence_file = "assets/app-icon/LICENSE.txt"
diff --git a/CLAUDE.md b/CLAUDE.md
index b6c91b1fe6..5e9328f8d3 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -4,7 +4,7 @@ PdfCraft is a clean-room, open-source, Rust-native PDF application targeting Ado
 
 ## Start every session here
 1. Read `plan/STATUS.md`: the current milestone, the next unchecked task and any blockers. `ROADMAP.md` is the one-page summary (stage, numbers, progress log) and `docs/roadmap.md` the milestone table; at the end of every session update the milestone row and add a line to the ROADMAP.md progress log.
-   - Read `docs/gaps.md` (the ranked gaps: Acrobat interop, the open-issue backlog, the renderer and a fidelity harness, editing existing content, Pro workflows, 1.0 polish) and `docs/target-app-parity.md` (the numbers and how they are measured) before choosing work. Prefer the gaps over new P2/P3 features, and keep both documents true when things change (`docs/` progress docs follow craftrules `standards/progress-docs.md`: status line, revision history).
+   - Read `docs/gaps.md` (the ranked gaps: Acrobat interop, the open-issue backlog, the renderer and a fidelity harness, editing existing content, Pro workflows, 1.0 polish) and `docs/target-app-parity.md` (the numbers and how they are measured) before choosing work. Prefer the gaps over new P2/P3 features, and keep both documents true when things change (`docs/` progress docs carry a status line and a revision history).
    - "Shipped" in `parity/` means "exists and tested", not "as good as Acrobat". Don't mark a feature shipped on a generic test, and say in its notes what is still missing.
 2. Read that task in `plan/execution-plan.md` §3, the relevant section of `plan/architecture.md`, and the README of the crate you're touching.
 3. Follow the **autonomous operation protocol** in `plan/execution-plan.md` §7 (orient → plan → implement + test → verify → record → commit). Don't stop to ask unless §7 lists the decision as the user's.
@@ -13,7 +13,7 @@ PdfCraft is a clean-room, open-source, Rust-native PDF application targeting Ado
 
 ## Non-negotiables
 - **Assets: read `AGENTS.md` §1 before adding or showing any icon, image, font or document.** No assets from Adobe products, ever. Only openly licensed or contributor-original assets are allowed, each with an entry in `ATTRIBUTION.toml`. `cargo xtask assets` enforces this. `AGENTS.md` overrides this file.
-- **Fonts live in [storytold/craft-fonts](https://github.com/storytold/craft-fonts).** Never commit font files here (`AGENTS.md` §1.4; team members: [craftrules `standards/fonts.md`](https://github.com/storytold/craftrules/blob/main/standards/fonts.md), internal). It is the optional build input `CRAFT_FONTS_DIR`: `git clone https://github.com/storytold/craft-fonts ../craft-fonts && CRAFT_FONTS_DIR=../craft-fonts cargo test --workspace` embeds the Japanese fonts (UI fallback, Japanese text in edited PDFs) and runs their tests, which otherwise skip. Code using `pdfcraft_fonts::CRAFT_FONTS` must work when it is empty.
+- **Fonts live in [storytold/craft-fonts](https://github.com/storytold/craft-fonts).** Never commit font files here (`AGENTS.md` §1.4). It is the optional build input `CRAFT_FONTS_DIR`: `git clone https://github.com/storytold/craft-fonts ../craft-fonts && CRAFT_FONTS_DIR=../craft-fonts cargo test --workspace` embeds the Japanese fonts (UI fallback, Japanese text in edited PDFs) and runs their tests, which otherwise skip. Code using `pdfcraft_fonts::CRAFT_FONTS` must work when it is empty.
 - **Clean-room.**
   - Never read, disassemble or copy anything inside the Acrobat bundle (names and listings only). **Never open `Contents/Resources/JavaScripts/`.**
   - Behaviour comes from public docs, specs (ISO 32000-2, the Arlington model) and black-box observation (`plan/acrobat/`).
@@ -32,7 +32,7 @@ PdfCraft is a clean-room, open-source, Rust-native PDF application targeting Ado
   - Cap allocations sized by input, and bound recursion with depth limits or seen-sets.
   - Handle lock poisoning.
   - No `unsafe` (`unsafe_code = "forbid"`).
-  - Every crash fix gets a synthetic regression test. See `AGENTS.md` §4 (and, for team members, the internal `craftrules/standards/never-crash.md`).
+  - Every crash fix gets a synthetic regression test. See `AGENTS.md` §4.
 - **Rust only** in the product and build (`xtask`). No handwritten JS/TS.
 - **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
 - **Review every update as you make it, at four zooms.** Not an end-of-task pass — a per-update habit, so a defect never gets built on. **Clause:** checked arithmetic, `get()` not `[i]`, char-boundary slicing, the right error through `?`, `<` against `<=`, the 1-based/0-based seam, capped allocations. **Function:** is it total — name an input that panics; walk empty, zero, max, malformed, cyclic; is the return type honest. **File/module:** two sources of truth, dead or duplicated code, is the public surface still smallest and the doc comment still true. **Project:** layering, wasm, undo/redo, save fidelity, encryption and permissions, a matching `automation` tool or registry entry, and whether a `parity/` status or note just became untrue. Scale the zoom to the change, and fix what a level turns up before widening.
diff --git a/ROADMAP.md b/ROADMAP.md
index 76e86471b6..60a005cf23 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -555,8 +555,8 @@ Newest first: the date, what moved, and the new overall estimate.
 - **2026-10-10 (M3, #740):** Column select, as in Acrobat: holding Alt (Option on macOS) when a drag starts selects only the text inside the rectangle, with the Select tool, the text markup tools and Redact; Edit ▸ Column select does it with a plain drag, for Linux desktops whose window manager takes Alt-drag (Xfce, Cinnamon, MATE, KDE Plasma 5 by default). Copy gives rows top to bottom with tab-separated cells (right to left in right-to-left rows, reading order for vertical text); `text_extract` takes the same rectangle as `rect`. The new label is in all 15 catalogs. Also repaired `parity/acrobat-features.toml`, which #650 had left unparseable (duplicate keys on `form.field-list`). Still missing: column selection across pages and ⇧-click extension. Estimates unchanged.
 - **2026-10-10 (progress docs, hours per audience):** Each readiness number gets its own hours to ≈ 95%: full ≈ 49% / 780–1,400 h, mainstream ≈ 55% / 500–900 h, essentials ≈ 66% / 180–330 h. The full number is now the standard's additive weighted sum over the dimensions (written weights), 47% → 49%: method aligned with the standard, no new evidence. Beta ≈ 26 points, ≈ 400–700 h.
 - **2026-10-10 (progress docs, gate consistency check):** Re-judged the convert-and-share row with the rule applied across all Crafting Apps (a workflow blocks only when it can't be completed at all; lossy exchange and missing sub-cases are beta items, as for FilmCraft's .prproj or VectorCraft's .ai). Unencrypted sharing works, encryption interop (#774) and Office→PDF are sub-cases, Word export is lossy rather than absent: partial, not blocking. **Stage pre-alpha → alpha**; numbers unchanged (47%, mainstream 55%; beta ≈ 400–700 h). Added an essentials-user score: ≈ 66% for someone who only opens, reads, comments, fills, signs, prints and rearranges pages.
-- **2026-10-10 (progress docs, second look and alpha gate):** At the owner's request, after practitioners praised PdfCraft, re-examined the numbers. User sentiment: 7,595 stars, 177k + 39k downloads of 0.4.0/0.5.0, 23 user issues with explicit praise and switching reports (#179, #232, #273), issue themes concentrated in core paths (launch/GPU, rendering, editing, CJK, signing, printing). The checklist is not niche-dominated (497 mainstream vs 311 specialist rows; P0 95% / 91%). The first pass's 9-point cross-cutting deduction double-counted Windows printing, interop and glyphs: **ready for real work 40% → 47%**, and **≈ 55% for the mainstream practitioner** (new). The new core-workflow gate (craftrules progress-docs) fails on convert and share (#774, no Office import, #773): **stage alpha → pre-alpha**, ≈ 40–70 h from alpha; beta still ≈ 400–700 h.
-- **2026-10-10 (progress docs, full re-measure):** Re-measured against Acrobat Pro 26.002.21931 (installed bundle inspected: document types, localizations, plug-in and framework names). Checklist: 423 shipped + 74 partial of 808 (56.9%; P0 94.2%), ≈ 67% tier-weighted. Ready for real work ≈ 40%; stage **alpha**; ≈ 400–700 h to beta, ≈ 780–1,400 h to full parity (up from 600–1,100 h: the first public releases surfaced Acrobat interop of encrypted output, Windows printing, Chinese UI glyphs, Word-export layout and a 245-issue backlog). This file restructured to the craftrules progress-docs standard; the honest assessment moved to `docs/target-app-parity.md`, the gap list to `docs/gaps.md`, the milestones (duplicated rows merged) to `docs/roadmap.md`; new `docs/architecture.md`, `docs/localization-parity.md`, `docs/file-format-parity.md`, `docs/pdf-spec-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`.
+- **2026-10-10 (progress docs, second look and alpha gate):** At the owner's request, after practitioners praised PdfCraft, re-examined the numbers. User sentiment: 7,595 stars, 177k + 39k downloads of 0.4.0/0.5.0, 23 user issues with explicit praise and switching reports (#179, #232, #273), issue themes concentrated in core paths (launch/GPU, rendering, editing, CJK, signing, printing). The checklist is not niche-dominated (497 mainstream vs 311 specialist rows; P0 95% / 91%). The first pass's 9-point cross-cutting deduction double-counted Windows printing, interop and glyphs: **ready for real work 40% → 47%**, and **≈ 55% for the mainstream practitioner** (new). The new core-workflow gate fails on convert and share (#774, no Office import, #773): **stage alpha → pre-alpha**, ≈ 40–70 h from alpha; beta still ≈ 400–700 h.
+- **2026-10-10 (progress docs, full re-measure):** Re-measured against Acrobat Pro 26.002.21931 (installed bundle inspected: document types, localizations, plug-in and framework names). Checklist: 423 shipped + 74 partial of 808 (56.9%; P0 94.2%), ≈ 67% tier-weighted. Ready for real work ≈ 40%; stage **alpha**; ≈ 400–700 h to beta, ≈ 780–1,400 h to full parity (up from 600–1,100 h: the first public releases surfaced Acrobat interop of encrypted output, Windows printing, Chinese UI glyphs, Word-export layout and a 245-issue backlog). This file restructured; the honest assessment moved to `docs/target-app-parity.md`, the gap list to `docs/gaps.md`, the milestones (duplicated rows merged) to `docs/roadmap.md`; new `docs/architecture.md`, `docs/localization-parity.md`, `docs/file-format-parity.md`, `docs/pdf-spec-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`.
 - **2026-10-10 (M8, redact word lists):** Find text and redact gains "Multiple words or phrases": a list with one word or phrase per line, typed or imported from a `.txt` file, whose every match is marked in one undo step. Lists are trimmed, deduplicated and bounded (1,000 entries of 256 characters, files up to 1 MB). `redact_mark` takes `words` and reports how many marks each made, so an agent sees which found nothing. Tests cover the list parsing, the tool end to end (mark, undo, apply, invalid lists) and the dialog with an imported list; the new labels are translated in all 13 UI catalogs. `protect.redact-word-lists` is shipped; whole-word and case-sensitive matching and exporting the list are still missing. Estimates unchanged (about 30–35%).
 - **2026-10-10 (M4, bookmarks from structure):** Bookmark options ▸ New bookmarks from structure (command `bookmark.from_structure`, tool `bookmark_from_structure`) turns a tagged document's headings into bookmarks: H1–H6 through the role map, a plain H by its section nesting, nested by level under a new first "Untitled" bookmark as in Acrobat, each linked to its structure element (/SE). Titles come from /ActualText, the marked text on the page (decoded through the font's ToUnicode or encoding), /Alt or /T. The walk is bounded (depth, visits, heading and title caps, cycle-safe), an untagged document gets a clear error, and the edit is one undo step. Tests cover role maps, nesting, ToUnicode text, a self-referencing heading, the tool, undo and the panel. Still missing: Acrobat's element-type choice and destinations at the heading's position. The M4 row no longer lists Replace pages as missing (it shipped earlier). Overall estimate unchanged (about 30–35%).
 - **2026-10-10 (M9, signing encrypted documents):** Digital signatures, certification and document timestamps work on password-protected PDFs instead of failing with "not supported: signing encrypted documents". `pdfcraft-cos` no longer encrypts or decrypts a signature dictionary's `/Contents` (§7.6.2; by `/Type /Sig|/DocTimeStamp` or `/Contents` + `/ByteRange`), so the placeholder is patched after hashing as in a plain file and existing signatures in encrypted files read their real CMS (which also fixes their DSS `/VRI` keys and keeps them intact in a full rewrite). Opened with the user password, the signer applies the document's permissions (fill-forms for existing fields and timestamps, annotate + modify for new fields, modify for certifying) and names the permissions password when it refuses. Synthetic tests cover all four algorithms, counter-signing, tampering, permissions and the automation tools. Overall estimate unchanged (about 30–35%).
diff --git a/assets/app-icon/README.md b/assets/app-icon/README.md
index 58ef07d37c..7c17ad0045 100644
--- a/assets/app-icon/README.md
+++ b/assets/app-icon/README.md
@@ -20,8 +20,7 @@ icons use the full-bleed tile. macOS icons put it on Apple's grid (an 824 px bod
 1024 px canvas).
 
 **Provenance:** the project owner's original drawing, made in ArtCraft (2880 px, keyed to the palette), then
-vectorised with craftrules `assets/logo-options/_tools/vectorize_tile.py` (potrace; no filtering or
-warping). The source drawing is kept in craftrules at `assets/app-icons/pdfcraft/source.png`, not here.
+vectorised (potrace; no filtering or warping).
 Licence: [LICENSE.txt](LICENSE.txt) (`MIT OR Apache-2.0`, like the repo).
 
 ## Files
diff --git a/contributors/people.toml b/contributors/people.toml
index 53cc2391ed..a5a47f5c52 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -1,13 +1,10 @@
-# Contributor names for the About window (craftrules standards/contributors.md).
+# Contributor names for the About window.
 #
 # Everyone who contributes is credited by GitHub username automatically. Anything more is up to
 # you: add YOUR OWN entry below, in your own PR (commit it yourself). Never add someone else; a
 # maintainer may add a person only when that person asked, recording where in consent_source.
 #
-# Easiest: python3 ../../craftrules/scripts/contributors.py --add-me . \
-#            [--real-name "Ada Lovelace"] [--display-name "Ada"] [--sync-github-name]
-#
-# Or copy this block, replacing your-github-username (every field is optional):
+# Copy this block, replacing your-github-username (every field is optional):
 #
 #   [people.your-github-username]
 #   real_name = "Your Name"        # shown when the viewer picks "Real name"
diff --git a/crates/fonts/README.md b/crates/fonts/README.md
index 36b305bd9d..b20b930a91 100644
--- a/crates/fonts/README.md
+++ b/crates/fonts/README.md
@@ -72,7 +72,7 @@ needed.
 wasm32 builds embed only BIZ UDPGothic Regular and any `Arab`, `Telu`, `Hebr` or `Thai` face, to keep the web build small: the web build
 currently has no Chinese face, so Chinese there still shows the replacement glyph.
 Font files are never
-committed here (`AGENTS.md` §1.4; team members: [craftrules `standards/fonts.md`](https://github.com/storytold/craftrules/blob/main/standards/fonts.md), internal).
+committed here (`AGENTS.md` §1.4).
 
 The full font subsystem (parsing, shaping, subsetting and embedding) arrives with M2.2/M7.
 
diff --git a/crates/ui-egui/build.rs b/crates/ui-egui/build.rs
index f40007fb2f..3116b01db3 100644
--- a/crates/ui-egui/build.rs
+++ b/crates/ui-egui/build.rs
@@ -1,8 +1,7 @@
-//! Bake the contributor credits into the binary as static Rust tables (craftrules
-//! standards/contributors.md). Nothing is read at run time.
+//! Bake the contributor credits into the binary as static Rust tables. Nothing is read at run time.
 //!
-//! - contributors/contributors.json: commit stats per GitHub username, generated by craftrules
-//!   scripts/contributors.py, which also marks whose people.toml entry it verified.
+//! - contributors/contributors.json: commit stats per GitHub username, with a mark for whose people.toml
+//!   entry is verified.
 //! - contributors/people.toml: the names people chose for themselves. A name is used only when the
 //!   JSON says the entry was verified (`people_entry`).
 //!
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index d24e62cb7d..bfb0da686a 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -1506,7 +1506,7 @@ fn dialog_shortcuts(ui: &mut egui::Ui) -> bool {
 /// `Dialog::About` content. Returns `false` when it has its own buttons and no footer is wanted.
 fn dialog_about(ui: &mut egui::Ui, req: &mut Pending) -> bool {
     let t = Tokens::get(ui.ctx());
-    // Tabs About · Contributors · Models (craftrules standards/contributors.md).
+    // Tabs About · Contributors · Models.
     let tab_id = egui::Id::unique("about_tab");
     let mut tab = ui.data_mut(|d| d.get_temp::<u8>(tab_id)).unwrap_or(0);
     ui.horizontal_wrapped(|ui| {
diff --git a/crates/ui-egui/src/dialogs/credits.rs b/crates/ui-egui/src/dialogs/credits.rs
index d509a3b0eb..ad45ec77b6 100644
--- a/crates/ui-egui/src/dialogs/credits.rs
+++ b/crates/ui-egui/src/dialogs/credits.rs
@@ -1,6 +1,6 @@
 //! The About window's credits: every contributor (GitHub login always; display and real names only
 //! with recorded consent) and the AI models that helped. The tables are baked into the binary by
-//! build.rs from contributors/contributors.json (craftrules standards/contributors.md); nothing is
+//! build.rs from contributors/contributors.json; nothing is
 //! read at run time.
 
 use std::cmp::Ordering;
diff --git a/docs/contributors.md b/docs/contributors.md
index a1b0bcba13..fa7e988611 100644
--- a/docs/contributors.md
+++ b/docs/contributors.md
@@ -1,16 +1,14 @@
 # Contributors in the About window
 
 **About ▸ Contributors** credits everyone who contributed to PdfCraft, and **About ▸ Models** credits
-the AI models named in `Co-Authored-By` trailers. This follows the shared craftrules standard
-[`standards/contributors.md`](https://github.com/storytold/craftrules/blob/main/standards/contributors.md);
-this page is the local copy of the decision.
+the AI models named in `Co-Authored-By` trailers.
 
 ## Decision
 
 - Two files, both **compiled into the binary** by the UI crate's `build.rs` (nothing is read from
   disk or the network at run time; the web build has them too):
   - [`contributors/contributors.json`](../contributors/contributors.json): commit stats per GitHub
-    username. **Generated** by `craftrules/scripts/contributors.py`; never hand-edit.
+    username.
   - [`contributors/people.toml`](../contributors/people.toml): the names people chose for
     themselves. **Each contributor adds only their own entry**, in their own PR.
 - Each contributor gets one line: GitHub username (always), display name (opt-in, or their synced
@@ -36,20 +34,5 @@ display_name = "Nickname"
 sync_github_name = true   # use the name on your public GitHub profile as display name
 ```
 
-or, with craftrules checked out next to `craft-apps/`:
-
-```sh
-python3 ../../craftrules/scripts/contributors.py --add-me . --real-name "Your Name" --sync-github-name
-```
-
-Names show after the next refresh: the script checks that each entry was committed by its own
-user (or by a maintainer with a `consent_source`). Delete your entry to remove your names.
-
-## Refreshing (maintainers)
-
-```sh
-python3 ../../craftrules/scripts/contributors.py .           # regenerate + verify; needs git, Python 3.11+, gh
-python3 ../../craftrules/scripts/contributors.py --check .   # verify people.toml only
-```
-
-Commit the updated `contributors/contributors.json`. Git author names and emails are never recorded.
+Names show for entries committed by their own user (or by a maintainer with a `consent_source`).
+Delete your entry to remove your names. Git author names and emails are never recorded.

From da4cc2c145578c3167ac4ce5c0de7094d26186a3 Mon Sep 17 00:00:00 2001
From: aiongg <aiongtaigi@gmail.com>
Date: Sat, 31 Oct 2026 04:25:36 +0000
Subject: [PATCH 259/270] docs: tidy wording

---
 ROADMAP.md                | 6 +++---
 docs/roadmap.md           | 2 +-
 docs/target-app-parity.md | 6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 60a005cf23..56f6237e8d 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -553,7 +553,7 @@ Newest first: the date, what moved, and the new overall estimate.
 - **2026-10-10 (L Print, #756):** Windows prints. The Print dialog lists the system's printers and its default from `Win32_Printer` (through PowerShell's CIM; `wmic` is gone from Windows 11), and Print spools the print-ready PDF: the in-box Windows.Data.Pdf renders each sheet at the printer's own resolution and System.Drawing.Printing carries copies, collation, duplex and colour as the job's settings — both reached through `powershell`, so the Rust code touches no Win32 API and the machine needs no PDF reader. This closes #756 and the "printer not showing" duplicates #160, #244, #293, #465 and #644, using the CIM approach community-tested in #452; the tests render the job's sheets through the whole WinRT path on CI (dry run, no printer needed) and, where a printer can be added, catch a real job in its paused queue. Web printing is still missing; milestone and effort estimates are unchanged.
 
 - **2026-10-10 (M3, #740):** Column select, as in Acrobat: holding Alt (Option on macOS) when a drag starts selects only the text inside the rectangle, with the Select tool, the text markup tools and Redact; Edit ▸ Column select does it with a plain drag, for Linux desktops whose window manager takes Alt-drag (Xfce, Cinnamon, MATE, KDE Plasma 5 by default). Copy gives rows top to bottom with tab-separated cells (right to left in right-to-left rows, reading order for vertical text); `text_extract` takes the same rectangle as `rect`. The new label is in all 15 catalogs. Also repaired `parity/acrobat-features.toml`, which #650 had left unparseable (duplicate keys on `form.field-list`). Still missing: column selection across pages and ⇧-click extension. Estimates unchanged.
-- **2026-10-10 (progress docs, hours per audience):** Each readiness number gets its own hours to ≈ 95%: full ≈ 49% / 780–1,400 h, mainstream ≈ 55% / 500–900 h, essentials ≈ 66% / 180–330 h. The full number is now the standard's additive weighted sum over the dimensions (written weights), 47% → 49%: method aligned with the standard, no new evidence. Beta ≈ 26 points, ≈ 400–700 h.
+- **2026-10-10 (progress docs, hours per audience):** Each readiness number gets its own hours to ≈ 95%: full ≈ 49% / 780–1,400 h, mainstream ≈ 55% / 500–900 h, essentials ≈ 66% / 180–330 h. The full number is now the additive weighted sum over the dimensions (written weights), 47% → 49%; no new evidence. Beta ≈ 26 points, ≈ 400–700 h.
 - **2026-10-10 (progress docs, gate consistency check):** Re-judged the convert-and-share row with the rule applied across all Crafting Apps (a workflow blocks only when it can't be completed at all; lossy exchange and missing sub-cases are beta items, as for FilmCraft's .prproj or VectorCraft's .ai). Unencrypted sharing works, encryption interop (#774) and Office→PDF are sub-cases, Word export is lossy rather than absent: partial, not blocking. **Stage pre-alpha → alpha**; numbers unchanged (47%, mainstream 55%; beta ≈ 400–700 h). Added an essentials-user score: ≈ 66% for someone who only opens, reads, comments, fills, signs, prints and rearranges pages.
 - **2026-10-10 (progress docs, second look and alpha gate):** At the owner's request, after practitioners praised PdfCraft, re-examined the numbers. User sentiment: 7,595 stars, 177k + 39k downloads of 0.4.0/0.5.0, 23 user issues with explicit praise and switching reports (#179, #232, #273), issue themes concentrated in core paths (launch/GPU, rendering, editing, CJK, signing, printing). The checklist is not niche-dominated (497 mainstream vs 311 specialist rows; P0 95% / 91%). The first pass's 9-point cross-cutting deduction double-counted Windows printing, interop and glyphs: **ready for real work 40% → 47%**, and **≈ 55% for the mainstream practitioner** (new). The new core-workflow gate fails on convert and share (#774, no Office import, #773): **stage alpha → pre-alpha**, ≈ 40–70 h from alpha; beta still ≈ 400–700 h.
 - **2026-10-10 (progress docs, full re-measure):** Re-measured against Acrobat Pro 26.002.21931 (installed bundle inspected: document types, localizations, plug-in and framework names). Checklist: 423 shipped + 74 partial of 808 (56.9%; P0 94.2%), ≈ 67% tier-weighted. Ready for real work ≈ 40%; stage **alpha**; ≈ 400–700 h to beta, ≈ 780–1,400 h to full parity (up from 600–1,100 h: the first public releases surfaced Acrobat interop of encrypted output, Windows printing, Chinese UI glyphs, Word-export layout and a 245-issue backlog). This file restructured; the honest assessment moved to `docs/target-app-parity.md`, the gap list to `docs/gaps.md`, the milestones (duplicated rows merged) to `docs/roadmap.md`; new `docs/architecture.md`, `docs/localization-parity.md`, `docs/file-format-parity.md`, `docs/pdf-spec-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`.
@@ -765,11 +765,11 @@ Newest first: the date, what moved, and the new overall estimate.
 | 2026-10-11 | minor | M7: #594 paragraph-drag candidate and source regressions prepared; subsequent Linux validation passed all eight CI gates. Estimates unchanged. |
 | 2026-10-10 | minor | Recorded the remaining System appearance repair after #881; estimates unchanged |
 | 2026-10-11 | minor | Contributor fork: document-font selection and subset completion, CFF, style ranges, contextual/bidi save/reopen and all-page Chinese keyboard acceptance; curve/hole hit testing (shared clips stay fixed, as on main). Scope remains bounded; percentages unchanged |
-| 2026-10-10 | minor | Readiness table with hours per audience; full number restated as the additive weighted sum over dimensions (47% → 49%; method aligned with the standard, no new evidence) |
+| 2026-10-10 | minor | Readiness table with hours per audience; full number restated as the additive weighted sum over dimensions (47% → 49%; no new evidence) |
 | 2026-10-10 | minor | Essentials-user score added (≈ 66%) |
 | 2026-10-10 | minor | Gate consistency check: convert and share re-judged partial, not blocking; stage pre-alpha → alpha |
 | 2026-10-10 | minor | Second look: ready 40% → 47% (cross-cutting double count removed), mainstream-practitioner numbers and user sentiment added; core-workflow alpha gate applied, stage alpha → pre-alpha |
-| 2026-10-10 | major | Restructured to the progress-docs standard (stage, two numbers, dimensions, features, languages, upcoming, log); full re-measure; assessment, gaps and milestones moved to `docs/`; log sorted newest first and a stray merged entry dated |
+| 2026-10-10 | major | Progress docs restructured (stage, two numbers, dimensions, features, languages, upcoming, log); full re-measure; assessment, gaps and milestones moved to `docs/`; log sorted newest first and a stray merged entry dated |
 | 2026-10-07 | minor | 806 tracked features, 51.0% shipped, effort-weighted ≈ 30–35%, 600–1,100 h |
 | 2026-10-05 | major | Honest assessment and "Where we're lacking" added |
 | 2026-10-12 | minor | M8: cleanup removes replacement descriptions only from changed marked-content spans, preserving surviving accessibility text. Estimates unchanged. |
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 12161c4dff..0f1fb6f4d5 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -129,7 +129,7 @@ encryption and storage-write retry behavior are unchanged; this does not resolve
 
 ## Alpha gate
 
-The stage standard's gate: Acrobat Pro's everyday core workflows must each work end to end on the
+The alpha gate: Acrobat Pro's everyday core workflows must each work end to end on the
 main platform (macOS), with the work saved and reopened. Any `no`, or a `partial` that blocks the
 workflow, keeps PdfCraft pre-alpha; those rows are the alpha checklist. Assessed 2026-10-10 with the
 rule applied across the Crafting Apps: a row blocks only when a typical user cannot complete the
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 46767848cc..d03c27c95c 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -98,8 +98,8 @@ platforms 5%, hardware 4%, ecosystem 1%, AI 1%:
 History: the first version of this file subtracted 9 points from the area figure for cross-cutting
 shortfalls (40%); the second look found that a double count (Windows printing, encrypted-output
 interop and Chinese glyphs were already scored in their areas) and used a 2-point deduction (47%);
-this version replaces the deduction with the standard's weighted sum over dimensions (49%). Method
-aligned with the standard, no new evidence. Multiplicative discounts are used only for the
+this version replaces the deduction with the weighted sum over dimensions (49%), with no new
+evidence. Multiplicative discounts are used only for the
 mainstream and essentials numbers.
 
 ## Mainstream practitioner vs full Acrobat Pro
@@ -306,7 +306,7 @@ licensed OCR or AI model.
 | 2026-10-11 | minor | Web printing shipped (gap 4): Hardware, Platforms and L Print text updated. Text only: scores, readiness and hours not re-judged |
 | 2026-10-11 | minor | Contributor fork: document-font selection and subset completion, CFF, style ranges, contextual/bidi save/reopen and all-page Chinese keyboard acceptance; curve/hole hit testing (shared clips stay fixed, as on main). Scope remains bounded; percentages unchanged |
 | 2026-10-11 | minor | Synced with closed issues: encrypted output opens in Acrobat (#774, #836), Windows prints (#756, #847), column select (#740), 1:1 touchpad scrolling (#759), same-page multi-object move (#844), #825 and the #799–#821 fix batch. Text only: scores, readiness and hours not re-judged |
-| 2026-10-10 | minor | Readiness table: hours to ≈ 95% per audience (full 780–1,400, mainstream 500–900, essentials 180–330). Full number restated as the standard's additive weighted sum over dimensions with written weights: 47% → 49%. Method aligned with the standard, no new evidence |
+| 2026-10-10 | minor | Readiness table: hours to ≈ 95% per audience (full 780–1,400, mainstream 500–900, essentials 180–330). Full number restated as the additive weighted sum over dimensions with written weights: 47% → 49%. No new evidence |
 | 2026-10-10 | minor | Added the essentials-user score (≈ 66%): weighted depth of 13 everyday features, discounted for launch, discoverability and opening others' files |
 | 2026-10-10 | minor | Consistency check across apps: re-judged the convert-and-share gate row with the shared rule (blocking only when the workflow can't be completed at all; lossy exchange and missing sub-cases are beta items). Encrypted output (#774) and Office→PDF are sub-cases, Word export is lossy not absent → partial, not blocking; stage pre-alpha → **alpha**. Numbers unchanged |
 | 2026-10-10 | minor | Second look requested by the owner after practitioners praised PdfCraft: user sentiment gathered (stars, downloads, 23 praising issues, switching reports, issue themes); checklist split into mainstream (497) and specialist (311) features; the 9-point cross-cutting deduction removed as a double count (Windows printing, interop and glyphs were already scored in their areas). Ready for real work 40% → 47%; mainstream practitioner ≈ 55% added. Core-workflow alpha gate applied: convert and share fails → stage alpha → **pre-alpha**, ≈ 40–70 h from alpha |

From 635a84016413181d71226962a1ca44d12ff4a89b Mon Sep 17 00:00:00 2001
From: aiongg <aiongtaigi@gmail.com>
Date: Sat, 31 Oct 2026 04:43:07 +0000
Subject: [PATCH 260/270] updates: show check results with craft-update's
 CheckResultDialog

---
 Cargo.lock                             | 21 ++++----
 Cargo.toml                             | 14 ++---
 crates/ui-egui/src/i18n/ar.tsv         |  5 --
 crates/ui-egui/src/i18n/bg.tsv         |  5 --
 crates/ui-egui/src/i18n/ca.tsv         |  5 --
 crates/ui-egui/src/i18n/ckb.tsv        |  5 --
 crates/ui-egui/src/i18n/cs.tsv         |  5 --
 crates/ui-egui/src/i18n/de.tsv         |  5 --
 crates/ui-egui/src/i18n/el.tsv         |  5 --
 crates/ui-egui/src/i18n/es.tsv         |  5 --
 crates/ui-egui/src/i18n/fa.tsv         |  5 --
 crates/ui-egui/src/i18n/fi.tsv         |  5 --
 crates/ui-egui/src/i18n/fr.tsv         |  5 --
 crates/ui-egui/src/i18n/hi.tsv         |  5 --
 crates/ui-egui/src/i18n/hu.tsv         |  5 --
 crates/ui-egui/src/i18n/id.tsv         |  5 --
 crates/ui-egui/src/i18n/it.tsv         |  5 --
 crates/ui-egui/src/i18n/ja.tsv         |  5 --
 crates/ui-egui/src/i18n/kk.tsv         |  5 --
 crates/ui-egui/src/i18n/ko.tsv         |  5 --
 crates/ui-egui/src/i18n/lo.tsv         |  5 --
 crates/ui-egui/src/i18n/lt.tsv         |  5 --
 crates/ui-egui/src/i18n/nb.tsv         |  5 --
 crates/ui-egui/src/i18n/pl.tsv         |  5 --
 crates/ui-egui/src/i18n/pt-br.tsv      |  5 --
 crates/ui-egui/src/i18n/ro.tsv         |  5 --
 crates/ui-egui/src/i18n/ru.tsv         |  5 --
 crates/ui-egui/src/i18n/sl.tsv         |  5 --
 crates/ui-egui/src/i18n/sq.tsv         |  5 --
 crates/ui-egui/src/i18n/te.tsv         |  5 --
 crates/ui-egui/src/i18n/th.tsv         |  5 --
 crates/ui-egui/src/i18n/tr.tsv         |  5 --
 crates/ui-egui/src/i18n/uk.tsv         |  5 --
 crates/ui-egui/src/i18n/vi.tsv         |  5 --
 crates/ui-egui/src/i18n/zh-hans.tsv    |  5 --
 crates/ui-egui/src/i18n/zh-hant.tsv    |  5 --
 crates/ui-egui/src/platform/updates.rs | 75 ++++++--------------------
 crates/ui-egui/tests/it/updates.rs     |  7 +--
 38 files changed, 38 insertions(+), 249 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b29fd629b2..fd186d995c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1178,17 +1178,17 @@ dependencies = [
 [[package]]
 name = "craft-docpath"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545#e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 
 [[package]]
 name = "craft-fonts-build"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545#e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 
 [[package]]
 name = "craft-i18n"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545#e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
  "fixed_decimal",
  "icu_decimal",
@@ -1211,7 +1211,7 @@ dependencies = [
 [[package]]
 name = "craft-keymap"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545#e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
  "egui",
  "serde",
@@ -1221,7 +1221,7 @@ dependencies = [
 [[package]]
 name = "craft-menu"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545#e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
  "craft-keymap",
  "craft-quit",
@@ -1234,9 +1234,10 @@ dependencies = [
 [[package]]
 name = "craft-print"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545#e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
  "craft-winprint-gdi",
+ "log",
  "miniz_oxide 0.9.1",
  "roxmltree 0.21.2",
  "tempfile",
@@ -1247,7 +1248,7 @@ dependencies = [
 [[package]]
 name = "craft-quit"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545#e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
  "dispatch2",
  "egui",
@@ -1258,7 +1259,7 @@ dependencies = [
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545#e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
  "craft-fonts-build",
  "craft-i18n",
@@ -1279,7 +1280,7 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=04aa1703b32d299e54f78fcde4182f2b393a9116#04aa1703b32d299e54f78fcde4182f2b393a9116"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
  "chrono",
  "dunce",
@@ -6765,7 +6766,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix 1.1.5",
  "windows-sys 0.61.2",
diff --git a/Cargo.toml b/Cargo.toml
index 771f4c9611..85d02570ba 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,18 +13,18 @@ repository = "https://github.com/storytold/pdfcraft"
 
 [workspace.dependencies]
 # Shared frontend components; engines remain independent of egui.
-craft-ui = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545", features = ["serde"] }
+craft-ui = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["serde"] }
 # Quit the macOS way (#1136): ⌘Q asks about unsaved changes, and closing quits through `terminate:`.
-craft-quit = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545" }
+craft-quit = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
 # One menu definition for the native macOS menu bar and the in-window bar elsewhere.
-craft-menu = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545" }
-craft-keymap = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545", default-features = false }
+craft-menu = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
+craft-keymap = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", default-features = false }
 # Shared system spooler; document composition remains in pdfcraft-print.
-craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545" }
+craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
 # Whether a path stored in a document may be opened (GoToR link targets).
-craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "e11f9d9aebea5f6b8e74643c1ea1ed172ba5f545" }
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
 # craft-update: app-specific pretend versions apply to startup and manual checks.
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "04aa1703b32d299e54f78fcde4182f2b393a9116", features = ["egui"] }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["egui"] }
 # internal
 pdfcraft-geom = { path = "crates/geom", version = "0.16.1" }
 pdfcraft-filters = { path = "crates/filters", version = "0.16.1" }
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index ce5bf387be..56f62b7734 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -823,14 +823,9 @@
 	Copy Image in Original Format	نسخ الصورة بتنسيقها الأصلي
 	The image has been copied as a {ext} file	نُسخت الصورة كملف {ext}
 	The page has changed; select the image again	تغيّرت الصفحة؛ حدّد الصورة مرة أخرى
-	Check for updates	التحقق من التحديثات
 	No check has run yet.	لم يُجرَ أي تحقق بعد.
-	Checking for a newer version…	جارٍ التحقق من وجود إصدار أحدث…
 	PdfCraft {v} is available.	PdfCraft {v} متاح.
 	You have version {c}. Download the new version from its release page.	لديك الإصدار {c}. نزّل الإصدار الجديد من صفحة إصداره.
-	PdfCraft {c} is up to date.	PdfCraft {c} محدَّث.
-	Couldn't check for updates: {e}	تعذّر التحقق من التحديثات: {e}
-	You have version {c}. All releases are listed at {page}.	لديك الإصدار {c}. كل الإصدارات مدرجة في {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	يسأل GitHub عن أحدث إصدار. لا يُنزَّل أو يُثبَّت شيء تلقائيًا.
 	Download	تنزيل
 	Later	لاحقًا
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index eb37bdd775..ceccdf9582 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -486,14 +486,9 @@
 	Copy Image in Original Format	Копирай изображението в оригиналния формат
 	The image has been copied as a {ext} file	Изображението е копирано като файл {ext}
 	The page has changed; select the image again	Страницата е променена; изберете изображението отново
-	Check for updates	Провери за актуализации
 	No check has run yet.	Още не е извършвана проверка.
-	Checking for a newer version…	Проверка за по-нова версия…
 	PdfCraft {v} is available.	Налична е PdfCraft {v}.
 	You have version {c}. Download the new version from its release page.	Имате версия {c}. Изтеглете новата версия от страницата на изданието.
-	PdfCraft {c} is up to date.	PdfCraft {c} е актуална.
-	Couldn't check for updates: {e}	Неуспешна проверка за актуализации: {e}
-	You have version {c}. All releases are listed at {page}.	Имате версия {c}. Всички издания са изброени на {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Запитва GitHub за най-новото издание. Нищо не се изтегля и не се инсталира автоматично.
 	Download	Изтегли
 	Later	По-късно
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 513016faf4..83750ba124 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -777,14 +777,9 @@
 	Copy Image in Original Format	Copia la imatge en el format original
 	The image has been copied as a {ext} file	S'ha copiat la imatge com a fitxer {ext}
 	The page has changed; select the image again	La pàgina ha canviat; torna a seleccionar la imatge
-	Check for updates	Cerca actualitzacions
 	No check has run yet.	Encara no s'ha fet cap comprovació.
-	Checking for a newer version…	S'està cercant una versió més recent…
 	PdfCraft {v} is available.	PdfCraft {v} està disponible.
 	You have version {c}. Download the new version from its release page.	Tens la versió {c}. Baixa la versió nova des de la seva pàgina de publicació.
-	PdfCraft {c} is up to date.	PdfCraft {c} està actualitzat.
-	Couldn't check for updates: {e}	No s'han pogut cercar actualitzacions: {e}
-	You have version {c}. All releases are listed at {page}.	Tens la versió {c}. Totes les versions es llisten a {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Consulta a GitHub la darrera versió. No es baixa ni s'instal·la res automàticament.
 	Download	Baixa
 	Later	Més tard
diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index 645f174416..f6d91e3f42 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -787,14 +787,9 @@
 	Copy Image in Original Format	کۆپیکردنی وێنە بە فۆرماتی ڕەسەن
 	The image has been copied as a {ext} file	وێنەکە وەک فایلی {ext} کۆپی کرا
 	The page has changed; select the image again	پەڕەکە گۆڕاوە؛ دووبارە وێنەکە هەڵبژێرە
-	Check for updates	پشکنین بۆ نوێکردنەوەکان
 	No check has run yet.	هێشتا هیچ پشکنینێک نەکراوە.
-	Checking for a newer version…	پشکنین بۆ وەشانێکی نوێتر…
 	PdfCraft {v} is available.	PdfCraft {v} بەردەستە.
 	You have version {c}. Download the new version from its release page.	وەشانی {c} هەیە. وەشانە نوێیەکە لە پەڕەی وەشانەکەیەوە دابگرە.
-	PdfCraft {c} is up to date.	PdfCraft {c} نوێکراوەتەوە.
-	Couldn't check for updates: {e}	پشکنین بۆ نوێکردنەوە نەکرا: {e}
-	You have version {c}. All releases are listed at {page}.	وەشانی {c} هەیە. هەموو وەشانەکان لە {page} پێڕست کراون.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	لە GitHub دەپرسێت بۆ نوێترین وەشان. هیچ شتێک بە شێوەی خۆکار داگیر ناکرێت یان دادەمەزرێنرێت.
 	Download	داگرتن
 	Later	دواتر
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 4ab47a4c3c..8bfde72a85 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -902,14 +902,9 @@ key	Space	Mezerník
 	Copy Image in Original Format	Kopírovat obrázek v původním formátu
 	The image has been copied as a {ext} file	Obrázek byl zkopírován jako soubor {ext}
 	The page has changed; select the image again	Stránka se změnila; vyberte obrázek znovu
-	Check for updates	Zkontrolovat aktualizace
 	No check has run yet.	Kontrola zatím neproběhla.
-	Checking for a newer version…	Hledání novější verze…
 	PdfCraft {v} is available.	Je k dispozici PdfCraft {v}.
 	You have version {c}. Download the new version from its release page.	Máte verzi {c}. Novou verzi si stáhněte z její stránky s vydáním.
-	PdfCraft {c} is up to date.	PdfCraft {c} je aktuální.
-	Couldn't check for updates: {e}	Aktualizace nelze zkontrolovat: {e}
-	You have version {c}. All releases are listed at {page}.	Máte verzi {c}. Všechna vydání najdete na {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Zjistí na GitHubu nejnovější vydání. Nic se automaticky nestahuje ani neinstaluje.
 	Download	Stáhnout
 	Later	Později
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index fab8b0bff5..83684c08ea 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -801,14 +801,9 @@
 	Copy Image in Original Format	Bild im Originalformat kopieren
 	The image has been copied as a {ext} file	Das Bild wurde als {ext}-Datei kopiert
 	The page has changed; select the image again	Die Seite hat sich geändert; wählen Sie das Bild erneut aus
-	Check for updates	Nach Updates suchen
 	No check has run yet.	Es wurde noch nicht gesucht.
-	Checking for a newer version…	Suche nach einer neueren Version…
 	PdfCraft {v} is available.	PdfCraft {v} ist verfügbar.
 	You have version {c}. Download the new version from its release page.	Du hast Version {c}. Lade die neue Version von ihrer Release-Seite herunter.
-	PdfCraft {c} is up to date.	PdfCraft {c} ist auf dem neuesten Stand.
-	Couldn't check for updates: {e}	Updates konnten nicht gesucht werden: {e}
-	You have version {c}. All releases are listed at {page}.	Du hast Version {c}. Alle Releases findest du unter {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Fragt GitHub nach dem neuesten Release. Es wird nichts automatisch heruntergeladen oder installiert.
 	Download	Herunterladen
 	Later	Später
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 707f15f99a..576cdfcd6d 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -272,7 +272,6 @@
 	General	Γενικά
 	About	Πληροφορίες
 	About PdfCraft	Σχετικά με το PdfCraft
-	Check for updates	Έλεγχος για ενημερώσεις
 	Keyboard shortcuts	Συντομεύσεις πληκτρολογίου
 	Default	Προεπιλογή
 	Custom	Προσαρμοσμένο
@@ -394,12 +393,8 @@
 	Replace Image…	Αντικατάσταση εικόνας…
 	Save Image As…	Αποθήκευση εικόνας ως…
 	No check has run yet.	Δεν έχει πραγματοποιηθεί ακόμη έλεγχος.
-	Checking for a newer version…	Έλεγχος για νεότερη έκδοση…
 	PdfCraft {v} is available.	Η έκδοση {v} του PdfCraft είναι διαθέσιμη.
 	You have version {c}. Download the new version from its release page.	Έχετε την έκδοση {c}. Κάντε λήψη της νέας έκδοσης από τη σελίδα εκδόσεών της.
-	PdfCraft {c} is up to date.	Το PdfCraft {c} είναι ενημερωμένο.
-	Couldn't check for updates: {e}	Δεν ήταν δυνατός ο έλεγχος για ενημερώσεις: {e}
-	You have version {c}. All releases are listed at {page}.	Έχετε την έκδοση {c}. Όλες οι εκδόσεις βρίσκονται στη διεύθυνση {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Αναζητά την τελευταία έκδοση στο GitHub. Δεν γίνεται αυτόματα λήψη ή εγκατάσταση.
 	Later	Αργότερα
 	none	κανένα
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index a465e5a1f8..3216e4e448 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -817,14 +817,9 @@
 	Copy Image in Original Format	Copiar imagen en formato original
 	The image has been copied as a {ext} file	Se ha copiado la imagen como archivo {ext}
 	The page has changed; select the image again	La página ha cambiado; vuelva a seleccionar la imagen
-	Check for updates	Buscar actualizaciones
 	No check has run yet.	Aún no se ha hecho ninguna comprobación.
-	Checking for a newer version…	Buscando una versión más reciente…
 	PdfCraft {v} is available.	PdfCraft {v} está disponible.
 	You have version {c}. Download the new version from its release page.	Tienes la versión {c}. Descarga la nueva versión desde su página de publicación.
-	PdfCraft {c} is up to date.	PdfCraft {c} está actualizado.
-	Couldn't check for updates: {e}	No se pudieron buscar actualizaciones: {e}
-	You have version {c}. All releases are listed at {page}.	Tienes la versión {c}. Todas las versiones aparecen en {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Consulta a GitHub cuál es la última versión. No se descarga ni se instala nada automáticamente.
 	Download	Descargar
 	Later	Más tarde
diff --git a/crates/ui-egui/src/i18n/fa.tsv b/crates/ui-egui/src/i18n/fa.tsv
index 99a156bc58..292b4fbdb3 100644
--- a/crates/ui-egui/src/i18n/fa.tsv
+++ b/crates/ui-egui/src/i18n/fa.tsv
@@ -818,14 +818,9 @@
 	Copy Image in Original Format	کپی تصویر در قالب اصلی
 	The image has been copied as a {ext} file	تصویر به‌صورت یک فایل {ext} کپی شد
 	The page has changed; select the image again	صفحه تغییر کرده است؛ تصویر را دوباره انتخاب کنید
-	Check for updates	بررسی به‌روز‌رسانی‌ها
 	No check has run yet.	هنوز هیچ بررسیای انجام نشده است.
-	Checking for a newer version…	بررسی برای نگارش تازه‌تر…
 	PdfCraft {v} is available.	PdfCraft {v} در دسترس است.
 	You have version {c}. Download the new version from its release page.	شما نگارش {c} را دارید. نگارش جدید را از صفحه انتشار آن دانلود کنید.
-	PdfCraft {c} is up to date.	PdfCraft {c} به‌روز است.
-	Couldn't check for updates: {e}	بررسی به‌روز‌رسانی‌ها انجام نشد: {e}
-	You have version {c}. All releases are listed at {page}.	شما نگارش {c} را دارید. همه انتشار‌ها در {page} فهرست شدهاند.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	آخرین انتشار را از GitHub می‌پرسد. هیچ چیزی به‌طور خودکار دانلود یا نصب نمی‌شود.
 	Download	دانلود
 	Later	بعداً
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index b1dbaffc1e..80d2a0f859 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -776,14 +776,9 @@
 	Copy Image in Original Format	Kopioi kuva alkuperäisessä muodossa
 	The image has been copied as a {ext} file	Kuva on kopioitu {ext}-tiedostona
 	The page has changed; select the image again	Sivu on muuttunut; valitse kuva uudelleen
-	Check for updates	Tarkista päivitykset
 	No check has run yet.	Tarkistusta ei ole vielä tehty.
-	Checking for a newer version…	Tarkistetaan uudempaa versiota…
 	PdfCraft {v} is available.	PdfCraft {v} on saatavilla.
 	You have version {c}. Download the new version from its release page.	Käytössä on versio {c}. Lataa uusi versio sen julkaisusivulta.
-	PdfCraft {c} is up to date.	PdfCraft {c} on ajan tasalla.
-	Couldn't check for updates: {e}	Päivitysten tarkistus epäonnistui: {e}
-	You have version {c}. All releases are listed at {page}.	Käytössä on versio {c}. Kaikki julkaisut on lueteltu sivulla {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Kysyy uusinta julkaisua GitHubista. Mitään ei ladata tai asenneta automaattisesti.
 	Download	Lataa
 	Later	Myöhemmin
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 513ba27b3f..6092231df3 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -797,14 +797,9 @@
 	Copy Image in Original Format	Copier l'image au format d'origine
 	The image has been copied as a {ext} file	L'image a été copiée en tant que fichier {ext}
 	The page has changed; select the image again	La page a changé ; sélectionnez de nouveau l'image
-	Check for updates	Rechercher des mises à jour
 	No check has run yet.	Aucune vérification n'a encore été faite.
-	Checking for a newer version…	Recherche d'une version plus récente…
 	PdfCraft {v} is available.	PdfCraft {v} est disponible.
 	You have version {c}. Download the new version from its release page.	Vous avez la version {c}. Téléchargez la nouvelle version depuis sa page de publication.
-	PdfCraft {c} is up to date.	PdfCraft {c} est à jour.
-	Couldn't check for updates: {e}	Impossible de rechercher les mises à jour : {e}
-	You have version {c}. All releases are listed at {page}.	Vous avez la version {c}. Toutes les versions sont listées sur {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Demande à GitHub la dernière version. Rien n'est téléchargé ni installé automatiquement.
 	Download	Télécharger
 	Later	Plus tard
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index fa59df3a15..dfaa94b5d6 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -760,14 +760,9 @@
 	Copy Image in Original Format	छवि मूल प्रारूप में कॉपी करें
 	The image has been copied as a {ext} file	छवि {ext} फ़ाइल के रूप में कॉपी हो गई है
 	The page has changed; select the image again	पृष्ठ बदल गया है; छवि फिर से चुनें
-	Check for updates	अपडेट के लिए जाँचें
 	No check has run yet.	अभी तक कोई जाँच नहीं चली है।
-	Checking for a newer version…	नए संस्करण की जाँच हो रही है…
 	PdfCraft {v} is available.	PdfCraft {v} उपलब्ध है।
 	You have version {c}. Download the new version from its release page.	आपके पास संस्करण {c} है। नया संस्करण इसके रिलीज़ पृष्ठ से डाउनलोड करें।
-	PdfCraft {c} is up to date.	PdfCraft {c} अद्यतन है।
-	Couldn't check for updates: {e}	अपडेट की जाँच नहीं हो सकी: {e}
-	You have version {c}. All releases are listed at {page}.	आपके पास संस्करण {c} है। सभी रिलीज़ {page} पर सूचीबद्ध हैं।
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	GitHub से नवीनतम रिलीज़ की क्वेरी करता है। कुछ भी स्वतः डाउनलोड या इंस्टॉल नहीं होता।
 	Download	डाउनलोड
 	Later	बाद में
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index bc4614e104..53b81062bb 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -794,14 +794,9 @@
 	Copy Image in Original Format	Kép másolása eredeti formátumban
 	The image has been copied as a {ext} file	A kép {ext}-fájlként a vágólapra került
 	The page has changed; select the image again	Az oldal megváltozott; jelölje ki újra a képet
-	Check for updates	Frissítések keresése
 	No check has run yet.	Még nem futott ellenőrzés.
-	Checking for a newer version…	Újabb verzió keresése…
 	PdfCraft {v} is available.	Elérhető a PdfCraft {v}.
 	You have version {c}. Download the new version from its release page.	A jelenlegi verzió: {c}. Töltsd le az újat a kiadási oldaláról.
-	PdfCraft {c} is up to date.	A PdfCraft {c} naprakész.
-	Couldn't check for updates: {e}	A frissítések keresése nem sikerült: {e}
-	You have version {c}. All releases are listed at {page}.	A jelenlegi verzió: {c}. Minden kiadás itt található: {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	A GitHubtól kéri le a legújabb kiadást. Semmi sem töltődik le vagy települ automatikusan.
 	Download	Letöltés
 	Later	Később
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 52b2dfbe4f..0eb02928f1 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -334,12 +334,10 @@
 	Check Again	Periksa Lagi
 	Check again	Periksa lagi
 	Check box is checked by default	Kotak centang tercentang secara bawaan
-	Check for updates	Periksa pembaruan
 	Check spelling	Periksa ejaan
 	Check the pages	Periksa halaman
 	Check the pages of {name}: {why}	Periksa halaman {name}: {why}
 	Checking Options ({on} of 32 in all categories)	Memeriksa Opsi ({on} dari 32 di semua kategori)
-	Checking for a newer version…	Mencari versi yang lebih baru…
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Pilih gambar PNG atau JPEG (hingga 4 MiB). Transparansi dipertahankan.
 	Choose a folder for the exported files	Pilih folder untuk file yang diekspor
 	Choose a folder for the extracted pages	Pilih folder untuk halaman yang diekstrak
@@ -398,7 +396,6 @@
 	Copies:	Salinan:
 	Copy selected text	Salin teks yang dipilih
 	Copy text	Salin teks
-	Couldn't check for updates: {e}	Tidak dapat memeriksa pembaruan: {e}
 	Couldn't open the printer's preferences: {e}	Tidak dapat membuka preferensi printer: {e}
 	Counterclockwise 90 degrees	90 derajat berlawanan arah jarum jam
 	Country/Region	Negara/Wilayah
@@ -859,7 +856,6 @@
 	Patterns (graphics objects)	Pola (objek grafis)
 	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft tidak berhenti secara normal. Dokumen-dokumen ini memiliki perubahan yang disimpan otomatis:
 	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft bekerja secara luring. Tidak ada telemetri, tidak ada akun, dan tidak ada pemrosesan awan kecuali Anda menambahkan penyedia.
-	PdfCraft {c} is up to date.	PdfCraft {c} sudah terbaru.
 	PdfCraft {v} is available.	PdfCraft {v} tersedia.
 	Percentage	Persentase
 	Permissions password	Kata sandi izin
@@ -1278,7 +1274,6 @@
 	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	Formulir XFA: kolom dan data XFA-nya dijaga tetap sinkron, sehingga penampil lain menampilkan yang Anda isi.
 	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Anda akan menerapkan 1 tanda sensor. Teks, gambar, dan gambar-gambar di bawah tanda tersebut, serta komentar dan kolom formulir yang bertumpang tindih dengannya, akan dihapus permanen.
 	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Anda akan menerapkan {n} tanda sensor. Teks, gambar, dan gambar-gambar di bawah tanda tersebut, serta komentar dan kolom formulir yang bertumpang tindih dengannya, akan dihapus permanen.
-	You have version {c}. All releases are listed at {page}.	Anda memiliki versi {c}. Semua rilis tercantum di {page}.
 	You have version {c}. Download the new version from its release page.	Anda memiliki versi {c}. Unduh versi baru dari halaman rilisnya.
 	Your changes will be lost if you don't save them.	Perubahan Anda akan hilang jika tidak Anda simpan.
 	ZIP	ZIP
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 3228312cca..a3dc999d6d 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -820,14 +820,9 @@
 	Copy Image in Original Format	Copia immagine nel formato originale
 	The image has been copied as a {ext} file	L'immagine è stata copiata come file {ext}
 	The page has changed; select the image again	La pagina è cambiata; seleziona di nuovo l'immagine
-	Check for updates	Verifica aggiornamenti
 	No check has run yet.	Nessuna verifica eseguita finora.
-	Checking for a newer version…	Ricerca di una versione più recente…
 	PdfCraft {v} is available.	PdfCraft {v} è disponibile.
 	You have version {c}. Download the new version from its release page.	Hai la versione {c}. Scarica la nuova versione dalla sua pagina di rilascio.
-	PdfCraft {c} is up to date.	PdfCraft {c} è aggiornato.
-	Couldn't check for updates: {e}	Impossibile verificare gli aggiornamenti: {e}
-	You have version {c}. All releases are listed at {page}.	Hai la versione {c}. Tutte le versioni sono elencate su {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Chiede a GitHub qual è l'ultima versione. Nulla viene scaricato o installato automaticamente.
 	Download	Scarica
 	Later	Più tardi
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 37ddfd4c58..5e64a1a8ce 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -824,14 +824,9 @@
 	Copy Image in Original Format	画像を元の形式でコピー
 	The image has been copied as a {ext} file	画像を {ext} ファイルとしてコピーしました
 	The page has changed; select the image again	ページが変更されました。画像をもう一度選択してください
-	Check for updates	アップデートを確認
 	No check has run yet.	まだ確認していません。
-	Checking for a newer version…	新しいバージョンを確認中…
 	PdfCraft {v} is available.	PdfCraft {v} が利用できます。
 	You have version {c}. Download the new version from its release page.	現在のバージョンは {c} です。リリースページから新しいバージョンをダウンロードしてください。
-	PdfCraft {c} is up to date.	PdfCraft {c} は最新です。
-	Couldn't check for updates: {e}	アップデートを確認できませんでした: {e}
-	You have version {c}. All releases are listed at {page}.	現在のバージョンは {c} です。すべてのリリースは {page} に掲載されています。
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	GitHub で最新リリースを確認します。自動でダウンロードやインストールは行いません。
 	Download	ダウンロード
 	Later	後で
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index a28d532498..5c8e594759 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -780,14 +780,9 @@
 	Copy Image in Original Format	Суретті бастапқы пішімде көшіру
 	The image has been copied as a {ext} file	Сурет {ext} файлы ретінде көшірілді
 	The page has changed; select the image again	Бет өзгерді; суретті қайта таңдаңыз
-	Check for updates	Жаңартуларды тексеру
 	No check has run yet.	Тексеру әлі жүргізілген жоқ.
-	Checking for a newer version…	Жаңа нұсқа бар ма екені тексерілуде…
 	PdfCraft {v} is available.	PdfCraft {v} қолжетімді.
 	You have version {c}. Download the new version from its release page.	Сізде {c} нұсқасы бар. Жаңа нұсқаны шығарылым бетінен жүктеп алыңыз.
-	PdfCraft {c} is up to date.	PdfCraft {c} нұсқасы ең соңғы.
-	Couldn't check for updates: {e}	Жаңартуларды тексеру мүмкін болмады: {e}
-	You have version {c}. All releases are listed at {page}.	Сізде {c} нұсқасы бар. Барлық шығарылымдар {page} бетінде көрсетілген.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	GitHub-тан соңғы шығарылымды сұрайды. Ештеңе автоматты түрде жүктелмейді немесе орнатылмайды.
 	Download	Жүктеп алу
 	Later	Кейінірек
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index ecf2b20faa..1e461bbdff 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -760,14 +760,9 @@
 	Copy Image in Original Format	원본 형식으로 이미지 복사
 	The image has been copied as a {ext} file	이미지가 {ext} 파일로 복사되었습니다
 	The page has changed; select the image again	페이지가 변경되었으므로 이미지를 다시 선택하세요
-	Check for updates	업데이트 확인
 	No check has run yet.	아직 확인이 실행되지 않았습니다.
-	Checking for a newer version…	새 버전이 있는지 확인하는 중…
 	PdfCraft {v} is available.	PdfCraft {v}을(를) 사용할 수 있습니다.
 	You have version {c}. Download the new version from its release page.	현재 버전은 {c}입니다. 릴리스 페이지에서 새 버전을 다운로드하세요.
-	PdfCraft {c} is up to date.	PdfCraft {c}은(는) 최신 버전입니다.
-	Couldn't check for updates: {e}	업데이트를 확인할 수 없습니다: {e}
-	You have version {c}. All releases are listed at {page}.	현재 버전은 {c}입니다. 모든 릴리스는 {page}에 표시됩니다.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	GitHub에 최신 릴리스를 요청합니다. 어떤 것도 자동으로 다운로드하거나 설치하지 않습니다.
 	Download	다운로드
 	Later	나중에
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index ca2d8bc7ea..c4d45c90d1 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -786,14 +786,9 @@
 	Copy Image in Original Format	ສຳເນົາຮູບພາບໃນຮູບແບບຕົ້ນສະບັບ
 	The image has been copied as a {ext} file	ສຳເນົາຮູບພາບເປັນໄຟລ໌ {ext} ແລ້ວ
 	The page has changed; select the image again	ໜ້າປ່ຽນໄປແລ້ວ; ກະລຸນາເລືອກຮູບພາບອີກຄັ້ງ
-	Check for updates	ກວດສອບການອັບເດດ
 	No check has run yet.	ຍັງບໍ່ທັນມີການກວດສອບເທື່ອ.
-	Checking for a newer version…	ກຳລັງກວດສອບເວີຊັນໃໝ່…
 	PdfCraft {v} is available.	ມີ PdfCraft {v} ພ້ອມໃຫ້ໃຊ້ງານແລ້ວ.
 	You have version {c}. Download the new version from its release page.	ທ່ານກຳລັງໃຊ້ເວີຊັນ {c}. ດາວໂຫຼດເວີຊັນໃໝ່ໄດ້ຈາກໜ້າ release.
-	PdfCraft {c} is up to date.	PdfCraft {c} ເປັນເວີຊັນລ່າສຸດແລ້ວ.
-	Couldn't check for updates: {e}	ບໍ່ສາມາດກວດສອບການອັບເດດໄດ້: {e}
-	You have version {c}. All releases are listed at {page}.	ທ່ານກຳລັງໃຊ້ເວີຊັນ {c}. ລາຍການ release ທັງໝົດແມ່ນສະແດງຢູ່ທີ່ {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	ກວດສອບລຸ້ນລ່າສຸດຈາກ GitHub. ຈະບໍ່ມີການດາວໂຫຼດ ຫຼື ຕິດຕັ້ງໂດຍອັດຕະໂນມັດ.
 	Download	ດາວໂຫຼດ
 	Later	ພາຍຫຼັງ
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index b2e588c48a..61fd9dc9a2 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -344,12 +344,10 @@
 	Check Again	Tikrinti dar kartą
 	Check again	Tikrinti dar kartą
 	Check box is checked by default	Žymimasis langelis pažymėtas pagal numatytuosius parametrus
-	Check for updates	Tikrinti, ar yra naujinimų
 	Check spelling	Tikrinti rašybą
 	Check the pages	Tikrinti puslapius
 	Check the pages of {name}: {why}	Tikrinti dokumento {name} puslapius: {why}
 	Checking Options ({on} of 32 in all categories)	Tikrinimo parinktys (visose kategorijose: {on} iš 32)
-	Checking for a newer version…	Tikrinama, ar yra naujesnė versija…
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Pasirinkite PNG arba JPEG paveikslėlį (iki 4 MiB). Skaidrumas išsaugomas.
 	Choose a folder for the exported files	Pasirinkite aplanką eksportuojamiems failams
 	Choose a folder for the extracted pages	Pasirinkite aplanką išskirtiems puslapiams
@@ -411,7 +409,6 @@
 	Copies:	Kopijų skaičius:
 	Copy selected text	Kopijuoti pažymėtą tekstą
 	Copy text	Kopijuoti tekstą
-	Couldn't check for updates: {e}	Nepavyko patikrinti, ar yra naujinimų: {e}
 	Couldn't open the printer's preferences: {e}	Nepavyko atverti spausdintuvo nuostatų: {e}
 	Counterclockwise 90 degrees	90 laipsnių prieš laikrodžio rodyklę
 	Country/Region	Šalis / regionas
@@ -916,7 +913,6 @@
 	Patterns (graphics objects)	Šablonai (grafiniai objektai)
 	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	„PdfCraft“ buvo uždaryta netinkamai. Šių dokumentų pakeitimai buvo automatiškai įrašyti:
 	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	„PdfCraft“ veikia neprisijungus. Nerenkami telemetrijos duomenys, nereikia paskyros ir nenaudojamos debesijos paslaugos, nebent pridėtumėte jų teikėją.
-	PdfCraft {c} is up to date.	Naudojate naujausią „PdfCraft“ versiją {c}.
 	PdfCraft {v} is available.	Išleista „PdfCraft“ versija {v}.
 	Percentage	Procentai
 	Permissions password	Teisių slaptažodis
@@ -1344,7 +1340,6 @@
 	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	XFA forma: jos laukai ir XFA duomenys sinchronizuojami, todėl kitose žiūryklėse rodoma tai, ką įvedate.
 	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Ketinate pritaikyti 1 šalinimo žymą. Po žymomis esantis tekstas, paveikslėliai ir brėžiniai, taip pat su jomis persidengiantys komentarai ir formos laukai bus pašalinti visam laikui.
 	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Ketinate pritaikyti šalinimo žymų: {n}. Po žymomis esantis tekstas, paveikslėliai ir brėžiniai, taip pat su jomis persidengiantys komentarai ir formos laukai bus pašalinti visam laikui.
-	You have version {c}. All releases are listed at {page}.	Turite versiją {c}. Visos laidos išvardytos čia: {page}.
 	You have version {c}. Download the new version from its release page.	Turite versiją {c}. Atsisiųskite naują versiją iš jos laidos puslapio.
 	Your changes will be lost if you don't save them.	Jei pakeitimų neįrašysite, jie bus prarasti.
 	ZIP	ZIP
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index c196fd2394..e81b84e341 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -341,12 +341,10 @@
 	Check Again	Sjekk igjen
 	Check again	Sjekk igjen
 	Check box is checked by default	Avkrysningsboksen er avkrysset som standard
-	Check for updates	Se etter oppdateringer
 	Check spelling	Stavekontroll
 	Check the pages	Kontroller sidene
 	Check the pages of {name}: {why}	Kontroller sidene i {name}: {why}
 	Checking Options ({on} of 32 in all categories)	Kontrollalternativer ({on} av 32 i alle kategorier)
-	Checking for a newer version…	Ser etter en nyere versjon…
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Velg et PNG- eller JPEG-bilde (opptil 4 MiB). Gjennomsiktighet bevares.
 	Choose a folder for the exported files	Velg en mappe for de eksporterte filene
 	Choose a folder for the extracted pages	Velg en mappe for de uttrukne sidene
@@ -406,7 +404,6 @@
 	Copies:	Antall kopier:
 	Copy selected text	Kopier merket tekst
 	Copy text	Kopier tekst
-	Couldn't check for updates: {e}	Kunne ikke se etter oppdateringer: {e}
 	Couldn't open the printer's preferences: {e}	Kunne ikke åpne skriverinnstillingene: {e}
 	Counterclockwise 90 degrees	90 grader mot klokka
 	Country/Region	Land/region
@@ -868,7 +865,6 @@
 	Patterns (graphics objects)	Mønstre (grafikkobjekter)
 	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft ble ikke avsluttet normalt. Disse dokumentene hadde endringer som ble autolagret:
 	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft fungerer uten nett. Ingen telemetri, ingen konto og ingen skybehandling med mindre du legger til en leverandør.
-	PdfCraft {c} is up to date.	PdfCraft {c} er oppdatert.
 	PdfCraft {v} is available.	PdfCraft {v} er tilgjengelig.
 	Percentage	Prosent
 	Permissions password	Tillatelsespassord
@@ -1289,7 +1285,6 @@
 	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	XFA-skjema: feltene og XFA-dataene holdes i takt, så andre visere viser det du fyller inn.
 	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Du er i ferd med å bruke 1 sladdemarkering. Tekst, bilder og tegninger under markeringene, og kommentarer og skjemafelt som overlapper dem, fjernes permanent.
 	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Du er i ferd med å bruke {n} sladdemarkeringer. Tekst, bilder og tegninger under markeringene, og kommentarer og skjemafelt som overlapper dem, fjernes permanent.
-	You have version {c}. All releases are listed at {page}.	Du har versjon {c}. Alle utgivelser er listet på {page}.
 	You have version {c}. Download the new version from its release page.	Du har versjon {c}. Last ned den nye versjonen fra utgivelsessiden.
 	Your changes will be lost if you don't save them.	Endringene dine går tapt hvis du ikke lagrer dem.
 	ZIP	ZIP
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index ae6463a156..203cad58d8 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -816,14 +816,9 @@
 	Copy Image in Original Format	Kopiuj obraz w oryginalnym formacie
 	The image has been copied as a {ext} file	Obraz został skopiowany jako plik {ext}
 	The page has changed; select the image again	Strona się zmieniła; zaznacz obraz ponownie
-	Check for updates	Sprawdź aktualizacje
 	No check has run yet.	Nie sprawdzono jeszcze aktualizacji.
-	Checking for a newer version…	Sprawdzanie dostępności nowszej wersji…
 	PdfCraft {v} is available.	PdfCraft {v} jest dostępny.
 	You have version {c}. Download the new version from its release page.	Masz wersję {c}. Pobierz nową wersję ze strony wydania.
-	PdfCraft {c} is up to date.	PdfCraft {c} jest aktualny.
-	Couldn't check for updates: {e}	Nie można sprawdzić aktualizacji: {e}
-	You have version {c}. All releases are listed at {page}.	Masz wersję {c}. Wszystkie wydania są dostępne na {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Sprawdza najnowsze wydanie na GitHubie. Nic nie jest pobierane ani instalowane automatycznie.
 	Download	Pobierz
 	Later	Później
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 70309ffc15..45f827171b 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -441,14 +441,9 @@
 	Copy Image in Original Format	Copiar imagem no formato original
 	The image has been copied as a {ext} file	A imagem foi copiada como arquivo {ext}
 	The page has changed; select the image again	A página mudou; selecione a imagem novamente
-	Check for updates	Verificar atualizações
 	No check has run yet.	Nenhuma verificação foi executada ainda.
-	Checking for a newer version…	Verificando se há uma versão mais recente…
 	PdfCraft {v} is available.	O PdfCraft {v} está disponível.
 	You have version {c}. Download the new version from its release page.	Você tem a versão {c}. Baixe a nova versão na página de lançamentos.
-	PdfCraft {c} is up to date.	O PdfCraft {c} está atualizado.
-	Couldn't check for updates: {e}	Não foi possível verificar atualizações: {e}
-	You have version {c}. All releases are listed at {page}.	Você tem a versão {c}. Todos os lançamentos estão listados em {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Consulta o GitHub para obter o lançamento mais recente. Nada é baixado ou instalado automaticamente.
 	Download	Baixar
 	Later	Mais tarde
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index f8a2deb83e..6b23515b8e 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -342,12 +342,10 @@
 	Check Again	Verificare din nou
 	Check again	Verificare din nou
 	Check box is checked by default	Caseta de selectare este bifată implicit
-	Check for updates	Căutare actualizări
 	Check spelling	Verificare ortografică
 	Check the pages	Verificați paginile
 	Check the pages of {name}: {why}	Verificați paginile din {name}: {why}
 	Checking Options ({on} of 32 in all categories)	Opțiuni de verificare ({on} din 32 în toate categoriile)
-	Checking for a newer version…	Se caută o versiune mai nouă…
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Alegeți o imagine PNG sau JPEG (până la 4 MiB). Transparența se păstrează.
 	Choose a folder for the exported files	Alegeți un folder pentru fișierele exportate
 	Choose a folder for the extracted pages	Alegeți un folder pentru paginile extrase
@@ -407,7 +405,6 @@
 	Copies:	Copii:
 	Copy selected text	Copiere text selectat
 	Copy text	Copiere text
-	Couldn't check for updates: {e}	Nu s-au putut căuta actualizări: {e}
 	Couldn't open the printer's preferences: {e}	Nu s-au putut deschide preferințele imprimantei: {e}
 	Counterclockwise 90 degrees	90 de grade în sens invers acelor de ceasornic
 	Country/Region	Țară/regiune
@@ -868,7 +865,6 @@
 	Patterns (graphics objects)	Modele (obiecte grafice)
 	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft nu s-a închis normal. Aceste documente aveau modificări salvate automat:
 	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft funcționează offline. Fără telemetrie, fără cont și fără procesare în cloud, cu excepția cazului în care adăugați un furnizor.
-	PdfCraft {c} is up to date.	PdfCraft {c} este la zi.
 	PdfCraft {v} is available.	Este disponibil PdfCraft {v}.
 	Percentage	Procent
 	Permissions password	Parolă de permisiuni
@@ -1287,7 +1283,6 @@
 	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	Formular XFA: câmpurile și datele XFA sunt sincronizate, ca alte vizualizatoare să arate ce completați.
 	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Urmează să aplicați 1 marcaj de anonimizare. Textul, imaginile și desenele de sub marcaje, precum și comentariile și câmpurile de formular care se suprapun cu ele, se elimină definitiv.
 	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Urmează să aplicați {n} marcaje de anonimizare. Textul, imaginile și desenele de sub marcaje, precum și comentariile și câmpurile de formular care se suprapun cu ele, se elimină definitiv.
-	You have version {c}. All releases are listed at {page}.	Aveți versiunea {c}. Toate versiunile sunt listate la {page}.
 	You have version {c}. Download the new version from its release page.	Aveți versiunea {c}. Descărcați versiunea nouă de pe pagina ei de lansare.
 	Your changes will be lost if you don't save them.	Modificările se vor pierde dacă nu le salvați.
 	ZIP	ZIP
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 87042f7bd9..59c483526a 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -817,14 +817,9 @@
 	Copy Image in Original Format	Копировать изображение в исходном формате
 	The image has been copied as a {ext} file	Изображение скопировано как файл {ext}
 	The page has changed; select the image again	Страница изменилась; выберите изображение снова
-	Check for updates	Проверить обновления
 	No check has run yet.	Проверка ещё не выполнялась.
-	Checking for a newer version…	Проверка новой версии…
 	PdfCraft {v} is available.	Доступна PdfCraft {v}.
 	You have version {c}. Download the new version from its release page.	У вас версия {c}. Скачайте новую версию со страницы релизов.
-	PdfCraft {c} is up to date.	У вас последняя версия PdfCraft {c}.
-	Couldn't check for updates: {e}	Не удалось проверить обновления: {e}
-	You have version {c}. All releases are listed at {page}.	У вас версия {c}. Все релизы перечислены на {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Запрашивает у GitHub последний релиз. Ничего не скачивается и не устанавливается автоматически.
 	Download	Скачать
 	Later	Позже
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 57d31bd66e..83cb594158 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -343,7 +343,6 @@
 	Check box is checked by default	Potrditveno polje je privzeto označeno
 	Check for accessibility	Preveri dostopnost
 	Check for accessibility…	Preveri dostopnost…
-	Check for updates	Preveri posodobitve
 	Check for updates…	Preveri posodobitve…
 	Check spelling	Preveri črkovanje
 	Check that the tags read in the order a sighted reader would. Use the Reading Order tool or the Tags panel to correct it.	Preverite, ali se oznake berejo v vrstnem redu, v katerem bi jih bral bralec. Za popravek uporabite orodje Vrstni red branja ali razdelek Oznake.
@@ -352,7 +351,6 @@
 	Checkbox	Potrditveno polje
 	Checked	Označeno
 	Checking Options ({on} of 32 in all categories)	Možnosti preverjanja ({on} od 32 v vseh kategorijah)
-	Checking for a newer version…	Preverjanje za novejšo različico…
 	Checkmark	Kljukica
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Izberite sliko PNG ali JPEG (do 4 MiB). Prosojnost je ohranjena.
 	Choose a folder for the exported files	Izberite mapo za izvožene datoteke
@@ -457,7 +455,6 @@
 	Correct recognized text	Popravi prepoznano besedilo
 	Could not save: {e}	Shranjevanje ni uspelo: {e}
 	Couldn't add {name}: {e}	Datoteke {name} ni bilo mogoče dodati: {e}
-	Couldn't check for updates: {e}	Posodobitev ni bilo mogoče preveriti: {e}
 	Couldn't combine files: {e}	Datotek ni bilo mogoče združiti: {e}
 	Couldn't create a PDF: {e}	PDF-ja ni bilo mogoče ustvariti: {e}
 	Couldn't download {name}: {e}	Datoteke {name} ni bilo mogoče prenesti: {e}
@@ -1368,7 +1365,6 @@
 	PdfCraft on GitHub	PdfCraft na GitHubu
 	PdfCraft web page	Spletna stran PdfCraft
 	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft deluje brez povezave. Brez telemetrije, brez računa in brez obdelave v oblaku, razen če dodate ponudnika.
-	PdfCraft {c} is up to date.	PdfCraft {c} je posodobljen.
 	PdfCraft {v} is available.	Na voljo je PdfCraft {v}.
 	People may need more time to respond. Check that nothing has a time limit.	Ljudje bodo morda potrebovali več časa za odziv. Preverite, da nič nima časovne omejitve.
 	Percentage	Odstotek
@@ -2063,7 +2059,6 @@
 	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Uveljavili boste 1 oznako za počrnitev. Besedilo, slike in risbe pod oznakami ter komentarji in polja obrazca, ki se z njimi prekrivajo, bodo trajno odstranjeni.
 	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Uveljavili boste oznake za počrnitev: {n}. Besedilo, slike in risbe pod oznakami ter komentarji in polja obrazca, ki se z njimi prekrivajo, bodo trajno odstranjeni.
 	You can pin up to {n} folders. Unpin one first.	Pripnete lahko do {n} map. Najprej eno odpnite.
-	You have version {c}. All releases are listed at {page}.	Imate različico {c}. Vse izdaje so navedene na {page}.
 	You have version {c}. Download the new version from its release page.	Imate različico {c}. Novo različico prenesite z njene strani izdaje.
 	Your changes will be lost if you don't save them.	Vaše spremembe bodo izgubljene, če jih ne shranite.
 	Your name	Vaše ime
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index 4b1769c0f3..e5a8f5b037 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -337,7 +337,6 @@
 	Check box is checked by default	Kutia e zgjedhjes është e zgjedhur si parazgjedhje
 	Check for accessibility	Kontrollo qasshmërinë
 	Check for accessibility…	Kontrollo qasshmërinë…
-	Check for updates	Kontrollo për përditësime
 	Check for updates…	Kontrollo për përditësime…
 	Check spelling	Kontrollo drejtshkrimin
 	Check that the tags read in the order a sighted reader would. Use the Reading Order tool or the Tags panel to correct it.	Kontrolloni që etiketat lexohen në radhën që do t'i lexonte një lexues që sheh. Përdorni mjetin e radhës së leximit ose panelin e etiketave për ta korrigjuar.
@@ -346,7 +345,6 @@
 	Checkbox	Kuti zgjedhjeje
 	Checked	E zgjedhur
 	Checking Options ({on} of 32 in all categories)	Opsionet e kontrollit ({on} nga 32 në të gjitha kategoritë)
-	Checking for a newer version…	Duke kontrolluar për një version më të ri…
 	Checkmark	Shenjë vlefshmërie
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Zgjidhni një imazh PNG ose JPEG (deri në 4 MiB). Transparenca ruhet.
 	Choose a folder for the exported files	Zgjidhni një dosje për skedarët e eksportuar
@@ -450,7 +448,6 @@
 	Correct recognized text	Korrigjo tekstin e njohur
 	Could not save: {e}	Nuk u ruajt: {e}
 	Couldn't add {name}: {e}	Nuk u shtua {name}: {e}
-	Couldn't check for updates: {e}	Nuk u kontrollua për përditësime: {e}
 	Couldn't combine files: {e}	Nuk u bashkuan skedarët: {e}
 	Couldn't create a PDF: {e}	Nuk u krijua dot një PDF: {e}
 	Couldn't download {name}: {e}	Nuk u shkarkua {name}: {e}
@@ -1317,7 +1314,6 @@
 	PdfCraft on GitHub	PdfCraft në GitHub
 	PdfCraft web page	Faqja ueb e PdfCraft
 	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft funksionon pa internet. Pa telemetri, pa llogari dhe pa përpunim në re, përveçse nëse shton një ofrues.
-	PdfCraft {c} is up to date.	PdfCraft {c} është i përditësuar.
 	PdfCraft {v} is available.	PdfCraft {v} është i disponueshëm.
 	People may need more time to respond. Check that nothing has a time limit.	Njerëzit mund të kenë nevojë për më shumë kohë për të përgjigjur. Kontrollo që asgjë të mos ketë kufi kohe.
 	Percentage	Përqindja
@@ -2002,7 +1998,6 @@
 	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Jeni gati të zbatoni 1 shenjë redaktimi. Teksti, imazhet dhe vizatimet nën shenjat, si dhe komentet dhe fushat e formularit që mbivendosen me to, hiqen përgjithmonë.
 	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Jeni gati të zbatoni {n} shenja redaktimi. Teksti, imazhet dhe vizatimet nën shenjat, si dhe komentet dhe fushat e formularit që mbivendosen me to, hiqen përgjithmonë.
 	You can pin up to {n} folders. Unpin one first.	Mund të fiksoni deri në {n} dosje. Hiqni fiksimin e njërës më parë.
-	You have version {c}. All releases are listed at {page}.	Keni versionin {c}. Të gjitha botimet janë të listuara te {page}.
 	You have version {c}. Download the new version from its release page.	Keni versionin {c}. Shkarkoni versionin e ri nga faqja e botimit.
 	Your changes will be lost if you don't save them.	Ndryshimet tuaja do të humbasin nëse nuk i ruani.
 	Your name	Emri juaj
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 5b4ba64345..0bb56f4793 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -798,14 +798,9 @@ comment menu	Edit	సవరించు
 	Copy Image in Original Format	చిత్రాన్ని అసలు ఫార్మాట్‌లో కాపీ చేయి
 	The image has been copied as a {ext} file	చిత్రం {ext} ఫైల్‌గా కాపీ చేయబడింది
 	The page has changed; select the image again	పేజీ మారింది; చిత్రాన్ని మళ్లీ ఎంచుకోండి
-	Check for updates	అప్‌డేట్‌ల కోసం తనిఖీ చేయి
 	No check has run yet.	ఇంకా తనిఖీ జరగలేదు.
-	Checking for a newer version…	కొత్త వెర్షన్ కోసం తనిఖీ చేస్తోంది…
 	PdfCraft {v} is available.	PdfCraft {v} అందుబాటులో ఉంది.
 	You have version {c}. Download the new version from its release page.	మీ వద్ద వెర్షన్ {c} ఉంది. కొత్త వెర్షన్‌ను దాని విడుదల పేజీ నుండి డౌన్‌లోడ్ చేసుకోండి.
-	PdfCraft {c} is up to date.	PdfCraft {c} తాజా వెర్షన్.
-	Couldn't check for updates: {e}	అప్‌డేట్‌ల కోసం తనిఖీ చేయడం సాధ్యం కాలేదు: {e}
-	You have version {c}. All releases are listed at {page}.	మీ వద్ద వెర్షన్ {c} ఉంది. అన్ని విడుదలల జాబితా: {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	తాజా విడుదల గురించి GitHubను అడుగుతుంది. ఏదీ ఆటోమేటిక్‌గా డౌన్‌లోడ్ లేదా ఇన్‌స్టాల్ చేయబడదు.
 	Download	డౌన్‌లోడ్ చేయి
 	Later	తర్వాత
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index 71c7d38fe8..0c2b58a812 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -771,14 +771,9 @@
 	Copy Image in Original Format	คัดลอกรูปภาพในรูปแบบเดิม
 	The image has been copied as a {ext} file	คัดลอกรูปภาพเป็นไฟล์ {ext} แล้ว
 	The page has changed; select the image again	หน้ามีการเปลี่ยนแปลง โปรดเลือกรูปภาพอีกครั้ง
-	Check for updates	ตรวจหาการอัปเดต
 	No check has run yet.	ยังไม่ได้ตรวจสอบ
-	Checking for a newer version…	กำลังตรวจหารุ่นที่ใหม่กว่า…
 	PdfCraft {v} is available.	มี PdfCraft {v} ให้ใช้งานแล้ว
 	You have version {c}. Download the new version from its release page.	คุณใช้รุ่น {c} ดาวน์โหลดรุ่นใหม่ได้จากหน้ารุ่นที่เผยแพร่
-	PdfCraft {c} is up to date.	PdfCraft {c} เป็นรุ่นล่าสุดแล้ว
-	Couldn't check for updates: {e}	ตรวจหาการอัปเดตไม่ได้: {e}
-	You have version {c}. All releases are listed at {page}.	คุณใช้รุ่น {c} รายการรุ่นทั้งหมดอยู่ที่ {page}
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	ถาม GitHub ว่ามีรุ่นล่าสุดหรือไม่ จะไม่มีการดาวน์โหลดหรือติดตั้งโดยอัตโนมัติ
 	Download	ดาวน์โหลด
 	Later	ภายหลัง
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index f76f7f5cd0..b52688606b 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -779,14 +779,9 @@
 	Copy Image in Original Format	Resmi Özgün Biçimde Kopyala
 	The image has been copied as a {ext} file	Resim {ext} dosyası olarak kopyalandı
 	The page has changed; select the image again	Sayfa değişti; resmi yeniden seçin
-	Check for updates	Güncellemeleri denetle
 	No check has run yet.	Henüz denetim yapılmadı.
-	Checking for a newer version…	Daha yeni bir sürüm denetleniyor…
 	PdfCraft {v} is available.	PdfCraft {v} kullanılabilir.
 	You have version {c}. Download the new version from its release page.	{c} sürümüne sahipsiniz. Yeni sürümü sürüm sayfasından indirin.
-	PdfCraft {c} is up to date.	PdfCraft {c} güncel.
-	Couldn't check for updates: {e}	Güncellemeler denetlenemedi: {e}
-	You have version {c}. All releases are listed at {page}.	{c} sürümüne sahipsiniz. Tüm sürümler {page} adresinde listelenmiştir.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	En son sürüm için GitHub'ı sorgular. Hiçbir şey otomatik olarak indirilmez veya kurulmaz.
 	Download	İndir
 	Later	Daha sonra
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index eb7bb2ec4b..dc65faf7a2 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -821,14 +821,9 @@
 	Copy Image in Original Format	Копіювати зображення в оригінальному форматі
 	The image has been copied as a {ext} file	Зображення скопійовано як файл {ext}
 	The page has changed; select the image again	Сторінка змінилася; виберіть зображення ще раз
-	Check for updates	Перевірити оновлення
 	No check has run yet.	Перевірку ще не виконано.
-	Checking for a newer version…	Перевірка наявності новішої версії…
 	PdfCraft {v} is available.	Доступна версія PdfCraft {v}.
 	You have version {c}. Download the new version from its release page.	У вас версія {c}. Завантажте нову версію зі сторінки випуску.
-	PdfCraft {c} is up to date.	Ваша версія PdfCraft {c} актуальна.
-	Couldn't check for updates: {e}	Не вдалося перевірити оновлення: {e}
-	You have version {c}. All releases are listed at {page}.	У вас версія {c}. Усі випуски наведено на {page}.
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Запитує в GitHub найновіший випуск. Нічого не завантажується й не встановлюється автоматично.
 	Download	Завантажити
 	Later	Пізніше
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 860884ae48..e9a9a73f2b 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -342,12 +342,10 @@ theme	Appearance	Giao diện
 	Check Again	Kiểm tra lại
 	Check again	Kiểm tra lại
 	Check box is checked by default	Hộp kiểm được chọn theo mặc định
-	Check for updates	Kiểm tra bản cập nhật
 	Check spelling	Kiểm tra chính tả
 	Check the pages	Kiểm tra các trang
 	Check the pages of {name}: {why}	Kiểm tra các trang của {name}: {why}
 	Checking Options ({on} of 32 in all categories)	Tùy chọn kiểm tra ({on} trên 32 ở tất cả danh mục)
-	Checking for a newer version…	Đang kiểm tra phiên bản mới hơn…
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Chọn ảnh PNG hoặc JPEG (tối đa 4 MiB). Độ trong suốt được giữ nguyên.
 	Choose a folder for the exported files	Chọn thư mục cho các tệp đã xuất
 	Choose a folder for the extracted pages	Chọn thư mục cho các trang đã trích xuất
@@ -408,7 +406,6 @@ theme	Appearance	Giao diện
 	Copies:	Số bản sao:
 	Copy selected text	Sao chép văn bản đã chọn
 	Copy text	Sao chép văn bản
-	Couldn't check for updates: {e}	Không thể kiểm tra bản cập nhật: {e}
 	Couldn't open the printer's preferences: {e}	Không thể mở tùy chọn của máy in: {e}
 	Counterclockwise 90 degrees	Ngược chiều kim đồng hồ 90 độ
 	Country/Region	Quốc gia/Khu vực
@@ -910,7 +907,6 @@ theme	Appearance	Giao diện
 	Patterns (graphics objects)	Họa tiết (đối tượng đồ họa)
 	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft không đóng bình thường. Các tài liệu này có thay đổi đã được tự động lưu:
 	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft hoạt động ngoại tuyến. Không thu thập dữ liệu sử dụng, không cần tài khoản, và không xử lý đám mây trừ khi bạn thêm nhà cung cấp.
-	PdfCraft {c} is up to date.	PdfCraft {c} đã là bản mới nhất.
 	PdfCraft {v} is available.	PdfCraft {v} đã có sẵn.
 	Percentage	Phần trăm
 	Permissions password	Mật khẩu quyền hạn
@@ -1333,7 +1329,6 @@ theme	Appearance	Giao diện
 	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	Biểu mẫu XFA: các trường và dữ liệu XFA của nó được giữ đồng bộ, nên các trình xem khác hiển thị những gì bạn điền.
 	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Bạn sắp áp dụng 1 dấu xóa. Văn bản, hình ảnh và bản vẽ nằm dưới các dấu, cũng như bình luận và trường biểu mẫu chồng lên chúng, sẽ bị xóa vĩnh viễn.
 	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Bạn sắp áp dụng {n} dấu xóa. Văn bản, hình ảnh và bản vẽ nằm dưới các dấu, cũng như bình luận và trường biểu mẫu chồng lên chúng, sẽ bị xóa vĩnh viễn.
-	You have version {c}. All releases are listed at {page}.	Bạn đang dùng phiên bản {c}. Tất cả các bản phát hành được liệt kê tại {page}.
 	You have version {c}. Download the new version from its release page.	Bạn đang dùng phiên bản {c}. Hãy tải phiên bản mới từ trang phát hành của nó.
 	Your changes will be lost if you don't save them.	Các thay đổi của bạn sẽ bị mất nếu bạn không lưu.
 	ZIP	ZIP
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 995acc78e6..5f08576b8e 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -492,14 +492,9 @@
 	Copy Image in Original Format	以原始格式复制图像
 	The image has been copied as a {ext} file	图像已复制为 {ext} 文件
 	The page has changed; select the image again	页面已更改；请重新选择图像
-	Check for updates	检查更新
 	No check has run yet.	尚未运行检查。
-	Checking for a newer version…	正在检查新版本…
 	PdfCraft {v} is available.	PdfCraft {v} 可用。
 	You have version {c}. Download the new version from its release page.	当前版本为 {c}。请从其发布页面下载新版本。
-	PdfCraft {c} is up to date.	PdfCraft {c} 已是最新。
-	Couldn't check for updates: {e}	无法检查更新：{e}
-	You have version {c}. All releases are listed at {page}.	当前版本为 {c}。所有版本列在 {page}。
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	向 GitHub 查询最新版本。不会自动下载或安装任何内容。
 	Download	下载
 	Later	稍后
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 79b67e6e70..2570f12f1c 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -445,14 +445,9 @@
 	Copy Image in Original Format	以原始格式複製圖片
 	The image has been copied as a {ext} file	圖片已複製為 {ext} 檔案
 	The page has changed; select the image again	頁面已變更；請重新選取圖片
-	Check for updates	檢驗更新
 	No check has run yet.	尚未執行檢驗。
-	Checking for a newer version…	正在檢驗新版本…
 	PdfCraft {v} is available.	PdfCraft {v} 可用。
 	You have version {c}. Download the new version from its release page.	目前版本為 {c}。請從其釋出頁面下載新版本。
-	PdfCraft {c} is up to date.	PdfCraft {c} 已是最新。
-	Couldn't check for updates: {e}	無法檢驗更新：{e}
-	You have version {c}. All releases are listed at {page}.	目前版本為 {c}。所有版本列在 {page}。
 	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	向 GitHub 搜尋最新版本。不會自動下載或安裝任何內容。
 	Download	下載
 	Later	稍後
diff --git a/crates/ui-egui/src/platform/updates.rs b/crates/ui-egui/src/platform/updates.rs
index 7ffebdcbc0..6b7ea291fa 100644
--- a/crates/ui-egui/src/platform/updates.rs
+++ b/crates/ui-egui/src/platform/updates.rs
@@ -1,11 +1,13 @@
 //! Help ▸ Check for updates and the check at start, through `craft_update`: the flow itself is its
-//! `Updater`; this module supplies the suite, the quit path and the status dialog.
+//! `Updater`; this module supplies the suite and the quit path, and shows the result in
+//! `craft_update`'s `CheckResultDialog`.
 
 #[cfg(not(target_arch = "wasm32"))]
 use craft_update::updater::{Action, CheckSource, Status, Updater};
-use egui::{Align, Layout};
+#[cfg(not(target_arch = "wasm32"))]
+use craft_update::{CheckResultDialog, CheckResultResponse};
 
-use crate::{PdfCraftApp, theme, widgets};
+use crate::PdfCraftApp;
 
 /// Where every PdfCraft release is listed.
 pub const RELEASES_PAGE: &str = "https://github.com/storytold/pdfcraft/releases";
@@ -99,63 +101,18 @@ pub(crate) fn dialog(app: &mut PdfCraftApp, ctx: &egui::Context) {
         if app.updates.open && !app.updates.check_requested && matches!(app.updates.updater.status(), Status::Idle) {
             app.updates.open = false;
         }
-    }
-    if !app.updates.open {
-        return;
-    }
-    let t = theme::Tokens::get(ctx);
-    let current = env!("CARGO_PKG_VERSION");
-    let mut close = false;
-    let modal = crate::widgets::show_modal(ctx, "updates", |ui| {
-        ui.set_width(420.0);
-        ui.horizontal(|ui| {
-            ui.add(crate::icons::image("cloud", 22.0, t.accent));
-            ui.label(egui::RichText::new(tl!("Check for updates")).font(theme::semibold(16.0)));
-        });
-        ui.add_space(8.0);
-        #[cfg(not(target_arch = "wasm32"))]
-        match app.updates.updater.status() {
-            Status::Idle => {
-                ui.horizontal(|ui| {
-                    ui.spinner();
-                    ui.label(tl!("Checking for a newer version…"));
-                });
-            }
-            Status::Checking => {
-                ui.horizontal(|ui| {
-                    ui.spinner();
-                    ui.label(tl!("Checking for a newer version…"));
-                });
-            }
-            Status::UpToDate => {
-                ui.label(crate::i18n::fmt(tl!("PdfCraft {c} is up to date."), &[("c", current)]));
-            }
-            Status::Failed(e) => {
-                ui.label(crate::i18n::fmt(tl!("Couldn't check for updates: {e}"), &[("e", e)]));
-                ui.label(
-                    egui::RichText::new(crate::i18n::fmt(
-                        tl!("You have version {c}. All releases are listed at {page}."),
-                        &[("c", current), ("page", RELEASES_PAGE)],
-                    ))
-                    .color(t.text_muted),
-                );
+        if app.updates.open {
+            let dialog = CheckResultDialog::new(&crate::UPDATE_APP, env!("CARGO_PKG_VERSION"));
+            match dialog.show(ctx, app.updates.updater.status()) {
+                CheckResultResponse::None => {}
+                CheckResultResponse::Close => {
+                    app.updates.open = false;
+                    app.updates.updater.dismiss_status();
+                }
+                CheckResultResponse::CheckAgain => app.updates.check_requested = true,
             }
         }
-        #[cfg(target_arch = "wasm32")]
-        let _ = (&t, current);
-        ui.add_space(10.0);
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if widgets::pill_button(ui, tl!("Close"), true).clicked() {
-                close = true;
-            }
-        });
-    });
-    if modal.should_close() {
-        close = true;
-    }
-    if close {
-        app.updates.open = false;
-        #[cfg(not(target_arch = "wasm32"))]
-        app.updates.updater.dismiss_status();
     }
+    #[cfg(target_arch = "wasm32")]
+    let _ = (app, ctx);
 }
diff --git a/crates/ui-egui/tests/it/updates.rs b/crates/ui-egui/tests/it/updates.rs
index d2eaa7c660..3ea55e434e 100644
--- a/crates/ui-egui/tests/it/updates.rs
+++ b/crates/ui-egui/tests/it/updates.rs
@@ -38,7 +38,7 @@ fn settle(h: &mut Harness<'static, PdfCraftApp>) {
     let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
     loop {
         h.run_steps(2);
-        if h.query_by_label_contains("Checking for a newer version").is_none() {
+        if h.query_by_label_contains("Checking for updates").is_none() {
             break;
         }
         assert!(std::time::Instant::now() < deadline, "timed out waiting for the update check");
@@ -64,13 +64,14 @@ fn an_up_to_date_or_failed_check_says_so() {
     let mut h = harness(Ok(None));
     h.state_mut().execute("help.check_updates");
     settle(&mut h);
-    h.get_by_label_contains("is up to date");
+    h.get_by_label_contains("is the newest version available");
     assert!(h.query_by_label("Download").is_none());
 
     let mut h = harness(Err("couldn't reach GitHub"));
     h.state_mut().execute("help.check_updates");
     settle(&mut h);
-    h.get_by_label_contains("Couldn't check for updates: couldn't reach GitHub");
+    h.get_by_label_contains("Could not check for updates.");
+    h.get_by_label_contains("couldn't reach GitHub");
 }
 
 #[test]

From 13655d09922038ab62d93b84ba9cd2eae474abd7 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Sat, 31 Oct 2026 15:33:25 -0400
Subject: [PATCH 261/270] packaging(flatpak): add OCI image build and GHCR
 publishing helper (#5526)

---
 packaging/linux/flatpak-bundle.sh |  9 +++++
 packaging/linux/flatpak-oci.sh    | 64 +++++++++++++++++++++++++++++++
 2 files changed, 73 insertions(+)
 create mode 100755 packaging/linux/flatpak-oci.sh

diff --git a/packaging/linux/flatpak-bundle.sh b/packaging/linux/flatpak-bundle.sh
index 26e09cd1c8..0534b3194e 100755
--- a/packaging/linux/flatpak-bundle.sh
+++ b/packaging/linux/flatpak-bundle.sh
@@ -20,10 +20,12 @@ APP_ID=ai.storyteller.pdfcraft
 FLATHUB=https://dl.flathub.org/repo/flathub.flatpakrepo
 
 TEST=1
+OCI=0
 TARBALL=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --no-test) TEST=0; shift ;;
+    --oci) OCI=1; shift ;;
     -h | --help) sed -n '2,14p' "$0"; exit 0 ;;
     -*) echo "unknown argument: $1" >&2; exit 2 ;;
     *) TARBALL="$1"; shift ;;
@@ -62,6 +64,13 @@ OUT="$DIST/$BASENAME.flatpak"
 flatpak build-bundle --runtime-repo="$FLATHUB" "$WORK/repo" "$OUT" "$APP_ID" stable
 echo "wrote $OUT"
 
+if [[ "$OCI" = 1 ]]; then
+  OUT_OCI="$DIST/$BASENAME-oci"
+  rm -rf "$OUT_OCI"
+  flatpak build-bundle --oci "$WORK/repo" "$OUT_OCI" "$APP_ID" stable
+  echo "wrote OCI layout to $OUT_OCI"
+fi
+
 if [[ "$TEST" = 1 ]]; then
   flatpak install --user -y --noninteractive --reinstall "$OUT"
   flatpak info --user "$APP_ID"
diff --git a/packaging/linux/flatpak-oci.sh b/packaging/linux/flatpak-oci.sh
new file mode 100755
index 0000000000..0572ef1a3a
--- /dev/null
+++ b/packaging/linux/flatpak-oci.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Build PdfCraft as an OCI container layout and push it to GitHub Container Registry (GHCR)
+# for consumption by Flatpak OCI clients (flatpak-oci-specs).
+#
+# Usage:
+#   packaging/linux/flatpak-oci.sh [--push] [TARBALL]
+#
+# Environment variables:
+#   REGISTRY       Target registry image (default: ghcr.io/storytold/pdfcraft)
+#   TAG            Target image tag (default: $VERSION-$ARCH, also tags stable and latest)
+#   GITHUB_TOKEN   Token for GHCR authentication when --push is used
+set -euo pipefail
+# shellcheck source=../env.sh
+. "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
+HERE="$ROOT/packaging/linux"
+
+PUSH=0
+TARBALL=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --push) PUSH=1; shift ;;
+    -h | --help) sed -n '2,12p' "$0"; exit 0 ;;
+    -*) echo "unknown argument: $1" >&2; exit 2 ;;
+    *) TARBALL="$1"; shift ;;
+  esac
+done
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64) ;;
+  aarch64 | arm64) ARCH=aarch64 ;;
+  *) echo "unsupported architecture $ARCH" >&2; exit 2 ;;
+esac
+
+BASENAME="pdfcraft-$VERSION-linux-$ARCH"
+OUT_OCI="$DIST/$BASENAME-oci"
+
+echo "==> Building Flatpak OCI layout for $BASENAME"
+"$HERE/flatpak-bundle.sh" --oci --no-test "${TARBALL:-}"
+
+[[ -d "$OUT_OCI" ]] || { echo "error: $OUT_OCI layout not generated" >&2; exit 1; }
+
+REGISTRY="${REGISTRY:-ghcr.io/storytold/pdfcraft}"
+TAG="${TAG:-$VERSION-$ARCH}"
+
+echo "==> OCI layout ready at $OUT_OCI (Target: $REGISTRY:$TAG)"
+
+if [[ "$PUSH" = 1 ]]; then
+  command -v skopeo >/dev/null || { echo "error: skopeo is required to push OCI images (apt install skopeo)" >&2; exit 1; }
+
+  AUTH_ARGS=()
+  if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+    AUTH_ARGS=(--dest-creds "${GITHUB_ACTOR:-storytold}:$GITHUB_TOKEN")
+  fi
+
+  echo "==> Pushing to $REGISTRY:$TAG"
+  skopeo copy --format oci "${AUTH_ARGS[@]}" "oci:$OUT_OCI" "docker://$REGISTRY:$TAG"
+
+  # Also update architecture-specific stable tag
+  echo "==> Pushing to $REGISTRY:stable-$ARCH"
+  skopeo copy --format oci "${AUTH_ARGS[@]}" "oci:$OUT_OCI" "docker://$REGISTRY:stable-$ARCH"
+
+  echo "==> Push complete"
+fi

From fdcf66d5f68156df67d77986b2952f8570505fe2 Mon Sep 17 00:00:00 2001
From: FredApps <FredApps@users.noreply.github.com>
Date: Sat, 31 Oct 2026 22:16:52 +0100
Subject: [PATCH 262/270] Apply licensing validation to newly added upstream
 Lucide icons

---
 ATTRIBUTION.md   | 8 ++++----
 ATTRIBUTION.toml | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 01a5815390..fc88e8b664 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -290,10 +290,10 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/ui-egui/src/i18n/sl.tsv` | Slovene interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Slovene UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `vendor/vello_common/assets/probe.png` | vello_common probe reference image (rendered from probe.rgba) | Linebender vello contributors | MIT OR Apache-2.0 | vello_common 0.0.8 (crates.io), vendored in vendor/vello_common; regenerated by its vello_sparse_tests regenerate_probe_reference binary | Reference picture of the vendored vello_common probe module, for people only; the build reads probe.rgba, not this file |
 | `crates/ui-egui/src/i18n/nb.tsv` | Norwegian Bokmål interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Norwegian Bokmål UI strings, compiled in by crates/ui-egui/src/i18n.rs |
-| `assets/icons/superscript.svg` | Lucide icon "superscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/superscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/subscript.svg` | Lucide icon "subscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/subscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pilcrow.svg` | Lucide icon "pilcrow" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pilcrow.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/move-horizontal.svg` | Lucide icon "move-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/superscript.svg` | Lucide icon "superscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/superscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/subscript.svg` | Lucide icon "subscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/subscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pilcrow.svg` | Lucide icon "pilcrow" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pilcrow.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/move-horizontal.svg` | Lucide icon "move-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `crates/ui-egui/src/i18n/sq.tsv` | Albanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-appearance labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Albanian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `crates/ui-egui/src/i18n/th.tsv` | Thai interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Thai UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `crates/ui-egui/src/i18n/ca.tsv` | Catalan interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, written from their meaning; no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Catalan UI strings, compiled in by crates/ui-egui/src/i18n.rs |
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 82241dd29b..76f4cf40a8 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -3461,7 +3461,7 @@ path = "assets/icons/superscript.svg"
 title = "Lucide icon \"superscript\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/superscript.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3472,7 +3472,7 @@ path = "assets/icons/subscript.svg"
 title = "Lucide icon \"subscript\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/subscript.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3483,7 +3483,7 @@ path = "assets/icons/pilcrow.svg"
 title = "Lucide icon \"pilcrow\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pilcrow.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3494,7 +3494,7 @@ path = "assets/icons/move-horizontal.svg"
 title = "Lucide icon \"move-horizontal\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-horizontal.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"

From 1d5ce9d7a92731af89f183c7530484b3b625bd52 Mon Sep 17 00:00:00 2001
From: FredApps <FredApps@users.noreply.github.com>
Date: Sat, 31 Oct 2026 22:26:16 +0100
Subject: [PATCH 263/270] Update shadow regression wheel events and retain
 upstream parity notes

---
 crates/ui-egui/tests/page_shadows.rs | 1 +
 parity/acrobat-features.toml         | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/tests/page_shadows.rs b/crates/ui-egui/tests/page_shadows.rs
index 1062605832..a83fa6ce05 100644
--- a/crates/ui-egui/tests/page_shadows.rs
+++ b/crates/ui-egui/tests/page_shadows.rs
@@ -88,6 +88,7 @@ fn scroll_down(h: &mut Harness<'static, PdfCraftApp>, points: f32) {
         delta: egui::vec2(0.0, -points),
         phase: egui::TouchPhase::Move,
         modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
     });
     h.run_steps(12);
 }
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 98bfdccc38..670b21da01 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -9928,8 +9928,8 @@ milestone = "M14"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/page_shadows.rs::viewport_fades_follow_the_preference_and_keep_other_scroll_areas_styled", "crates/ui-egui/tests/page_shadows.rs::rendered_page_content_is_identical_with_and_without_decoration", "crates/ui-egui/tests/page_shadows.rs::page_shadow_preference_round_trips_and_ignores_invalid_settings", "crates/ui-egui/tests/page_shadows.rs::viewer_shadows_follow_the_preference_without_moving_pages", "crates/ui-egui/tests/page_shadows.rs::organize_shadows_follow_the_preference", "crates/ui-egui/tests/it/control.rs::page_shadows_are_an_observable_app_wide_preference", "crates/ui-egui/tests/it/view.rs::default_page_display_is_used_for_new_documents", "crates/ui-egui/tests/it/view.rs::default_zoom_is_used_for_new_documents", "crates/ui-egui/tests/it/view.rs::preferences_set_the_default_zoom"]
-notes = "Preferences ▸ Documents and view: Default page display and Default zoom (Fit to width, Zoom to page level or a percentage) for every new tab; a PDF that asks for a layout or zoom gets it. Preferences ▸ Appearance also has an app-wide, persistent Show Page Edge Shadows checkbox (on by default), exposed through ui.set and ui.state; it affects viewer and Organize decorations, including the viewport-edge gradients painted over pages, only. Missing: Acrobat's resolution, rendering and page-content options"
+evidence = ["crates/ui-egui/tests/page_shadows.rs::viewport_fades_follow_the_preference_and_keep_other_scroll_areas_styled", "crates/ui-egui/tests/page_shadows.rs::rendered_page_content_is_identical_with_and_without_decoration", "crates/ui-egui/tests/page_shadows.rs::page_shadow_preference_round_trips_and_ignores_invalid_settings", "crates/ui-egui/tests/page_shadows.rs::viewer_shadows_follow_the_preference_without_moving_pages", "crates/ui-egui/tests/page_shadows.rs::organize_shadows_follow_the_preference", "crates/ui-egui/tests/it/control.rs::page_shadows_are_an_observable_app_wide_preference", "crates/ui-egui/tests/it/view.rs::default_page_display_is_used_for_new_documents", "crates/ui-egui/tests/it/view.rs::default_zoom_is_used_for_new_documents", "crates/ui-egui/tests/it/view.rs::preferences_set_the_default_zoom", "crates/ui-egui/tests/it/view.rs::always_use_my_default_zoom_and_page_layout_ignores_what_the_pdf_asks_for"]
+notes = "Preferences ▸ Documents and view: Default page display and Default zoom (Fit to width, Zoom to page level or a percentage) for every new tab; a PDF that asks for a layout or zoom gets it, unless Always use my default zoom and page layout is on. Preferences ▸ Appearance also has an app-wide, persistent Show Page Edge Shadows checkbox (on by default), exposed through ui.set and ui.state; it affects viewer and Organize decorations, including the viewport-edge gradients painted over pages, only. Missing: Acrobat's resolution, rendering and page-content options"
 
 [[feature]]
 id = "misc.prefs-documents"

From e5f21f2dbb25e7f3edca5f56ed81f178bf23d5a1 Mon Sep 17 00:00:00 2001
From: FredApps <FredApps@users.noreply.github.com>
Date: Sat, 31 Oct 2026 22:26:16 +0100
Subject: [PATCH 264/270] Keep licensing checks below the current complexity
 gate

---
 xtask/src/license_check.rs | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/xtask/src/license_check.rs b/xtask/src/license_check.rs
index 6b8b8c57fb..c845101db6 100644
--- a/xtask/src/license_check.rs
+++ b/xtask/src/license_check.rs
@@ -245,6 +245,11 @@ fn check(root: &Path, docs: &Documents, attribution: &assets::Manifest) -> Vec<S
             problems.push(format!("{}: Lucide collection must credit ISC and Feather MIT", a.path));
         }
     }
+    check_model_metadata(attribution, &mut problems);
+    problems
+}
+
+fn check_model_metadata(attribution: &assets::Manifest, problems: &mut Vec<String>) {
     let mut model_paths = BTreeSet::new();
     for f in attribution.fetched.iter().filter(|f| f.kind == "model") {
         if [f.title.as_str(), &f.author, &f.source, &f.usage, &f.licence].iter().any(|v| v.trim().is_empty())
@@ -265,7 +270,6 @@ fn check(root: &Path, docs: &Documents, attribution: &assets::Manifest) -> Vec<S
             }
         }
     }
-    problems
 }
 
 #[cfg(test)]

From 9a655ddb2dc8965bbfb1ad98776a4ebdff6b04d8 Mon Sep 17 00:00:00 2001
From: Combiler01 <HVcommercial@outlook.com>
Date: Sat, 31 Oct 2026 20:33:48 +0530
Subject: [PATCH 265/270] test(optimize): accept Flate or CCITT compression in
 monochrome scan test

---
 crates/optimize/tests/optimize.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 2e3ea2d42f..683cbd0684 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1775,7 +1775,8 @@ fn monochrome_images_keep_what_they_should() {
     optimize(&mut doc, &Settings::default()).unwrap();
     assert_eq!([alone, deep].map(|r| raw(&doc, r)), before, "a Group 4 halftone alone, and sixteen-bit grey");
     assert_eq!(filters(&doc, wrapped), 1, "a wrapped Group 4 halftone is stored again alone by default");
-    assert_eq!(stream(&doc, scan).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "the scan: Group 4 is smaller");
+    assert!(matches!(stream(&doc, scan).filters().as_slice(), [(Filter::CcittFax | Filter::Flate, _)]), "the scan: Group 4 or Flate");
+    assert_eq!(doc.decoded_image(&stream(&doc, scan)).unwrap(), ragged, "the scan preserves every sample");
     assert_eq!((stream(&doc, fax).dict.name(b"Filter"), filters(&doc, fax)), (Some(&b"CCITTFaxDecode"[..]), 1), "the busy fax image");
 
     let (mut doc, [_, wrapped, scan, _, _]) = build();

From 0475725247ec762247c3bb6a48d6e3abff9e4a06 Mon Sep 17 00:00:00 2001
From: Combiler01 <HVcommercial@outlook.com>
Date: Sat, 31 Oct 2026 20:33:48 +0530
Subject: [PATCH 266/270] test(optimize): accept Flate or CCITT compression in
 monochrome scan test

---
 crates/optimize/tests/optimize.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 2e3ea2d42f..683cbd0684 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1775,7 +1775,8 @@ fn monochrome_images_keep_what_they_should() {
     optimize(&mut doc, &Settings::default()).unwrap();
     assert_eq!([alone, deep].map(|r| raw(&doc, r)), before, "a Group 4 halftone alone, and sixteen-bit grey");
     assert_eq!(filters(&doc, wrapped), 1, "a wrapped Group 4 halftone is stored again alone by default");
-    assert_eq!(stream(&doc, scan).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "the scan: Group 4 is smaller");
+    assert!(matches!(stream(&doc, scan).filters().as_slice(), [(Filter::CcittFax | Filter::Flate, _)]), "the scan: Group 4 or Flate");
+    assert_eq!(doc.decoded_image(&stream(&doc, scan)).unwrap(), ragged, "the scan preserves every sample");
     assert_eq!((stream(&doc, fax).dict.name(b"Filter"), filters(&doc, fax)), (Some(&b"CCITTFaxDecode"[..]), 1), "the busy fax image");
 
     let (mut doc, [_, wrapped, scan, _, _]) = build();

From af03f08494842ea14dc1f95796047a872be9b3bc Mon Sep 17 00:00:00 2001
From: Combiler01 <HVcommercial@outlook.com>
Date: Sat, 31 Oct 2026 20:33:48 +0530
Subject: [PATCH 267/270] test(optimize): accept Flate or CCITT compression in
 monochrome scan test

---
 crates/optimize/tests/optimize.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 2e3ea2d42f..683cbd0684 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1775,7 +1775,8 @@ fn monochrome_images_keep_what_they_should() {
     optimize(&mut doc, &Settings::default()).unwrap();
     assert_eq!([alone, deep].map(|r| raw(&doc, r)), before, "a Group 4 halftone alone, and sixteen-bit grey");
     assert_eq!(filters(&doc, wrapped), 1, "a wrapped Group 4 halftone is stored again alone by default");
-    assert_eq!(stream(&doc, scan).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "the scan: Group 4 is smaller");
+    assert!(matches!(stream(&doc, scan).filters().as_slice(), [(Filter::CcittFax | Filter::Flate, _)]), "the scan: Group 4 or Flate");
+    assert_eq!(doc.decoded_image(&stream(&doc, scan)).unwrap(), ragged, "the scan preserves every sample");
     assert_eq!((stream(&doc, fax).dict.name(b"Filter"), filters(&doc, fax)), (Some(&b"CCITTFaxDecode"[..]), 1), "the busy fax image");
 
     let (mut doc, [_, wrapped, scan, _, _]) = build();

From b77699a22b043c3fa861ab5dd9fbdc5a6f4b77a4 Mon Sep 17 00:00:00 2001
From: Combiler01 <HVcommercial@outlook.com>
Date: Sat, 31 Oct 2026 20:33:48 +0530
Subject: [PATCH 268/270] test(optimize): accept Flate or CCITT compression in
 monochrome scan test

---
 crates/optimize/tests/optimize.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 2e3ea2d42f..683cbd0684 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1775,7 +1775,8 @@ fn monochrome_images_keep_what_they_should() {
     optimize(&mut doc, &Settings::default()).unwrap();
     assert_eq!([alone, deep].map(|r| raw(&doc, r)), before, "a Group 4 halftone alone, and sixteen-bit grey");
     assert_eq!(filters(&doc, wrapped), 1, "a wrapped Group 4 halftone is stored again alone by default");
-    assert_eq!(stream(&doc, scan).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "the scan: Group 4 is smaller");
+    assert!(matches!(stream(&doc, scan).filters().as_slice(), [(Filter::CcittFax | Filter::Flate, _)]), "the scan: Group 4 or Flate");
+    assert_eq!(doc.decoded_image(&stream(&doc, scan)).unwrap(), ragged, "the scan preserves every sample");
     assert_eq!((stream(&doc, fax).dict.name(b"Filter"), filters(&doc, fax)), (Some(&b"CCITTFaxDecode"[..]), 1), "the busy fax image");
 
     let (mut doc, [_, wrapped, scan, _, _]) = build();

From 9af62ceb386d236fc9eec1e33c5606258eadb7b8 Mon Sep 17 00:00:00 2001
From: FredApps <FredApps@users.noreply.github.com>
Date: Sat, 31 Oct 2026 23:07:05 +0100
Subject: [PATCH 269/270] Isolate UI frame-budget measurements under nextest

---
 .config/nextest.toml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.config/nextest.toml b/.config/nextest.toml
index 2a4cd2cb93..11ec94cc1a 100644
--- a/.config/nextest.toml
+++ b/.config/nextest.toml
@@ -1,3 +1,10 @@
 # Minimum cargo-nextest for this repository: GHSA-vc25-qg58-w57c is fixed in 0.9.150 and CI
 # installs exactly that version, so an older nextest refuses to run (exit 92 REQUIRED_VERSION_NOT_MET).
 nextest-version = "0.9.150"
+
+# These measurements require a quiet runner. Their in-process SERIAL mutex only
+# serializes cargo test; nextest gives each test its own process. Reserve all slots
+# so other tests cannot charge their CPU/render-worker time to a frame budget.
+[[profile.default.overrides]]
+filter = 'package(pdfcraft-ui-egui) & binary(perf)'
+threads-required = "num-test-threads"

From 47f42ba07b61553da50ca2df91b070519bd3386e Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Sat, 31 Oct 2026 23:43:03 -0400
Subject: [PATCH 270/270] ci: grant packages write permission to release
 workflow

---
 .github/workflows/release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a5c2ba7f7f..d8549142f7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,6 +12,7 @@ on:
 
 permissions:
   contents: write
+  packages: write
 
 concurrency:
   group: release-${{ github.ref }}